6c09e8c22ed08acc8a8cffcfb737461077509aab2fa8059be3963eb7487ef804

Sharing

Copy URL Twitter E-mail

General

Target
6c09e8c22ed08acc8a8cffcfb737461077509aab2fa8059be3963eb7487ef804
Size 10.4MB
Sample261011-mapfesga55
SHA256 6c09e8c22ed08acc8a8cffcfb737461077509aab2fa8059be3963eb7487ef804
MD5 06384631310fd37cabb74fe4e09f711b
SHA1 3bc13009ea78116428a2ccdfdfc57fe0ae271401
SHA512 63edc50b4d09ab1b3843b9eb3a32b5450d55a3e4d76fa2315606c3a67207c68d262b27db678e6b5ae14a26eec5eb1ebbd23b038a625f3f15d85c593946b62c4a
SSDEEP 196608:XZGmuzsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSg:XZGnzsREJLODBWlX3d+NpvdHIoP
TLSH
T195B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c09e8c22ed08acc8a8cffcfb737461077509aab2fa8059be3963eb7487ef804

File Explorer

6c09e8c22ed08acc8a8cffcfb737461077509aab2fa8059be3963eb7487ef804

.exe 10.4MB

6c09e8c22ed08acc8a8cffcfb737461077509aab2fa8059be3963eb7487ef804

IMPHASH 0404010961d0132a3678c4a79bac94bf
SHA256 6c09e8c22ed08acc8a8cffcfb737461077509aab2fa8059be3963eb7487ef804
MD5 06384631310fd37cabb74fe4e09f711b
SHA1 3bc13009ea78116428a2ccdfdfc57fe0ae271401
SHA512 63edc50b4d09ab1b3843b9eb3a32b5450d55a3e4d76fa2315606c3a67207c68d262b27db678e6b5ae14a26eec5eb1ebbd23b038a625f3f15d85c593946b62c4a
SSDEEP 196608:XZGmuzsR2/LGPLCXOKODxH5qFlXS47dV2MANpvrjVbEKGWIoSg:XZGnzsREJLODBWlX3d+NpvdHIoP
TLSH
T195B61233A1908066D289193956736F3879F8975D5EB0CCB3F7E4ECE22D624E1E72710A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8910904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTimeZoneInformation RaiseException RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile GetSystemTime LockFile FlushFileBuffers SetFilePointer DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement InterlockedIncrement GetLocalTime TerminateProcess HeapSize GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr SetStdHandle WideCharToMultiByte MultiByteToWideChar GetCurrentProcess GetWindowsDirectoryA GetSystemDirectoryA TerminateThread CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW RemoveDirectoryA GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree CloseHandle WaitForSingleObject CreateProcessA GetTickCount GetCommandLineA MulDiv GetProcAddress GetModuleHandleA GetVolumeInformationA SetCurrentDirectoryA CreateDirectoryA CopyFileA DeleteFileA DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA UnlockFile VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount GlobalFree GetProcAddress LocalAlloc LocalFree ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetForegroundWindow LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild TrackPopupMenu DestroyMenu SetForegroundWindow UnregisterClassA EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetSysColorBrush EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle GetWindowRect GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

GetViewportExtEx PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextMetricsA ExtSelectClipRgn OffsetViewportOrgEx SetBkColor CreateRectRgnIndirect SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject CreatePen PatBlt CombineRgn CreateRectRgn SetViewportOrgEx SetMapMode SetTextColor SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps LineTo MoveToEx ExcludeClipRect GetClipBox ScaleWindowExtEx SetWindowExtEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx

winmm

waveOutGetNumDevs waveOutPrepareHeader waveOutUnprepareHeader waveOutOpen midiOutUnprepareHeader midiStreamOpen waveOutClose midiOutPrepareHeader midiStreamOut midiStreamStop midiOutReset midiStreamClose midiStreamRestart waveOutReset waveOutPause midiStreamProperty waveOutWrite

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegCreateKeyExA RegCloseKey RegOpenKeyExA RegSetValueExA RegQueryValueA

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA ShellExecuteA

ole32

CLSIDFromProgID OleRun CoCreateInstance CLSIDFromString OleUninitialize OleInitialize

oleaut32

VariantClear VariantChangeType SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetDim SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElement VariantCopyInd VariantInit SysAllocString RegisterTypeLi LHashValOfNameSys LoadTypeLi UnRegisterTypeLi

comctl32

ImageList_GetImageCount ImageList_Duplicate ImageList_Read ImageList_Destroy ImageList_SetBkColor ord17

ws2_32

inet_ntoa WSACleanup closesocket WSAAsyncSelect recvfrom ioctlsocket recv getpeername accept

comdlg32

GetFileTitleA GetOpenFileNameA ChooseColorA GetSaveFileNameA

wtsapi32

WTSSendMessageW

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

264KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

80KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

oiNRhy0

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

oiNRhy1

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

180KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6c09e8c22ed08acc8a8cffcfb737461077509aab2fa8059be3963eb7487ef804

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

wtsapi32

generic