6fd7d0010d859f90b75fab3af80b8bbdf1d1ed56bd3e4dbc72c02958ae86eef7

Sharing

Copy URL Twitter E-mail

General

Target
6fd7d0010d859f90b75fab3af80b8bbdf1d1ed56bd3e4dbc72c02958ae86eef7
Size 1.1MB
Sample261011-v5e48svsbv
SHA256 6fd7d0010d859f90b75fab3af80b8bbdf1d1ed56bd3e4dbc72c02958ae86eef7
MD5 13c3f6c5bfcdf55c24495233d2edc5b1
SHA1 ace91227a288b672e1f5f49cac103d8098856753
SHA512 3f3e20ac6faed514d1dbb1cdfb7a040881519af468845dffb1c04a0a417d44a675d7fe1b5c6eff553041dccda96f1aa9b2d5f876034e30c553d434d7103d85c7
SSDEEP 24576:0eKdyEbnYXC9K0kd8iSZjozxT4KjiRQzIiMufWHd9:0eKdqy9K0k9SZjoz2eUiMuf0d9
TLSH
T145354A207642813AE9B300B2CEBE961D5168FA210B6654C3B3CC6D6E5FB5DE23E37547
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6fd7d0010d859f90b75fab3af80b8bbdf1d1ed56bd3e4dbc72c02958ae86eef7

File Explorer

6fd7d0010d859f90b75fab3af80b8bbdf1d1ed56bd3e4dbc72c02958ae86eef7

.exe 1.1MB

6fd7d0010d859f90b75fab3af80b8bbdf1d1ed56bd3e4dbc72c02958ae86eef7

IMPHASH c46c09913ce3023eb67bef60720badf8
SHA256 6fd7d0010d859f90b75fab3af80b8bbdf1d1ed56bd3e4dbc72c02958ae86eef7
MD5 13c3f6c5bfcdf55c24495233d2edc5b1
SHA1 ace91227a288b672e1f5f49cac103d8098856753
SHA512 3f3e20ac6faed514d1dbb1cdfb7a040881519af468845dffb1c04a0a417d44a675d7fe1b5c6eff553041dccda96f1aa9b2d5f876034e30c553d434d7103d85c7
SSDEEP 24576:0eKdyEbnYXC9K0kd8iSZjozxT4KjiRQzIiMufWHd9:0eKdqy9K0k9SZjoz2eUiMuf0d9
TLSH
T145354A207642813AE9B300B2CEBE961D5168FA210B6654C3B3CC6D6E5FB5DE23E37547
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

618173

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\JCP\Release\printer.pdb

kernel32

UnmapViewOfFile OpenFileMappingW GetTempPathW FindResourceW LoadResource LockResource SizeofResource FreeResource FindFirstFileW FindClose CreateFileW FormatMessageW LocalFree SetEvent ResetEvent FreeLibrary lstrcmpiW LoadLibraryExW DecodePointer ReleaseMutex CreateMutexW lstrlenA HeapReAlloc FormatMessageA GetSystemInfo SwitchToThread GetProcessHeap HeapAlloc HeapFree InterlockedExchange HeapSize InterlockedExchangeAdd GetModuleHandleA TlsAlloc TlsFree DeviceIoControl MultiByteToWideChar GetModuleHandleW GetProcAddress lstrcmpW MulDiv MapViewOfFile GlobalLock GlobalUnlock LoadLibraryW SetEnvironmentVariableA WriteConsoleW SetStdHandle UnregisterWaitEx QueryDepthSList InterlockedFlushSList GetVersionExW FreeLibraryAndExitThread GetThreadTimes FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTimeZoneInformation ReadConsoleW GetOEMCP GetACP IsValidCodePage ReadFile FlushFileBuffers GetFileType GetStdHandle GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation CreateFileMappingW WaitForSingleObject CreateEventW SetFileTime CloseHandle GetFileTime CreateFileA GetModuleFileNameA WideCharToMultiByte GlobalAlloc Sleep SetLastError InterlockedIncrement InterlockedDecrement GetModuleFileNameW LeaveCriticalSection EnterCriticalSection GetCurrentThreadId RaiseException DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError FlushInstructionCache GetCurrentProcess GetThreadPriority SetThreadPriority SignalObjectAndWait WaitForSingleObjectEx CreateTimerQueue ExitThread CreateThread CreateSemaphoreW GetStartupInfoW TlsSetValue TlsGetValue TerminateProcess UnhandledExceptionFilter GetCPInfo RtlUnwind RemoveDirectoryW GetFileAttributesW DeleteFileW CreateDirectoryW OutputDebugStringW IsDebuggerPresent VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetStringTypeW GetSystemTimeAsFileTime EncodePointer GetCommandLineW GetModuleHandleExW ExitProcess VirtualQuery VirtualProtect AreFileApisANSI OpenMutexW OpenEventW SetUnhandledExceptionFilter GetCurrentProcessId GetTickCount DuplicateHandle ReleaseSemaphore SetEndOfFile SetFilePointerEx WriteFile GetCurrentThread

user32

GetDesktopWindow ReleaseDC GetDC InvalidateRect InvalidateRgn GetClientRect SetWindowTextW PostQuitMessage PostMessageW SetWindowLongW DestroyAcceleratorTable DefWindowProcW CallWindowProcW UnregisterClassW GetMessageW TranslateMessage DispatchMessageW SendMessageW GetForegroundWindow RegisterClassExW GetClassInfoExW LoadCursorW GetWindowLongW GetDlgItem wsprintfW MessageBoxA ShowWindow SystemParametersInfoW RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW BeginPaint EndPaint IsChild GetFocus SetFocus GetWindow FillRect IsWindow GetClassNameW GetSysColor CharNextW SetWindowPos RedrawWindow CreateWindowExW CreateAcceleratorTableW ClientToScreen GetParent ScreenToClient MoveWindow SetCapture ReleaseCapture DestroyWindow

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject BitBlt DeleteDC GetStockObject GetObjectW GetDeviceCaps CreateSolidBrush

advapi32

CryptAcquireContextW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegDeleteValueW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW OpenProcessToken RegSetValueExW RegCreateKeyExW RegCloseKey CryptReleaseContext CryptGenRandom

shell32

ShellExecuteW

ole32

StringFromCLSID CoTaskMemFree CoTaskMemAlloc StringFromGUID2 OleLockRunning CreateStreamOnHGlobal CoCreateInstance CoGetClassObject CLSIDFromProgID CLSIDFromString OleUninitialize OleInitialize CoTaskMemRealloc CoUninitialize OleRun CoInitialize

oleaut32

VarBstrCmp SysStringByteLen SysAllocStringByteLen VarUI4FromStr SafeArrayUnlock SafeArrayLock SafeArrayDestroy SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetVartype VariantCopy VariantChangeType DispCallFunc SysAllocStringLen VariantInit VariantClear OleCreateFontIndirect SysAllocString LoadTypeLi LoadRegTypeLi SysFreeString SysStringLen GetErrorInfo

userenv

GetUserProfileDirectoryA

ws2_32

WSACleanup WSAStartup

Sharing

General

Malware Config

Signatures

File Explorer

6fd7d0010d859f90b75fab3af80b8bbdf1d1ed56bd3e4dbc72c02958ae86eef7

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

userenv

ws2_32

generic