39d64c034b53ee0ed960cb765ec7a6f5263958f87a9160137b65471dbcca3244

Sharing

Copy URL Twitter E-mail

General

Target
39d64c034b53ee0ed960cb765ec7a6f5263958f87a9160137b65471dbcca3244
Size 2.1MB
Sample261012-s2qqfscs5x
SHA256 39d64c034b53ee0ed960cb765ec7a6f5263958f87a9160137b65471dbcca3244
MD5 8947f286a69893700a9570a4bf562903
SHA1 340960e3197a75e2b71b05665fa5bf82ad01dea6
SHA512 1ebbf57e5e27febb3de0210229211756c82999195d559546b4e852b5002dd45ece44814790e6b2630d53b73641036b9c52211e2abb7c73f9ac2d2ed29ed3974f
SSDEEP 49152:Jvn9nIezApGzBMKi0TE3bEYFf6ap5ATjs4nqUi5TUHKL+u:Jv/4GzBMKiyE3MapGTVqUOSKL+u
TLSH
T143A502AE22A086F4D1762038A14B7A03D5693C55074196FB63E4C8F75FB3AD4EE33366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39d64c034b53ee0ed960cb765ec7a6f5263958f87a9160137b65471dbcca3244

File Explorer

39d64c034b53ee0ed960cb765ec7a6f5263958f87a9160137b65471dbcca3244

.exe 2.1MB

39d64c034b53ee0ed960cb765ec7a6f5263958f87a9160137b65471dbcca3244

IMPHASH a2c120b593819e2b4cecfe1a8bffb19b
SHA256 39d64c034b53ee0ed960cb765ec7a6f5263958f87a9160137b65471dbcca3244
MD5 8947f286a69893700a9570a4bf562903
SHA1 340960e3197a75e2b71b05665fa5bf82ad01dea6
SHA512 1ebbf57e5e27febb3de0210229211756c82999195d559546b4e852b5002dd45ece44814790e6b2630d53b73641036b9c52211e2abb7c73f9ac2d2ed29ed3974f
SSDEEP 49152:Jvn9nIezApGzBMKi0TE3bEYFf6ap5ATjs4nqUi5TUHKL+u:Jv/4GzBMKiyE3MapGTVqUOSKL+u
TLSH
T143A502AE22A086F4D1762038A14B7A03D5693C55074196FB63E4C8F75FB3AD4EE33366
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

325896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

user32

GetCursorPos ClientToScreen ScreenToClient LoadCursorW SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture SetCursor GetCapture TranslateMessage GetMessageExtraInfo TrackMouseEvent DispatchMessageW PeekMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow UpdateWindow EnumWindows GetClassNameW GetKeyboardLayout EmptyClipboard GetTopWindow GetClipboardData GetKeyState GetWindowThreadProcessId SetClipboardData GetWindow CloseClipboard OpenClipboard

shell32

ShellExecuteExW

kernel32

DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetFileInformationByHandleEx SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA IsDebuggerPresent GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetStartupInfoW GetCurrentThreadId FreeConsole GetLastError GetModuleHandleA GetProcAddress LoadLibraryA WideCharToMultiByte CreateFileW ReadFile CloseHandle Sleep GetCurrentProcess GetCurrentProcessId GetTickCount GetModuleFileNameW LocalFree GetTempPathW GetEnvironmentVariableW FlushFileBuffers GetFileSizeEx SetFilePointer WriteFile GetOverlappedResult CancelIo WaitForSingleObject CreateEventW TerminateProcess OpenProcess GetConsoleWindow GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetLocaleInfoA UnhandledExceptionFilter SetUnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead IsProcessorFeaturePresent

msvcp140

_Thrd_detach _Mtx_init_in_situ _Mtx_destroy_in_situ _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_C_error@std@@YAXH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ??Bid@locale@std@@QEAA_KXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

vcruntime140

strstr __std_terminate __std_exception_copy memset memmove memcpy __std_exception_destroy _CxxThrowException __current_exception memcmp memchr __current_exception_context __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

exit _exit _initterm _c_exit _register_thread_local_exe_atexit_callback _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _register_onexit_function _initialize_onexit_table _initterm_e _invalid_parameter_noinfo_noreturn terminate _beginthreadex _errno _crt_atexit

api-ms-win-crt-stdio-l1-1-0

fgetc _get_stream_buffer_pointers __stdio_common_vsprintf_s __p__commode _set_fmode fgetpos fputc fclose __stdio_common_vsscanf ftell fseek _wfopen __acrt_iob_func fread fflush fsetpos _fseeki64 __stdio_common_vsprintf fwrite setvbuf ungetc

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

isdigit isspace strncpy strcmp strncmp tolower strncpy_s _wcsicmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

acosf ceilf fmodf __setusermatherr cosf sinf sqrtf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

39d64c034b53ee0ed960cb765ec7a6f5263958f87a9160137b65471dbcca3244

d3d11

d3dcompiler_47

user32

shell32

kernel32

msvcp140

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic