a311dea09f962c67191f2edbc963ec55c41d47630dd59854ddd5992ff6a57d3d

Sharing

Copy URL Twitter E-mail

General

Target
a311dea09f962c67191f2edbc963ec55c41d47630dd59854ddd5992ff6a57d3d
Size 1.4MB
Sample261014-fxvsdsyyfv
SHA256 a311dea09f962c67191f2edbc963ec55c41d47630dd59854ddd5992ff6a57d3d
MD5 9467268aa03a09c1791b45b1f0ef5245
SHA1 bced5a9f06ed1437cd58781b37d2f1c05f8204f0
SHA512 c7ddfa52b38016e73b3c2417d165f44509cb49152355560405861552c8d438c3cc47c652c249a35327f0dfc70ac9558bdb2377675558a2be558a278acfb72022
SSDEEP 24576:pDcl2dDfNqcjUDRocYskUekCJ2+Cu9V+pHGXBM7Zn7yZdR+wARgfyHTnoeE5u2T7:19uSxhCr7k3N6mh3
TLSH
T180651941B3D61211F5670731B8FE6536FA3A79216B3BC6CF621044AC0AF17D1AA3DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a311dea09f962c67191f2edbc963ec55c41d47630dd59854ddd5992ff6a57d3d

File Explorer

a311dea09f962c67191f2edbc963ec55c41d47630dd59854ddd5992ff6a57d3d

.dll 1.4MB

a311dea09f962c67191f2edbc963ec55c41d47630dd59854ddd5992ff6a57d3d

IMPHASH 26b46b23f376e7dd72efe08fc35be2ac
SHA256 a311dea09f962c67191f2edbc963ec55c41d47630dd59854ddd5992ff6a57d3d
MD5 9467268aa03a09c1791b45b1f0ef5245
SHA1 bced5a9f06ed1437cd58781b37d2f1c05f8204f0
SHA512 c7ddfa52b38016e73b3c2417d165f44509cb49152355560405861552c8d438c3cc47c652c249a35327f0dfc70ac9558bdb2377675558a2be558a278acfb72022
SSDEEP 24576:pDcl2dDfNqcjUDRocYskUekCJ2+Cu9V+pHGXBM7Zn7yZdR+wARgfyHTnoeE5u2T7:19uSxhCr7k3N6mh3
TLSH
T180651941B3D61211F5670731B8FE6536FA3A79216B3BC6CF621044AC0AF17D1AA3DB26
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

484656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

urlmon

URLDownloadToCacheFileW

wininet

GetUrlCacheEntryInfoW

comctl32

ImageList_Add ImageList_Create ImageList_Destroy ImageList_ReplaceIcon

shell32

SHGetFolderPathW ShellExecuteW

shlwapi

PathAddBackslashW PathAppendW PathFindFileNameW PathIsRelativeW PathRemoveBackslashW PathRemoveFileSpecW PathStripPathW PathStripToRootW SHCreateStreamOnFileW StrFormatByteSizeW UrlIsW

cabinet

FDICopy FDICreate FDIDestroy

oleaut32

DispGetParam LoadRegTypeLib LoadTypeLib LoadTypeLibEx OleLoadPicture RegisterTypeLib SysAllocString SysAllocStringByteLen SysAllocStringLen SysFreeString SystemTimeToVariantTime UnRegisterTypeLib VariantChangeType VariantClear VariantCopy VariantCopyInd VariantInit VariantTimeToSystemTime

ole32

CLSIDFromProgID CLSIDFromString CoCreateGuid CoCreateInstance CoInitialize CoInitializeEx CoTaskMemFree CoUninitialize CreateILockBytesOnHGlobal CreateStreamOnHGlobal StgCreateDocfile StgOpenStorage StgOpenStorageOnILockBytes StringFromGUID2

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

user32

AdjustWindowRect AppendMenuA CallWindowProcW CharLowerW CharUpperW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DispatchMessageW EnableWindow EnumChildWindows GetClientRect GetDC GetFocus GetNextDlgTabItem GetParent GetPropW GetWindowLongW GetWindowRect GetWindowTextW InvalidateRect IsDialogMessageW LoadBitmapW LoadCursorW LoadIconW LoadImageW LoadStringW MapWindowPoints MessageBoxExA MessageBoxExW MessageBoxW MsgWaitForMultipleObjects MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW RegisterClassW ReleaseDC RemovePropW SendMessageW SetFocus SetPropW SetWindowLongW SetWindowPos SetWindowTextW ShowWindow TrackPopupMenu TranslateMessage UnregisterClassW wsprintfA wsprintfW

gdi32

CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW DeleteDC DeleteObject GetDeviceCaps GetObjectW GetStockObject GetTextMetricsW SelectObject SetBkMode SetTextColor StretchBlt

advapi32

ChangeServiceConfig2W CloseServiceHandle ControlService ConvertSidToStringSidW CreateProcessAsUserW CreateServiceW DeleteService EnumDependentServicesW GetServiceDisplayNameW GetTokenInformation GetUserNameW LookupAccountNameW MD5Final MD5Init MD5Update OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyExW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueW RegGetValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW StartServiceW

rpcrt4

I_RpcExceptionFilter NdrClientCall2 NdrServerCall2 RpcBindingFree RpcBindingFromStringBindingW RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqEpW RpcStringBindingComposeW RpcStringFreeW

sxs

CreateAssemblyCache

imagehlp

BindImage

mspatcha

ApplyPatchToFileW

odbccp32

SQLConfigDataSourceW SQLInstallDriverExW SQLInstallTranslatorExW SQLRemoveDriverW SQLRemoveTranslatorW

wintrust

WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WinVerifyTrustEx

crypt32

CertDuplicateCertificateContext

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _strdup _wcsdup _wcsicmp _wcsnicmp _wcsupr _wtoi bsearch calloc free fwrite getenv iswdigit iswspace malloc memcmp memcpy memmove memset qsort realloc strcat strchr strcmp strcpy strcspn strlen strtol towupper wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcsstr wcstol

kernel32

CloseHandle ConnectNamedPipe CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW CreateNamedPipeW CreateProcessW CreateThread DebugBreak DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls DosDateTimeToFileTime DuplicateHandle EnterCriticalSection EnumResourceNamesW ExpandEnvironmentStringsW FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FindResourceExW FindResourceW FreeLibrary GetComputerNameW GetCurrentDirectoryW GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileSize GetFullPathNameW GetLocalTime GetLogicalDriveStringsW GetLogicalDrives GetModuleFileNameW GetModuleHandleW GetNativeSystemInfo GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDefaultLangID GetSystemDirectoryW GetSystemWow64DirectoryW GetTempFileNameW GetTempPathW GetTickCount64 GetTickCount GetTimeFormatW GetUserDefaultLangID GetVersion GetVolumeInformationW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW IsValidCodePage IsValidLocale IsWow64Process2 IsWow64Process LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalFileTimeToFileTime LocalFree LockResource MapViewOfFile MoveFileExW MulDiv MultiByteToWideChar RaiseException ReadFile RemoveDirectoryW RtlUnwind SearchPathW SetFileAttributesW SetFilePointer SetFileTime SizeofResource Sleep SystemTimeToFileTime TzSpecificLocalTimeToSystemTime UnmapViewOfFile WaitForSingleObject WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteFile WritePrivateProfileStringW

ntdll

NtCreateSection NtQuerySection RtlGetVersion _chkstk _vsnprintf

DllCanUnloadNow DllGetClassObject DllGetVersion DllRegisterServer DllUnregisterServer Migrate10CachedPackagesA Migrate10CachedPackagesW MsiAdvertiseProductA MsiAdvertiseProductExA MsiAdvertiseProductExW MsiAdvertiseProductW MsiAdvertiseScriptA MsiAdvertiseScriptW MsiApplyMultiplePatchesA MsiApplyMultiplePatchesW MsiApplyPatchA MsiApplyPatchW MsiBeginTransactionA MsiBeginTransactionW MsiCloseAllHandles MsiCloseHandle MsiCollectUserInfoA MsiCollectUserInfoW MsiConfigureFeatureA MsiConfigureFeatureFromDescriptorA MsiConfigureFeatureFromDescriptorW MsiConfigureFeatureW MsiConfigureProductA MsiConfigureProductExA MsiConfigureProductExW MsiConfigureProductW MsiCreateAndVerifyInstallerDirectory MsiCreateRecord MsiCreateTransformSummaryInfoA MsiCreateTransformSummaryInfoW MsiDatabaseApplyTransformA MsiDatabaseApplyTransformW MsiDatabaseCommit MsiDatabaseExportA MsiDatabaseExportW MsiDatabaseGenerateTransformA MsiDatabaseGenerateTransformW MsiDatabaseGetPrimaryKeysA MsiDatabaseGetPrimaryKeysW MsiDatabaseImportA MsiDatabaseImportW MsiDatabaseIsTablePersistentA MsiDatabaseIsTablePersistentW MsiDatabaseMergeA MsiDatabaseMergeW MsiDatabaseOpenViewA MsiDatabaseOpenViewW MsiDecomposeDescriptorA MsiDecomposeDescriptorW MsiDeleteUserDataA MsiDeleteUserDataW MsiDetermineApplicablePatchesA MsiDetermineApplicablePatchesW MsiDeterminePatchSequenceA MsiDeterminePatchSequenceW MsiDoActionA MsiDoActionW MsiEnableLogA MsiEnableLogW MsiEnableUIPreview MsiEndTransaction MsiEnumClientsA MsiEnumClientsExA MsiEnumClientsExW MsiEnumClientsW MsiEnumComponentCostsA MsiEnumComponentCostsW MsiEnumComponentQualifiersA MsiEnumComponentQualifiersW MsiEnumComponentsA MsiEnumComponentsExA MsiEnumComponentsExW MsiEnumComponentsW MsiEnumFeaturesA MsiEnumFeaturesW MsiEnumPatchesA MsiEnumPatchesExA MsiEnumPatchesExW MsiEnumPatchesW MsiEnumProductsA MsiEnumProductsExA MsiEnumProductsExW MsiEnumProductsW MsiEnumRelatedProductsA MsiEnumRelatedProductsW MsiEvaluateConditionA MsiEvaluateConditionW MsiExtractPatchXMLDataA MsiExtractPatchXMLDataW MsiFormatRecordA MsiFormatRecordW MsiGetActiveDatabase MsiGetComponentPathA MsiGetComponentPathExA MsiGetComponentPathExW MsiGetComponentPathW MsiGetComponentStateA MsiGetComponentStateW MsiGetDatabaseState MsiGetFeatureCostA MsiGetFeatureCostW MsiGetFeatureInfoA MsiGetFeatureInfoW MsiGetFeatureStateA MsiGetFeatureStateW MsiGetFeatureUsageA MsiGetFeatureUsageW MsiGetFeatureValidStatesA MsiGetFeatureValidStatesW MsiGetFileHashA MsiGetFileHashW MsiGetFileSignatureInformationA MsiGetFileSignatureInformationW MsiGetFileVersionA MsiGetFileVersionW MsiGetLanguage MsiGetLastErrorRecord MsiGetMode MsiGetPatchFileListA MsiGetPatchFileListW MsiGetPatchInfoA MsiGetPatchInfoExA MsiGetPatchInfoExW MsiGetPatchInfoW MsiGetProductCodeA MsiGetProductCodeFromPackageCodeA MsiGetProductCodeFromPackageCodeW MsiGetProductCodeW MsiGetProductInfoA MsiGetProductInfoExA MsiGetProductInfoExW MsiGetProductInfoFromScriptA MsiGetProductInfoFromScriptW MsiGetProductInfoW MsiGetProductPropertyA MsiGetProductPropertyW MsiGetPropertyA MsiGetPropertyW MsiGetShortcutTargetA MsiGetShortcutTargetW MsiGetSourcePathA MsiGetSourcePathW MsiGetSummaryInformationA MsiGetSummaryInformationW MsiGetTargetPathA MsiGetTargetPathW MsiGetUserInfoA MsiGetUserInfoW MsiInstallMissingComponentA MsiInstallMissingComponentW MsiInstallMissingFileA MsiInstallMissingFileW MsiInstallProductA MsiInstallProductW MsiInvalidateFeatureCache MsiIsProductElevatedA MsiIsProductElevatedW MsiJoinTransaction MsiLoadStringA MsiLoadStringW MsiLocateComponentA MsiLocateComponentW MsiMessageBoxA MsiMessageBoxExA MsiMessageBoxExW MsiMessageBoxW MsiNotifySidChangeA MsiNotifySidChangeW MsiOpenDatabaseA MsiOpenDatabaseW MsiOpenPackageA MsiOpenPackageExA MsiOpenPackageExW MsiOpenPackageW MsiOpenProductA MsiOpenProductW MsiPreviewBillboardA MsiPreviewBillboardW MsiPreviewDialogA MsiPreviewDialogW MsiProcessAdvertiseScriptA MsiProcessAdvertiseScriptW MsiProcessMessage MsiProvideAssemblyA MsiProvideAssemblyW MsiProvideComponentA MsiProvideComponentFromDescriptorA MsiProvideComponentFromDescriptorW MsiProvideComponentW MsiProvideQualifiedComponentA MsiProvideQualifiedComponentExA MsiProvideQualifiedComponentExW MsiProvideQualifiedComponentW MsiQueryComponentStateA MsiQueryComponentStateW MsiQueryFeatureStateA MsiQueryFeatureStateExA MsiQueryFeatureStateExW MsiQueryFeatureStateFromDescriptorA MsiQueryFeatureStateFromDescriptorW MsiQueryFeatureStateW MsiQueryProductStateA MsiQueryProductStateW MsiRecordClearData MsiRecordDataSize MsiRecordGetFieldCount MsiRecordGetInteger MsiRecordGetStringA MsiRecordGetStringW MsiRecordIsNull MsiRecordReadStream MsiRecordSetInteger MsiRecordSetStreamA MsiRecordSetStreamW MsiRecordSetStringA MsiRecordSetStringW MsiReinstallFeatureA MsiReinstallFeatureFromDescriptorA MsiReinstallFeatureFromDescriptorW MsiReinstallFeatureW MsiReinstallProductA MsiReinstallProductW MsiRemovePatchesA MsiRemovePatchesW MsiSequenceA MsiSequenceW MsiSetComponentStateA MsiSetComponentStateW MsiSetExternalUIA MsiSetExternalUIRecord MsiSetExternalUIW MsiSetFeatureAttributesA MsiSetFeatureAttributesW MsiSetFeatureStateA MsiSetFeatureStateW MsiSetInstallLevel MsiSetInternalUI MsiSetMode MsiSetOfflineContextW MsiSetPropertyA MsiSetPropertyW MsiSetTargetPathA MsiSetTargetPathW MsiSourceListAddMediaDiskA MsiSourceListAddMediaDiskW MsiSourceListAddSourceA MsiSourceListAddSourceExA MsiSourceListAddSourceExW MsiSourceListAddSourceW MsiSourceListClearAllA MsiSourceListClearAllExA MsiSourceListClearAllExW MsiSourceListClearAllW MsiSourceListClearMediaDiskA MsiSourceListClearMediaDiskW MsiSourceListClearSourceA MsiSourceListClearSourceW MsiSourceListEnumMediaDisksA MsiSourceListEnumMediaDisksW MsiSourceListEnumSourcesA MsiSourceListEnumSourcesW MsiSourceListForceResolutionA MsiSourceListForceResolutionExA MsiSourceListForceResolutionExW MsiSourceListForceResolutionW MsiSourceListGetInfoA MsiSourceListGetInfoW MsiSourceListSetInfoA MsiSourceListSetInfoW MsiSummaryInfoGetPropertyA MsiSummaryInfoGetPropertyCount MsiSummaryInfoGetPropertyW MsiSummaryInfoPersist MsiSummaryInfoSetPropertyA MsiSummaryInfoSetPropertyW MsiUseFeatureA MsiUseFeatureExA MsiUseFeatureExW MsiUseFeatureW MsiVerifyDiskSpace MsiVerifyPackageA MsiVerifyPackageW MsiViewClose MsiViewExecute MsiViewFetch MsiViewGetColumnInfo MsiViewGetErrorA MsiViewGetErrorW MsiViewModify QueryInstanceCount __wine_msi_call_dll_function

Sharing

General

Malware Config

Signatures

File Explorer

a311dea09f962c67191f2edbc963ec55c41d47630dd59854ddd5992ff6a57d3d

urlmon

wininet

comctl32

shell32

shlwapi

cabinet

oleaut32

ole32

version

user32

gdi32

advapi32

rpcrt4

sxs

imagehlp

mspatcha

odbccp32

wintrust

crypt32

ucrtbase

kernel32

ntdll

generic