8bb96e1302c5484c1edea97f093831c4956a0b2d1e591ad4dcf271cf780ba402

Sharing

Copy URL Twitter E-mail

General

Target
8bb96e1302c5484c1edea97f093831c4956a0b2d1e591ad4dcf271cf780ba402
Size 707KB
Sample261014-l6dhcsszb1
SHA256 8bb96e1302c5484c1edea97f093831c4956a0b2d1e591ad4dcf271cf780ba402
MD5 3026328cc541539beec8679076788d1c
SHA1 9ee4053ef7a574c45e45f9fe300d39977ad3bce9
SHA512 704b485151186f810bc33d4cc3d3761b37166260e72560618c69ec4ec53d936184295b4c0b40940fb9f28c17567efcf387bd792f22fae2f5dafae1b8109ea860
SSDEEP 12288:+V1z8EccPxEs4S/B7xGEdE8Ts1VywgmW0Wwa7fH7UDw5w/fmpu7ULPHPGqZYiANR:yccPas4S//EX1IwgmW0Ww4fH78mpHPH6
TLSH
T15DF48D727C81C037E1B2003196BD9B765D7DB9302B2985CBA3D50B786A345D2BE38B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8bb96e1302c5484c1edea97f093831c4956a0b2d1e591ad4dcf271cf780ba402

File Explorer

8bb96e1302c5484c1edea97f093831c4956a0b2d1e591ad4dcf271cf780ba402

.exe 707KB

8bb96e1302c5484c1edea97f093831c4956a0b2d1e591ad4dcf271cf780ba402

IMPHASH 7b1acef29dc3cbf60e0cdadfd31fd749
SHA256 8bb96e1302c5484c1edea97f093831c4956a0b2d1e591ad4dcf271cf780ba402
MD5 3026328cc541539beec8679076788d1c
SHA1 9ee4053ef7a574c45e45f9fe300d39977ad3bce9
SHA512 704b485151186f810bc33d4cc3d3761b37166260e72560618c69ec4ec53d936184295b4c0b40940fb9f28c17567efcf387bd792f22fae2f5dafae1b8109ea860
SSDEEP 12288:+V1z8EccPxEs4S/B7xGEdE8Ts1VywgmW0Wwa7fH7UDw5w/fmpu7ULPHPGqZYiANR:yccPas4S//EX1IwgmW0Ww4fH78mpHPH6
TLSH
T15DF48D727C81C037E1B2003196BD9B765D7DB9302B2985CBA3D50B786A345D2BE38B5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

391533

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wldap32

ord30 ord200 ord301 ord35 ord33 ord32 ord27 ord143 ord26 ord22 ord41 ord50 ord60 ord211 ord46 ord79

kernel32

WaitForSingleObject CreateMutexW CreateEventW OpenEventW Sleep GetExitCodeThread GetLocalTime GetTickCount GetModuleFileNameW CreateFileW GetFileSize ReadFile GetModuleHandleW GetProcAddress MultiByteToWideChar WideCharToMultiByte OutputDebugStringW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection ExpandEnvironmentStringsW CreateDirectoryW GetFileAttributesW WaitForMultipleObjects DeleteFileW WriteFile SetFileAttributesW ResetEvent LocalFree GetPrivateProfileStringW WritePrivateProfileStringW FindClose FindFirstFileW FindNextFileW SetEnvironmentVariableW GetFileTime CopyFileW MoveFileExW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFilePointer SetLastError CreateProcessW GetCurrentProcess GetDiskFreeSpaceExW QueryDosDeviceW OpenProcess ReleaseMutex GetVersionExW FreeLibrary LoadLibraryW SystemTimeToFileTime GetCurrentProcessId TerminateProcess GetWindowsDirectoryW GetPrivateProfileIntW Module32FirstW Module32NextW RemoveDirectoryW GetCommandLineW GetSystemTimeAsFileTime SetEndOfFile SleepEx FormatMessageA GetFileType GetStdHandle PeekNamedPipe ExpandEnvironmentStringsA VerSetConditionMask LoadLibraryA GetModuleHandleA GetSystemDirectoryA VerifyVersionInfoA LCMapStringW CompareStringW QueryPerformanceFrequency GetConsoleCP ReadConsoleW GetConsoleMode ExitProcess SetEvent CloseHandle WriteConsoleW DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException DecodePointer FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetErrorMode GetTimeZoneInformation GetCurrentDirectoryW GetFullPathNameW SetStdHandle FlushFileBuffers FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW SetFilePointerEx GetFileInformationByHandle GetDriveTypeW GetFileAttributesExW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwind InitializeSListHead GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx IsDebuggerPresent

user32

EnumWindows GetWindowThreadProcessId SendMessageW FindWindowExW FindWindowW GetWindowRect RegisterWindowMessageW PostMessageW GetLastInputInfo ExitWindowsEx InvalidateRect IsWindowVisible

advapi32

SetSecurityDescriptorDacl CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegOpenKeyW StartServiceW OpenServiceW OpenSCManagerW CloseServiceHandle ReadEventLogW OpenEventLogW CloseEventLog RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorSacl InitializeSecurityDescriptor GetSecurityDescriptorSacl

shell32

SHCreateDirectoryExW

shlwapi

PathFileExistsW

ws2_32

WSAStartup WSACleanup WSAGetLastError __WSAFDIsSet select WSASetLastError recv send bind closesocket connect getpeername getsockopt htons ntohs gethostname ioctlsocket sendto recvfrom listen accept freeaddrinfo getaddrinfo WSAIoctl socket setsockopt getsockname

Name

.text

Size

549KB

Virtual Size

548KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

372B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8bb96e1302c5484c1edea97f093831c4956a0b2d1e591ad4dcf271cf780ba402

wldap32

kernel32

user32

advapi32

shell32

shlwapi

ws2_32

generic