c3d397c61172cd3f44b359244c2eab6d7ce722a4259b03a6d76fe1d75a1994ff

Sharing

Copy URL Twitter E-mail

General

Target
c3d397c61172cd3f44b359244c2eab6d7ce722a4259b03a6d76fe1d75a1994ff
Size 5.0MB
Sample261017-av334ae14j
SHA256 c3d397c61172cd3f44b359244c2eab6d7ce722a4259b03a6d76fe1d75a1994ff
MD5 08af56dacb680c92784d03bf112edea1
SHA1 578edc7904aa8f024e90ba78317132e134e884df
SHA512 b9c4cc38df94caad7bc7a6797bca859e298b70ce1e33b7eb044c0de3533d77637b902eafddf96fdfb5c24e0bacc0a7903bbc55567e502a8bc6cbb9fff3103051
SSDEEP 49152:Bz2Qw1Cge8cMz4rAm+xyBRfmziOPYaOK0gbJuQn34h3dPHkMQaTnCQQyKL9FbFqN:EQWC/wmTRUiOPYTxrIA3ZkQCQonb4gD
TLSH
T12636BE11BA8184B2D743023534EA977ECD3A7E2C4F2495C3AF97367E4E301C266FA695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c3d397c61172cd3f44b359244c2eab6d7ce722a4259b03a6d76fe1d75a1994ff

File Explorer

c3d397c61172cd3f44b359244c2eab6d7ce722a4259b03a6d76fe1d75a1994ff

.exe 5.0MB

c3d397c61172cd3f44b359244c2eab6d7ce722a4259b03a6d76fe1d75a1994ff

IMPHASH 254a70fc0067e552d02158cd1b28e3af
SHA256 c3d397c61172cd3f44b359244c2eab6d7ce722a4259b03a6d76fe1d75a1994ff
MD5 08af56dacb680c92784d03bf112edea1
SHA1 578edc7904aa8f024e90ba78317132e134e884df
SHA512 b9c4cc38df94caad7bc7a6797bca859e298b70ce1e33b7eb044c0de3533d77637b902eafddf96fdfb5c24e0bacc0a7903bbc55567e502a8bc6cbb9fff3103051
SSDEEP 49152:Bz2Qw1Cge8cMz4rAm+xyBRfmziOPYaOK0gbJuQn34h3dPHkMQaTnCQQyKL9FbFqN:EQWC/wmTRUiOPYTxrIA3ZkQCQonb4gD
TLSH
T12636BE11BA8184B2D743023534EA977ECD3A7E2C4F2495C3AF97367E4E301C266FA695
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

690589

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\df_helper\build\bin\Release\df_helper_main.pdb

shlwapi

StrCmpW PathFileExistsW PathRemoveFileSpecW PathStripPathW PathAppendA PathIsRelativeW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW VerQueryValueA

rpcrt4

UuidCreate

kernel32

CreateDirectoryW GetFullPathNameW CreateFileW FindFirstFileW FindNextFileW GetLongPathNameW EnterCriticalSection LeaveCriticalSection ReleaseSemaphore WriteFile FlushFileBuffers SetFileTime GetSystemTime SystemTimeToFileTime MapViewOfFile UnmapViewOfFile CreateSemaphoreW CreateFileMappingW OutputDebugStringA FreeLibrary GetLocalTime DecodePointer CreateWaitableTimerA SetWaitableTimer GetFileAttributesExW CreateFileMappingA InterlockedExchange InterlockedCompareExchange SwitchToThread ReadFile SetEndOfFile SetFilePointer GetPrivateProfileIntA GetPrivateProfileStringA CreateDirectoryA CreateFileA DeleteFileA FindFirstFileA CopyFileA LoadLibraryA GetSystemDirectoryA DeviceIoControl GetVersionExA CreateEventW GetModuleHandleA GetFileAttributesW CreateThread SetThreadPriority GetSystemTimeAsFileTime GetCurrentDirectoryW GetOverlappedResult GetDateFormatW UnlockFileEx UnlockFile LockFileEx LockFile GetFileAttributesA CreateMutexA GetTickCount WaitForSingleObject ReleaseMutex DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc FindClose HeapDestroy QueryPerformanceFrequency SetThreadAffinityMask GetCurrentThread Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte MultiByteToWideChar QueryPerformanceCounter SetConsoleCtrlHandler GetCommandLineA ExitProcess DeleteFileW GetPrivateProfileStringW GetPrivateProfileIntW OutputDebugStringW GetCommandLineW GetModuleHandleW GetModuleFileNameW GetExitCodeProcess GetModuleFileNameA LoadLibraryW OpenEventA CloseHandle Sleep SetEvent SetLastError GetLastError DuplicateHandle TerminateProcess GetCurrentProcessId GetCurrentProcess OpenProcess GetProcAddress Process32First Process32Next SetEnvironmentVariableW FileTimeToSystemTime InterlockedIncrement SystemTimeToTzSpecificLocalTime GetDriveTypeW ResumeThread ExitThread OpenFileMappingW GetSystemInfo Module32FirstW GetSystemPowerStatus GetSystemWow64DirectoryW GetDriveTypeA WritePrivateProfileStringW GetStartupInfoA CreateProcessW CreateProcessA GetLogicalDriveStringsA lstrcpyW lstrcmpA CreatePipe FileTimeToLocalFileTime GetSystemTimes LocalFree LocalAlloc GlobalMemoryStatusEx InterlockedDecrement CancelIo CreateNamedPipeW DisconnectNamedPipe ConnectNamedPipe WriteConsoleW FreeEnvironmentStringsW GetFileSizeEx GetFileSize GetFileInformationByHandle CreateEventA ResetEvent TerminateThread HeapAlloc GetCurrentThreadId Module32First GenerateConsoleCtrlEvent TzSpecificLocalTimeToSystemTime GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessAffinityMask GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SetStdHandle GetTimeZoneInformation FormatMessageW FindFirstFileExW GetDiskFreeSpaceExW SetFileAttributesW SetFilePointerEx GetTempPathW AreFileApisANSI CopyFileW CreateHardLinkW SetCurrentDirectoryW RemoveDirectoryW CreateDirectoryExW MoveFileExW TryEnterCriticalSection GetStringTypeW RtlUnwind WaitForSingleObjectEx GetExitCodeThread GetNativeSystemInfo EncodePointer QueueUserWorkItem GetModuleHandleExW RtlCaptureStackBackTrace IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead InitializeCriticalSection SleepEx ExpandEnvironmentStringsA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects FormatMessageA VerSetConditionMask VerifyVersionInfoA GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber CreateTimerQueue SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree SetProcessAffinityMask InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx GetConsoleOutputCP

user32

PeekMessageW UnregisterClassA MsgWaitForMultipleObjects SetCursor ClipCursor SetWindowTextW OffsetRect SystemParametersInfoA TranslateMessage DispatchMessageW GetProcessWindowStation GetUserObjectInformationW MessageBoxW SendMessageW CallWindowProcW SetWindowPos EndDialog SetDlgItemTextW GetSystemMetrics GetWindowRect GetWindowLongW SetWindowLongW GetParent LoadStringW EnumDisplayDevicesA RegisterWindowMessageW GetMessageA PostThreadMessageA SetWindowsHookExA UnhookWindowsHookEx CallNextHookEx PeekMessageA

shell32

SHGetSpecialFolderPathW SHGetPathFromIDListW SHBrowseForFolderW SHGetDesktopFolder CommandLineToArgvW SHCreateDirectoryExW SHGetSpecialFolderPathA SHGetFolderPathA SHGetFolderPathW ShellExecuteW

ole32

StringFromCLSID IIDFromString CoTaskMemFree CoCreateGuid CoInitialize CoCreateInstance CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CoUninitialize

oleaut32

VarBstrCmp SysStringLen SysFreeString SysAllocString VariantClear GetErrorInfo VariantInit VariantChangeType SetErrorInfo CreateErrorInfo

advapi32

ReportEventW BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegCreateKeyW CryptReleaseContext CryptGenRandom CryptAcquireContextA DeregisterEventSource RegisterEventSourceW CryptAcquireContextW CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash GetUserNameW RegQueryValueExA RegOpenKeyExA RegCloseKey CryptSignHashW CryptEnumProvidersW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA

ws2_32

gethostbyname gethostname ioctlsocket htonl getnameinfo sendto recvfrom listen accept freeaddrinfo getaddrinfo ntohl inet_ntoa shutdown select inet_addr ntohs __WSAFDIsSet setsockopt WSAStartup WSACleanup WSAGetLastError socket WSASetLastError recv send bind closesocket connect getpeername getsockname getsockopt htons WSAIoctl

iphlpapi

GetAdaptersInfo

wldap32

ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord211 ord46 ord217 ord143 ord200 ord35 ord30 ord79 ord301

netapi32

NetApiBufferFree NetWkstaTransportEnum Netbios

gdiplus

GdipCreateFont GdipCreateFontFamilyFromName GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipSaveImageToFile GdipGetImageGraphicsContext GdipDrawString GdipMeasureString GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromFile GdipSetSmoothingMode GdipDeleteGraphics GdipDeleteFont GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCloneImage GdipDisposeImage GdipCreateBitmapFromFileICM

httpapi

HttpReceiveHttpRequest HttpRemoveUrl HttpAddUrl HttpCreateHttpHandle HttpTerminate HttpInitialize HttpSendHttpResponse

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CryptDecodeObject CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CryptMsgGetParam CertGetNameStringA CertGetNameStringW CryptQueryObject

psapi

GetModuleFileNameExW

comdlg32

GetOpenFileNameW

winmm

timeKillEvent timeSetEvent timeGetDevCaps timeBeginPeriod

generic

count=22, id=259, version=27412,

count=225, id=261, version=27412,

count=23, id=260, version=27412,

count=666, id=260, productName=VS2017 v15.9.4 build 27025, version=27025,

count=3, id=170, productName=VS2010 build 30319, version=30319,

count=1, id=261, productName=VS2017 v15.8.9? build 26730, version=26730,

count=16, id=260, productName=VS2017 v15.8.9? build 26730, version=26730,

count=8, id=199, version=41118,

count=26, id=259, version=26706,

count=139, id=261, version=26706,

count=38, id=260, version=26706,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=457, id=1, productName=Unmarked objects,

count=9, id=265, version=27051,

count=53, id=261, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,