0999c4b61d0afa7e96fa477199cfffc37d67453f453476f118cb77ef388be09f

Sharing

Copy URL Twitter E-mail

General

Target
0999c4b61d0afa7e96fa477199cfffc37d67453f453476f118cb77ef388be09f
Size 3.2MB
Sample261017-e2yjeahv5j
SHA256 0999c4b61d0afa7e96fa477199cfffc37d67453f453476f118cb77ef388be09f
MD5 805095402ce8a223354bf4aa2bfd8a90
SHA1 2198b406aa0117dae8b7d8c7daaf48382771c823
SHA512 941935eaa998a5c9239abc99067c0433d2ce5832e7808b8906b41d58dce2e81535021b608f9ca465609c4d652583b5aa98ab9aba1fde10be048740bab9bb55f5
SSDEEP 49152:VSIIDxW9prf/fIVX1MgGZ3QwlWWYtpHdPikKEX5vKEYg6Oqln5/o0TVxmKN:VSIIFgprnAX1GZ3QmWW4fXvsAqlBFN
TLSH
T1F5F501372D4C86D7D5B528304E41C5BA229A8D36D643A98320E47E3F3B7BDE6043B95B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
0999c4b61d0afa7e96fa477199cfffc37d67453f453476f118cb77ef388be09f
unpack001/$PLUGINSDIR/NScurl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

File Explorer

0999c4b61d0afa7e96fa477199cfffc37d67453f453476f118cb77ef388be09f

.exe 3.2MB
$PLUGINSDIR/NScurl.dll

.dll 7.4MB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/nsExec.dll

.dll 7KB

0999c4b61d0afa7e96fa477199cfffc37d67453f453476f118cb77ef388be09f

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 0999c4b61d0afa7e96fa477199cfffc37d67453f453476f118cb77ef388be09f
MD5 805095402ce8a223354bf4aa2bfd8a90
SHA1 2198b406aa0117dae8b7d8c7daaf48382771c823
SHA512 941935eaa998a5c9239abc99067c0433d2ce5832e7808b8906b41d58dce2e81535021b608f9ca465609c4d652583b5aa98ab9aba1fde10be048740bab9bb55f5
SSDEEP 49152:VSIIDxW9prf/fIVX1MgGZ3QwlWWYtpHdPikKEX5vKEYg6Oqln5/o0TVxmKN:VSIIFgprnAX1GZ3QmWW4fXvsAqlBFN
TLSH
T1F5F501372D4C86D7D5B528304E41C5BA229A8D36D643A98320E47E3F3B7BDE6043B95B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NScurl.dll

IMPHASH a69b995beaf35247f82be4816ae4c0c6
SHA256 03c70cd356c49145e9151ec9e170884c399eef77e75c21d2a8e1ef4fe240393c
MD5 fe0a960719969b33c0344b66e2295006
SHA1 f06bd82427283cbff4f70c915a92367f1fc15545
SHA512 b01c71405910ecafd20c931ffad3e9d747cd825882b51526c8ace5bc0081aa13854fb202c5029727ca5611b27c0abd69355b62cbd4487f4c801749ae26b60746
SSDEEP 196608:9pwCVMkiHrx4BbDn6xruFBLwl51BMDcZeVYCuzBbDggiJ9M9nyI55kj+uw:s1/OT9m5kj+u
TLSH
T1E6764A94FECB04F1E55784B0D8EBB37F8B34A7118025D6BAEE0C5E56F933701261A61A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5450400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptDestroyKey CryptEncrypt CryptGenRandom CryptGetHashParam CryptHashData CryptImportKey CryptReleaseContext DeregisterEventSource RegisterEventSourceW ReportEventW

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenSystemStoreW

kernel32

CloseHandle CompareFileTime CompareStringA CompareStringW CreateDirectoryW CreateEventA CreateEventW CreateFileW CreateSemaphoreA CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileW FindNextFileW FindResourceExW FormatMessageW FreeLibrary GetACP GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileSize GetFileType GetFullPathNameW GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStdHandle GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetVersion GetVersionExW GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection InitializeCriticalSectionAndSpinCount IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LockResource MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleA ReadConsoleW ReadFile ReleaseSemaphore ResetEvent ResumeThread SetConsoleMode SetEvent SetFilePointer SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SizeofResource Sleep SleepEx SuspendThread SystemTimeToFileTime TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualLock VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile lstrcmpW lstrcmpiA lstrcmpiW lstrcpyW lstrcpynA lstrcpynW lstrlenA lstrlenW

msvcrt

__p___mb_cur_max __p__iob _amsg_exit _assert _beginthreadex _close _close _endthreadex _errno _exit _filelengthi64 _fileno _fullpath _initterm _fdopen _lock _lseek _read _setjmp3 _setmode _snprintf _snwprintf _stat _strdup _strdup _unlock _unlink _vsnprintf _vsnwprintf _wfopen _wfreopen _wfsopen _write _wsopen _wstati64 _wtoi64 abort atoi calloc fclose feof ferror fflush fgetpos fgets fgetwc fopen fprintf fputc fputs fread free fseek fsetpos ftell fwrite getc getenv gmtime isdigit islower isspace isupper isxdigit localeconv longjmp malloc memchr memcmp memcpy memmove memset qsort raise sprintf realloc setlocale setvbuf signal strcat strchr strcmp strcpy strcspn strerror strftime strlen strncmp strncpy time strpbrk strspn strrchr strstr strtol strtoul tolower ungetc vfprintf wcscat wcscpy wcslen wcsncmp wcspbrk wcsstr wcstombs wprintf

user32

CallWindowProcW CopyRect CreateDialogParamW CreateWindowExW DestroyIcon DestroyWindow DispatchMessageW EnableMenuItem EnableWindow FindWindowExW GetDesktopWindow GetDlgItem GetProcessWindowStation GetPropW GetSystemMenu GetSystemMetrics GetUserObjectInformationW GetWindow GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW IsDialogMessageW IsWindow IsWindowEnabled IsWindowVisible LoadImageW MessageBoxW MsgWaitForMultipleObjects OffsetRect PeekMessageW RemovePropW ScreenToClient SendDlgItemMessageW SendMessageW SetForegroundWindow SetPropW SetRectEmpty SetWindowLongW SetWindowPos SetWindowTextW TranslateMessage wsprintfW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetEvent WSASetLastError WSASocketA WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect gethostbyaddr gethostbyname getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt shutdown socket

Name

.text

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

664KB

Virtual Size

664KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

231B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

221KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

175KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

0999c4b61d0afa7e96fa477199cfffc37d67453f453476f118cb77ef388be09f

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NScurl.dll

advapi32

crypt32

kernel32

msvcrt

user32

version

ws2_32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic