a28350c64a8f569dad08e585b763614e073c31f3a92b6a292c01c74c0a831f0d

Sharing

Copy URL Twitter E-mail

General

Target
a28350c64a8f569dad08e585b763614e073c31f3a92b6a292c01c74c0a831f0d
Size 318KB
Sample261017-nbbrdsd17m
SHA256 a28350c64a8f569dad08e585b763614e073c31f3a92b6a292c01c74c0a831f0d
MD5 aa7e1b69659f930dbf8a3521dad5520a
SHA1 53e82e070b54ddb42a7fea6c899e6976e1452fc9
SHA512 e03ca463f36211eeaba0951a3d1aee910ba7fcb0990a57254a086f1f7828d14f9cf54e0678c1252ede29b437a679585426ad7a76afa67591c922ae2d572f1c70
SSDEEP 3072:FTbDQOgdbHlQsarn8pxP+hPawwPrCEbgY3ejnxDyfkI8JJJZkcoJcYMBpbU1Oyvl:pbDQOi+1rnTPa9Ckc6cYMMhIGKY
TLSH
T16B646D46B6EA3CE5F5A3903898B35015B533F42603245BDBBAAC02605F623E6FD3CB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a28350c64a8f569dad08e585b763614e073c31f3a92b6a292c01c74c0a831f0d

File Explorer

a28350c64a8f569dad08e585b763614e073c31f3a92b6a292c01c74c0a831f0d

.exe 318KB

a28350c64a8f569dad08e585b763614e073c31f3a92b6a292c01c74c0a831f0d

IMPHASH b3e01edf267ca5c512e09a7eb2c4c5e8
SHA256 a28350c64a8f569dad08e585b763614e073c31f3a92b6a292c01c74c0a831f0d
MD5 aa7e1b69659f930dbf8a3521dad5520a
SHA1 53e82e070b54ddb42a7fea6c899e6976e1452fc9
SHA512 e03ca463f36211eeaba0951a3d1aee910ba7fcb0990a57254a086f1f7828d14f9cf54e0678c1252ede29b437a679585426ad7a76afa67591c922ae2d572f1c70
SSDEEP 3072:FTbDQOgdbHlQsarn8pxP+hPawwPrCEbgY3ejnxDyfkI8JJJZkcoJcYMBpbU1Oyvl:pbDQOi+1rnTPa9Ckc6cYMMhIGKY
TLSH
T16B646D46B6EA3CE5F5A3903898B35015B533F42603245BDBBAAC02605F623E6FD3CB55
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TrackMouseEvent GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassExW CreateWindowExW IsWindow DestroyWindow ShowWindow MoveWindow SetWindowPos IsWindowVisible IsIconic BringWindowToTop GetDlgCtrlID SetFocus GetFocus SetTimer ChildWindowFromPointEx KillTimer EnableWindow IsWindowEnabled GetSystemMetrics SystemParametersInfoW IsDialogMessageW LoadImageW DestroyIcon LoadCursorW GetWindow FindWindowW EnumChildWindows SetWindowLongPtrW GetWindowLongPtrW InflateRect FillRect wsprintfW MapWindowPoints ScreenToClient GetCursorPos SetCursor AdjustWindowRectEx GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow UpdateWindow DrawTextW

gdi32

AddFontMemResourceEx CreateCompatibleBitmap MoveToEx CreateDIBSection GetTextMetricsW SetTextColor SetBkMode SetBkColor SelectObject RoundRect LineTo RemoveFontMemResourceEx BitBlt GetTextExtentPoint32W GetStockObject ExcludeClipRect EnumFontFamiliesExW Ellipse DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontIndirectW CreateCompatibleDC

gdiplus

GdipSetSmoothingMode GdipSetPixelOffsetMode GdipCreatePen1 GdipSetPenLineJoin GdipDeletePen GdipCreateSolidFill GdipDeleteBrush GdipCreatePath GdipAddPathArc GdipDeleteGraphics GdipFillPath GdipDrawPath GdipDrawLine GdipFillEllipse GdipDrawEllipse GdipGetDC GdipReleaseDC GdipDeletePath GdiplusStartup GdipCreateFromHDC GdiplusShutdown GdipClosePathFigure

comctl32

ord17

uxtheme

SetWindowTheme

mpr

WNetCancelConnection2W WNetAddConnection3W

iphlpapi

SendARP

netapi32

NetWkstaGetInfo NetApiBufferFree

winspool.drv

EnumPrintersW

kernel32

SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetModuleHandleExW ExitProcess GetStdHandle RtlPcToFileHeader RaiseException EncodePointer LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetFileType EnterCriticalSection GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx RtlUnwindEx GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WideCharToMultiByte MultiByteToWideChar SystemTimeToFileTime MoveFileExW CopyFileW WritePrivateProfileStringW WriteConsoleW GetPrivateProfileStringW lstrlenW lstrcpyW lstrcpynW lstrcmpiW LeaveCriticalSection CreateDirectoryW lstrcmpW LocalFree LocalAlloc FindResourceW SizeofResource GetEnvironmentVariableW SetEnvironmentVariableW CompareFileTime CreateFileW DeleteFileW GetFileAttributesW GetFileSize GetFileTime ReadFile SetFileAttributesW WriteFile CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap WaitForSingleObject CreateMutexW Sleep TerminateProcess CreateThread CreateProcessW GetSystemTime GetSystemTimeAsFileTime GetLocalTime GetTickCount CreateJobObjectW AssignProcessToJobObject SetInformationJobObject GetModuleFileNameW LoadResource LockResource

Name

.text

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a28350c64a8f569dad08e585b763614e073c31f3a92b6a292c01c74c0a831f0d

user32

gdi32

gdiplus

comctl32

uxtheme

mpr

iphlpapi

netapi32

winspool.drv

kernel32

generic