2bf32a99b97921b2f8c10178bd60d161dc9cb941b0613afd85b94a75591d17d2

Sharing

Copy URL Twitter E-mail

General

Target
2bf32a99b97921b2f8c10178bd60d161dc9cb941b0613afd85b94a75591d17d2
Size 279KB
Sample261017-rbvfaavtev
SHA256 2bf32a99b97921b2f8c10178bd60d161dc9cb941b0613afd85b94a75591d17d2
MD5 40e070a1b8a127770ade7dd0b1e9d17c
SHA1 99fcecfc94731d83f8740f4c3ce70a7f5b209afd
SHA512 0aa475570681f2a3a3068d0e9c000d40ed20c34bb0e9d1593313613fe947918583706f58bafd5856285a8a08706d88146173dabb69236f833a46a53c01477330
SSDEEP 6144:a1U3l+iB8g6bkJsWD+TCAui6j65RWBLyec1NRFRbbbbnnnnnn:a1UknozyTruire
TLSH
T1DF546B12FD859DEAD4C2077814FB6F7B89BDAD24036C98DB73E01C8A89906C2277D725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2bf32a99b97921b2f8c10178bd60d161dc9cb941b0613afd85b94a75591d17d2

File Explorer

2bf32a99b97921b2f8c10178bd60d161dc9cb941b0613afd85b94a75591d17d2

.dll 279KB

2bf32a99b97921b2f8c10178bd60d161dc9cb941b0613afd85b94a75591d17d2

IMPHASH c2801de0e904e93025ec48f303db8e16
SHA256 2bf32a99b97921b2f8c10178bd60d161dc9cb941b0613afd85b94a75591d17d2
MD5 40e070a1b8a127770ade7dd0b1e9d17c
SHA1 99fcecfc94731d83f8740f4c3ce70a7f5b209afd
SHA512 0aa475570681f2a3a3068d0e9c000d40ed20c34bb0e9d1593313613fe947918583706f58bafd5856285a8a08706d88146173dabb69236f833a46a53c01477330
SSDEEP 6144:a1U3l+iB8g6bkJsWD+TCAui6j65RWBLyec1NRFRbbbbnnnnnn:a1UknozyTruire
TLSH
T1DF546B12FD859DEAD4C2077814FB6F7B89BDAD24036C98DB73E01C8A89906C2277D725
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

162624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegQueryValueExA RegCloseKey OpenProcessToken GetTokenInformation RegCreateKeyExA RegSetValueExA

kernel32

HeapReAlloc HeapFree GetProcessHeap CompareStringW WideCharToMultiByte CompareStringA CreateDirectoryW ReadFile FindFirstFileW GetFullPathNameW FindNextFileW GetCurrentProcess WriteFile SetFileTime SetErrorMode SetFilePointer SetEndOfFile OpenFile FindClose CreateFileW GetFileAttributesW GetModuleHandleA GetVersion SetFileAttributesW MultiByteToWideChar FileTimeToSystemTime LoadLibraryA DeleteFileW CloseHandle LoadLibraryW GetWindowsDirectoryW GetProcAddress MoveFileExW SystemTimeToFileTime FreeLibrary GetFileTime SizeofResource FindResourceA FreeResource FindResourceExA LockResource LoadResource GlobalHandle GlobalAlloc GlobalFree GlobalLock GetLastError ExitProcess GetCurrentProcessId Sleep GetLocaleInfoW GetLocaleInfoA GetTimeFormatW GetDateFormatW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection HeapAlloc WaitForSingleObject ReleaseMutex DeleteCriticalSection GetVersionExA GetTickCount GetTimeZoneInformation GetLocalTime GetSystemTime MoveFileA LoadModule VirtualProtect SetLastError LoadLibraryExA _hread _hwrite _lopen _llseek GetCommandLineA GetTempPathA CopyFileA MoveFileExA CreateFileA GetSystemDirectoryA DeleteFileA GetWindowsDirectoryA SearchPathA _lread CreateProcessW CopyFileW WinExec CreateProcessA _lclose _lcreat _lwrite MoveFileW LoadLibraryExW GetModuleFileNameA OpenEventA SetNamedPipeHandleState WaitNamedPipeA GetDriveTypeA UnmapViewOfFile OpenProcess SetEvent DisableThreadLibraryCalls CreateThread CreateFileMappingA TransactNamedPipe CreateEventA MapViewOfFile GlobalUnlock CreateMutexA CloseHandle HeapSize HeapFree CloseHandle CloseHandle CreateFileW CloseHandle CloseHandle

user32

LoadStringW FindWindowA SendMessageA MessageBoxW CharUpperA MessageBoxA MessageBeep wsprintfA

version

GetFileVersionInfoSizeW VerInstallFileW VerInstallFileA GetFileVersionInfoW VerQueryValueA VerQueryValueW

DepHook10 DepHook11 DepHook12 DepHook13 DepHook14 DepHook2 DepHook3 DepHook4 DepHook5 DepHook6 DepHook7 DepHook8 DepHook9 DepInit DepInit32 DepKill DepKill32 DeputyCloseHandle DeputyCopyFileA DeputyCopyFileExA DeputyCopyFileExW DeputyCopyFileW DeputyCreateFileA DeputyCreateFileW DeputyCreateProcessA DeputyCreateProcessW DeputyDeleteFileW DeputyExitProcess DeputyGetProcAddress DeputyLoadLibraryA DeputyLoadLibraryExA DeputyLoadLibraryExW DeputyLoadLibraryW DeputyLoadModule DeputyMoveFileA DeputyMoveFileExA DeputyMoveFileExW DeputyMoveFileW DeputyOpenFile DeputyReadFile DeputySetFilePointer DeputyVerInstallFileA DeputyVerInstallFileW DeputyWinExec DeputyWriteFile Deputy_hread Deputy_hwrite Deputy_lclose Deputy_lcreat Deputy_llseek Deputy_lopen Deputy_lread Deputy_lwrite Java_com_sassafras_ksapi_KeyAuthenticate Java_com_sassafras_ksapi_KeyGetIndSession Java_com_sassafras_ksapi_KeyGetIndSessionEx Java_com_sassafras_ksapi_KeyGetInfo Java_com_sassafras_ksapi_KeyGetOptions Java_com_sassafras_ksapi_KeyGetSession Java_com_sassafras_ksapi_KeyGetSessionEx Java_com_sassafras_ksapi_KeyGetSessionState Java_com_sassafras_ksapi_KeyGetSessionStatus Java_com_sassafras_ksapi_KeyGetSessionTrust Java_com_sassafras_ksapi_KeyGetTransport Java_com_sassafras_ksapi_KeyLogon Java_com_sassafras_ksapi_KeyMessage Java_com_sassafras_ksapi_KeyObtain Java_com_sassafras_ksapi_KeyReturn Java_com_sassafras_ksapi_KeySession Java_com_sassafras_ksapi_KeySetOptions Java_com_sassafras_ksapi_KeySetTransport Java_com_sassafras_ksapi_KeyStatus Java_com_sassafras_ksapi_KeyStatusEx Java_com_sassafras_ksapi_KeySupported Java_com_sassafras_ksapi_KeyUpdate Java_com_sassafras_ksapi_KeyVersion KALib_Control KALib_ControlAsync KALib_ControlFlat KALib_ControlFlatAsync KALib_Invalidate KALib_LSGetMessage KALib_LSQuery KALib_LSRelease KALib_LSRequest KALib_LSUpdate KALib_LibVersion KALib_Pass16 KALib_Post KALib_Probe KALib_Query KALib_Request KALib_Status KALib_StatusAsync KALib_StatusFlat KALib_StatusFlatAsync KALib_Validate KALib_Version KeyAuditControl KeyAuditInfo KeyAuditList KeyAuditOffline KeyAuthenticate KeyDisplayServerPage KeyEncrypt KeyGetHostInfo KeyGetIndRemoteInfo KeyGetIndSession KeyGetIndSessionEx KeyGetInfo KeyGetMessage KeyGetMessageEx KeyGetOptions KeyGetPrefData KeyGetRemoteInfo KeyGetSession KeyGetSessionEx KeyGetSessionState KeyGetSessionStatus KeyGetSessionTrust KeyGetTransport KeyInform KeyInitLib KeyKillLib KeyLaunch KeyLockIdent KeyLog KeyLogon KeyMessage KeyObtain KeyObtainEx KeyObtainGid KeyPoll KeyPortAvailable KeyPortCreate KeyPortInfo KeyPortList KeyPortModify KeyPortReturn KeyPortScannable KeyPromptIdent KeyQuit KeyReturn KeySendRequest KeySession KeySetOptions KeySetTransport KeyStatus KeyStatusEx KeySupported KeyTimeInfo KeyTimeSync KeyTimeSyncEx KeyUpdate KeyVersion LSEnumProviders LSFreeHandle LSGetMessage LSInstall LSLicenseUnitsGet LSLicenseUnitsSet LSQuery LSRelease LSRequest LSUpdate key_apic_call key_apic_getdata key_apic_getntld key_apic_start key_apic_stop

Name

.text

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2bf32a99b97921b2f8c10178bd60d161dc9cb941b0613afd85b94a75591d17d2

advapi32

kernel32

user32

version

generic