600ec70990fb5a1a0cf2088f736b5cfa06d9bc9b2c0ed9ff79c47b206ee73f99

Sharing

Copy URL Twitter E-mail

General

Target
600ec70990fb5a1a0cf2088f736b5cfa06d9bc9b2c0ed9ff79c47b206ee73f99
Size 263KB
Sample261017-rdsdps1v9p
SHA256 600ec70990fb5a1a0cf2088f736b5cfa06d9bc9b2c0ed9ff79c47b206ee73f99
MD5 4e0697a48d66c9e62a71ea8a557f6793
SHA1 884ae828af6d54d525cc4872e0388c8845ee550c
SHA512 62269365a2289924743a7790aec7ee7c0c214a5c385434c4480dd903f4368e725eab355084899f9a3312cfb6ebe6ad4d2dfa3595c567eb85d36e81e80cd156f1
SSDEEP 6144:Y1U3l+iB8g6bkJsWD+TCAui6j65RWBLyec1NRFRbbbbnn:Y1UknozyTruire
TLSH
T1B5446B12FD828DE6E5C2077454FB6F7B89A9AD24032C99DB73F01C8A85906C23B7D725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
600ec70990fb5a1a0cf2088f736b5cfa06d9bc9b2c0ed9ff79c47b206ee73f99

File Explorer

600ec70990fb5a1a0cf2088f736b5cfa06d9bc9b2c0ed9ff79c47b206ee73f99

.dll 263KB

600ec70990fb5a1a0cf2088f736b5cfa06d9bc9b2c0ed9ff79c47b206ee73f99

IMPHASH c2801de0e904e93025ec48f303db8e16
SHA256 600ec70990fb5a1a0cf2088f736b5cfa06d9bc9b2c0ed9ff79c47b206ee73f99
MD5 4e0697a48d66c9e62a71ea8a557f6793
SHA1 884ae828af6d54d525cc4872e0388c8845ee550c
SHA512 62269365a2289924743a7790aec7ee7c0c214a5c385434c4480dd903f4368e725eab355084899f9a3312cfb6ebe6ad4d2dfa3595c567eb85d36e81e80cd156f1
SSDEEP 6144:Y1U3l+iB8g6bkJsWD+TCAui6j65RWBLyec1NRFRbbbbnn:Y1UknozyTruire
TLSH
T1B5446B12FD828DE6E5C2077454FB6F7B89A9AD24032C99DB73F01C8A85906C23B7D725
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

162624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegQueryValueExA RegCloseKey OpenProcessToken GetTokenInformation RegCreateKeyExA RegSetValueExA

kernel32

HeapReAlloc HeapFree GetProcessHeap CompareStringW WideCharToMultiByte CompareStringA CreateDirectoryW ReadFile FindFirstFileW GetFullPathNameW FindNextFileW GetCurrentProcess WriteFile SetFileTime SetErrorMode SetFilePointer SetEndOfFile OpenFile FindClose CreateFileW GetFileAttributesW GetModuleHandleA GetVersion SetFileAttributesW MultiByteToWideChar FileTimeToSystemTime LoadLibraryA DeleteFileW CloseHandle LoadLibraryW GetWindowsDirectoryW GetProcAddress MoveFileExW SystemTimeToFileTime FreeLibrary GetFileTime SizeofResource FindResourceA FreeResource FindResourceExA LockResource LoadResource GlobalHandle GlobalAlloc GlobalFree GlobalLock GetLastError ExitProcess GetCurrentProcessId Sleep GetLocaleInfoW GetLocaleInfoA GetTimeFormatW GetDateFormatW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection HeapAlloc WaitForSingleObject ReleaseMutex DeleteCriticalSection GetVersionExA GetTickCount GetTimeZoneInformation GetLocalTime GetSystemTime MoveFileA LoadModule VirtualProtect SetLastError LoadLibraryExA _hread _hwrite _lopen _llseek GetCommandLineA GetTempPathA CopyFileA MoveFileExA CreateFileA GetSystemDirectoryA DeleteFileA GetWindowsDirectoryA SearchPathA _lread CreateProcessW CopyFileW WinExec CreateProcessA _lclose _lcreat _lwrite MoveFileW LoadLibraryExW GetModuleFileNameA OpenEventA SetNamedPipeHandleState WaitNamedPipeA GetDriveTypeA UnmapViewOfFile OpenProcess SetEvent DisableThreadLibraryCalls CreateThread CreateFileMappingA TransactNamedPipe CreateEventA MapViewOfFile GlobalUnlock CreateMutexA CloseHandle HeapSize HeapFree CloseHandle CloseHandle CreateFileW CloseHandle CloseHandle

user32

LoadStringW FindWindowA SendMessageA MessageBoxW CharUpperA MessageBoxA MessageBeep wsprintfA

version

GetFileVersionInfoSizeW VerInstallFileW VerInstallFileA GetFileVersionInfoW VerQueryValueA VerQueryValueW

DepHook10 DepHook11 DepHook12 DepHook13 DepHook14 DepHook2 DepHook3 DepHook4 DepHook5 DepHook6 DepHook7 DepHook8 DepHook9 DepInit DepInit32 DepKill DepKill32 DeputyCloseHandle DeputyCopyFileA DeputyCopyFileExA DeputyCopyFileExW DeputyCopyFileW DeputyCreateFileA DeputyCreateFileW DeputyCreateProcessA DeputyCreateProcessW DeputyDeleteFileW DeputyExitProcess DeputyGetProcAddress DeputyLoadLibraryA DeputyLoadLibraryExA DeputyLoadLibraryExW DeputyLoadLibraryW DeputyLoadModule DeputyMoveFileA DeputyMoveFileExA DeputyMoveFileExW DeputyMoveFileW DeputyOpenFile DeputyReadFile DeputySetFilePointer DeputyVerInstallFileA DeputyVerInstallFileW DeputyWinExec DeputyWriteFile Deputy_hread Deputy_hwrite Deputy_lclose Deputy_lcreat Deputy_llseek Deputy_lopen Deputy_lread Deputy_lwrite Java_com_sassafras_ksapi_KeyAuthenticate Java_com_sassafras_ksapi_KeyGetIndSession Java_com_sassafras_ksapi_KeyGetIndSessionEx Java_com_sassafras_ksapi_KeyGetInfo Java_com_sassafras_ksapi_KeyGetOptions Java_com_sassafras_ksapi_KeyGetSession Java_com_sassafras_ksapi_KeyGetSessionEx Java_com_sassafras_ksapi_KeyGetSessionState Java_com_sassafras_ksapi_KeyGetSessionStatus Java_com_sassafras_ksapi_KeyGetSessionTrust Java_com_sassafras_ksapi_KeyGetTransport Java_com_sassafras_ksapi_KeyLogon Java_com_sassafras_ksapi_KeyMessage Java_com_sassafras_ksapi_KeyObtain Java_com_sassafras_ksapi_KeyReturn Java_com_sassafras_ksapi_KeySession Java_com_sassafras_ksapi_KeySetOptions Java_com_sassafras_ksapi_KeySetTransport Java_com_sassafras_ksapi_KeyStatus Java_com_sassafras_ksapi_KeyStatusEx Java_com_sassafras_ksapi_KeySupported Java_com_sassafras_ksapi_KeyUpdate Java_com_sassafras_ksapi_KeyVersion KALib_Control KALib_ControlAsync KALib_ControlFlat KALib_ControlFlatAsync KALib_Invalidate KALib_LSGetMessage KALib_LSQuery KALib_LSRelease KALib_LSRequest KALib_LSUpdate KALib_LibVersion KALib_Pass16 KALib_Post KALib_Probe KALib_Query KALib_Request KALib_Status KALib_StatusAsync KALib_StatusFlat KALib_StatusFlatAsync KALib_Validate KALib_Version KeyAuditControl KeyAuditInfo KeyAuditList KeyAuditOffline KeyAuthenticate KeyDisplayServerPage KeyEncrypt KeyGetHostInfo KeyGetIndRemoteInfo KeyGetIndSession KeyGetIndSessionEx KeyGetInfo KeyGetMessage KeyGetMessageEx KeyGetOptions KeyGetPrefData KeyGetRemoteInfo KeyGetSession KeyGetSessionEx KeyGetSessionState KeyGetSessionStatus KeyGetSessionTrust KeyGetTransport KeyInform KeyInitLib KeyKillLib KeyLaunch KeyLockIdent KeyLog KeyLogon KeyMessage KeyObtain KeyObtainEx KeyObtainGid KeyPoll KeyPortAvailable KeyPortCreate KeyPortInfo KeyPortList KeyPortModify KeyPortReturn KeyPortScannable KeyPromptIdent KeyQuit KeyReturn KeySendRequest KeySession KeySetOptions KeySetTransport KeyStatus KeyStatusEx KeySupported KeyTimeInfo KeyTimeSync KeyTimeSyncEx KeyUpdate KeyVersion LSEnumProviders LSFreeHandle LSGetMessage LSInstall LSLicenseUnitsGet LSLicenseUnitsSet LSQuery LSRelease LSRequest LSUpdate key_apic_call key_apic_getdata key_apic_getntld key_apic_start key_apic_stop

Name

.text

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

600ec70990fb5a1a0cf2088f736b5cfa06d9bc9b2c0ed9ff79c47b206ee73f99

advapi32

kernel32

user32

version

generic