013a4ebe72e63eaddd50375f656d1909dc9c03fa12232f5fd2d29599664c71ab

Sharing

Copy URL Twitter E-mail

General

Target
013a4ebe72e63eaddd50375f656d1909dc9c03fa12232f5fd2d29599664c71ab
Size 243KB
Sample261017-rfc2ssvth1
SHA256 013a4ebe72e63eaddd50375f656d1909dc9c03fa12232f5fd2d29599664c71ab
MD5 6693c9bb2dac5f81c0c3bd9d4f51164f
SHA1 831702748549919c07f8f2ee269fe0d2021bf470
SHA512 ea123a67bf8a08de2adfcc549c8c80f706ab92a49d2f8cca01d066c0d8a74a069a90e5676d35675eb22a2b49bc23f0dae4ecdcff99b9d1dd505c75160a45d61a
SSDEEP 6144:M1U3l+iB8g6bkJsWD+TCAui6j65RWBLyewSU0YRb:M1UknozyTruire
TLSH
T16B347B12ED82D9BAD5C203B454FF6F778979AD24032C69CB73F01C9685906C23B79726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
013a4ebe72e63eaddd50375f656d1909dc9c03fa12232f5fd2d29599664c71ab

File Explorer

013a4ebe72e63eaddd50375f656d1909dc9c03fa12232f5fd2d29599664c71ab

.dll 243KB

013a4ebe72e63eaddd50375f656d1909dc9c03fa12232f5fd2d29599664c71ab

IMPHASH c2801de0e904e93025ec48f303db8e16
SHA256 013a4ebe72e63eaddd50375f656d1909dc9c03fa12232f5fd2d29599664c71ab
MD5 6693c9bb2dac5f81c0c3bd9d4f51164f
SHA1 831702748549919c07f8f2ee269fe0d2021bf470
SHA512 ea123a67bf8a08de2adfcc549c8c80f706ab92a49d2f8cca01d066c0d8a74a069a90e5676d35675eb22a2b49bc23f0dae4ecdcff99b9d1dd505c75160a45d61a
SSDEEP 6144:M1U3l+iB8g6bkJsWD+TCAui6j65RWBLyewSU0YRb:M1UknozyTruire
TLSH
T16B347B12ED82D9BAD5C203B454FF6F778979AD24032C69CB73F01C9685906C23B79726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

162624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegQueryValueExA RegCloseKey OpenProcessToken GetTokenInformation RegCreateKeyExA RegSetValueExA

kernel32

HeapReAlloc HeapFree GetProcessHeap CompareStringW WideCharToMultiByte CompareStringA CreateDirectoryW ReadFile FindFirstFileW GetFullPathNameW FindNextFileW GetCurrentProcess WriteFile SetFileTime SetErrorMode SetFilePointer SetEndOfFile OpenFile FindClose CreateFileW GetFileAttributesW GetModuleHandleA GetVersion SetFileAttributesW MultiByteToWideChar FileTimeToSystemTime LoadLibraryA DeleteFileW CloseHandle LoadLibraryW GetWindowsDirectoryW GetProcAddress MoveFileExW SystemTimeToFileTime FreeLibrary GetFileTime SizeofResource FindResourceA FreeResource FindResourceExA LockResource LoadResource GlobalHandle GlobalAlloc GlobalFree GlobalLock GetLastError ExitProcess GetCurrentProcessId Sleep GetLocaleInfoW GetLocaleInfoA GetTimeFormatW GetDateFormatW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection HeapAlloc WaitForSingleObject ReleaseMutex DeleteCriticalSection GetVersionExA GetTickCount GetTimeZoneInformation GetLocalTime GetSystemTime MoveFileA LoadModule VirtualProtect SetLastError LoadLibraryExA _hread _hwrite _lopen _llseek GetCommandLineA GetTempPathA CopyFileA MoveFileExA CreateFileA GetSystemDirectoryA DeleteFileA GetWindowsDirectoryA SearchPathA _lread CreateProcessW CopyFileW WinExec CreateProcessA _lclose _lcreat _lwrite MoveFileW LoadLibraryExW GetModuleFileNameA OpenEventA SetNamedPipeHandleState WaitNamedPipeA GetDriveTypeA UnmapViewOfFile OpenProcess SetEvent DisableThreadLibraryCalls CreateThread CreateFileMappingA TransactNamedPipe CreateEventA MapViewOfFile GlobalUnlock CreateMutexA CloseHandle HeapSize HeapFree CloseHandle CloseHandle CreateFileW CloseHandle CloseHandle

user32

LoadStringW FindWindowA SendMessageA MessageBoxW CharUpperA MessageBoxA MessageBeep wsprintfA

version

GetFileVersionInfoSizeW VerInstallFileW VerInstallFileA GetFileVersionInfoW VerQueryValueA VerQueryValueW

DepHook10 DepHook11 DepHook12 DepHook13 DepHook14 DepHook2 DepHook3 DepHook4 DepHook5 DepHook6 DepHook7 DepHook8 DepHook9 DepInit DepInit32 DepKill DepKill32 DeputyCloseHandle DeputyCopyFileA DeputyCopyFileExA DeputyCopyFileExW DeputyCopyFileW DeputyCreateFileA DeputyCreateFileW DeputyCreateProcessA DeputyCreateProcessW DeputyDeleteFileW DeputyExitProcess DeputyGetProcAddress DeputyLoadLibraryA DeputyLoadLibraryExA DeputyLoadLibraryExW DeputyLoadLibraryW DeputyLoadModule DeputyMoveFileA DeputyMoveFileExA DeputyMoveFileExW DeputyMoveFileW DeputyOpenFile DeputyReadFile DeputySetFilePointer DeputyVerInstallFileA DeputyVerInstallFileW DeputyWinExec DeputyWriteFile Deputy_hread Deputy_hwrite Deputy_lclose Deputy_lcreat Deputy_llseek Deputy_lopen Deputy_lread Deputy_lwrite Java_com_sassafras_ksapi_KeyAuthenticate Java_com_sassafras_ksapi_KeyGetIndSession Java_com_sassafras_ksapi_KeyGetIndSessionEx Java_com_sassafras_ksapi_KeyGetInfo Java_com_sassafras_ksapi_KeyGetOptions Java_com_sassafras_ksapi_KeyGetSession Java_com_sassafras_ksapi_KeyGetSessionEx Java_com_sassafras_ksapi_KeyGetSessionState Java_com_sassafras_ksapi_KeyGetSessionStatus Java_com_sassafras_ksapi_KeyGetSessionTrust Java_com_sassafras_ksapi_KeyGetTransport Java_com_sassafras_ksapi_KeyLogon Java_com_sassafras_ksapi_KeyMessage Java_com_sassafras_ksapi_KeyObtain Java_com_sassafras_ksapi_KeyReturn Java_com_sassafras_ksapi_KeySession Java_com_sassafras_ksapi_KeySetOptions Java_com_sassafras_ksapi_KeySetTransport Java_com_sassafras_ksapi_KeyStatus Java_com_sassafras_ksapi_KeyStatusEx Java_com_sassafras_ksapi_KeySupported Java_com_sassafras_ksapi_KeyUpdate Java_com_sassafras_ksapi_KeyVersion KALib_Control KALib_ControlAsync KALib_ControlFlat KALib_ControlFlatAsync KALib_Invalidate KALib_LSGetMessage KALib_LSQuery KALib_LSRelease KALib_LSRequest KALib_LSUpdate KALib_LibVersion KALib_Pass16 KALib_Post KALib_Probe KALib_Query KALib_Request KALib_Status KALib_StatusAsync KALib_StatusFlat KALib_StatusFlatAsync KALib_Validate KALib_Version KeyAuditControl KeyAuditInfo KeyAuditList KeyAuditOffline KeyAuthenticate KeyDisplayServerPage KeyEncrypt KeyGetHostInfo KeyGetIndRemoteInfo KeyGetIndSession KeyGetIndSessionEx KeyGetInfo KeyGetMessage KeyGetMessageEx KeyGetOptions KeyGetPrefData KeyGetRemoteInfo KeyGetSession KeyGetSessionEx KeyGetSessionState KeyGetSessionStatus KeyGetSessionTrust KeyGetTransport KeyInform KeyInitLib KeyKillLib KeyLaunch KeyLockIdent KeyLog KeyLogon KeyMessage KeyObtain KeyObtainEx KeyObtainGid KeyPoll KeyPortAvailable KeyPortCreate KeyPortInfo KeyPortList KeyPortModify KeyPortReturn KeyPortScannable KeyPromptIdent KeyQuit KeyReturn KeySendRequest KeySession KeySetOptions KeySetTransport KeyStatus KeyStatusEx KeySupported KeyTimeInfo KeyTimeSync KeyTimeSyncEx KeyUpdate KeyVersion LSEnumProviders LSFreeHandle LSGetMessage LSInstall LSLicenseUnitsGet LSLicenseUnitsSet LSQuery LSRelease LSRequest LSUpdate key_apic_call key_apic_getdata key_apic_getntld key_apic_start key_apic_stop

Name

.text

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

013a4ebe72e63eaddd50375f656d1909dc9c03fa12232f5fd2d29599664c71ab

advapi32

kernel32

user32

version

generic