c66c5fd1d782c9f2d26c7367127c291eb1886832a5dbeb9f29dad8ef170039a8

General

Target
c66c5fd1d782c9f2d26c7367127c291eb1886832a5dbeb9f29dad8ef170039a8
Size 235KB
Sample261017-rfmagagy91
SHA256 c66c5fd1d782c9f2d26c7367127c291eb1886832a5dbeb9f29dad8ef170039a8
MD5 dad104701746204d510b7d78daa64f19
SHA1 ac0db6b2553abd9937ca22e2caf60aefc5d9ebe0
SHA512 93dad4c7afdf9b6ff62688c73ac468a65211316080f0a7a97c51cdb41e2434bf59d4f12438469157bae50a9a5def27849d025157213152e60bd5702e47ba13f2
SSDEEP 6144:g1U3l+iB8g6bkJsWD+TCAui6j65RWBLyec+YA/:g1UknozyTruire
TLSH
T196347B12ED82D5BAD6C203B054FF6F779579AD24036C69CB73F01C9285906C23B7A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c66c5fd1d782c9f2d26c7367127c291eb1886832a5dbeb9f29dad8ef170039a8

File Explorer

c66c5fd1d782c9f2d26c7367127c291eb1886832a5dbeb9f29dad8ef170039a8

.dll 235KB

c66c5fd1d782c9f2d26c7367127c291eb1886832a5dbeb9f29dad8ef170039a8

IMPHASH cef43bc6de38142fdc2db0df7cadb430
SHA256 c66c5fd1d782c9f2d26c7367127c291eb1886832a5dbeb9f29dad8ef170039a8
MD5 dad104701746204d510b7d78daa64f19
SHA1 ac0db6b2553abd9937ca22e2caf60aefc5d9ebe0
SHA512 93dad4c7afdf9b6ff62688c73ac468a65211316080f0a7a97c51cdb41e2434bf59d4f12438469157bae50a9a5def27849d025157213152e60bd5702e47ba13f2
SSDEEP 6144:g1U3l+iB8g6bkJsWD+TCAui6j65RWBLyec+YA/:g1UknozyTruire
TLSH
T196347B12ED82D5BAD6C203B054FF6F779579AD24036C69CB73F01C9285906C23B7A72A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

162624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegQueryValueExA RegCloseKey OpenProcessToken GetTokenInformation RegCreateKeyExA RegSetValueExA

kernel32

HeapReAlloc HeapFree GetProcessHeap CompareStringW WideCharToMultiByte CompareStringA CreateDirectoryW ReadFile FindFirstFileW GetFullPathNameW FindNextFileW GetCurrentProcess WriteFile SetFileTime SetErrorMode SetFilePointer SetEndOfFile OpenFile FindClose CreateFileW GetFileAttributesW GetModuleHandleA GetVersion SetFileAttributesW MultiByteToWideChar FileTimeToSystemTime LoadLibraryA DeleteFileW CloseHandle LoadLibraryW GetWindowsDirectoryW GetProcAddress MoveFileExW SystemTimeToFileTime FreeLibrary GetFileTime SizeofResource FindResourceA FreeResource FindResourceExA LockResource LoadResource GlobalHandle GlobalAlloc GlobalFree GlobalLock GetLastError ExitProcess GetCurrentProcessId Sleep GetLocaleInfoW GetLocaleInfoA GetTimeFormatW GetDateFormatW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection HeapAlloc WaitForSingleObject ReleaseMutex DeleteCriticalSection GetVersionExA GetTickCount GetTimeZoneInformation GetLocalTime GetSystemTime MoveFileA LoadModule VirtualProtect SetLastError LoadLibraryExA _hread _hwrite _lopen _llseek GetCommandLineA GetTempPathA CopyFileA MoveFileExA CreateFileA GetSystemDirectoryA DeleteFileA GetWindowsDirectoryA SearchPathA _lread CreateProcessW CopyFileW WinExec CreateProcessA _lclose _lcreat _lwrite MoveFileW LoadLibraryExW GetModuleFileNameA OpenEventA SetNamedPipeHandleState WaitNamedPipeA GetDriveTypeA UnmapViewOfFile OpenProcess SetEvent DisableThreadLibraryCalls CreateThread CreateFileMappingA TransactNamedPipe CreateEventA MapViewOfFile GlobalUnlock CreateMutexA CloseHandle HeapSize HeapFree CloseHandle CloseHandle CreateFileW CloseHandle

user32

LoadStringW FindWindowA SendMessageA MessageBoxW CharUpperA MessageBoxA MessageBeep wsprintfA

version

GetFileVersionInfoSizeW VerInstallFileW VerInstallFileA GetFileVersionInfoW VerQueryValueA VerQueryValueW

DepHook10 DepHook11 DepHook12 DepHook13 DepHook14 DepHook2 DepHook3 DepHook4 DepHook5 DepHook6 DepHook7 DepHook8 DepHook9 DepInit DepInit32 DepKill DepKill32 DeputyCloseHandle DeputyCopyFileA DeputyCopyFileExA DeputyCopyFileExW DeputyCopyFileW DeputyCreateFileA DeputyCreateFileW DeputyCreateProcessA DeputyCreateProcessW DeputyDeleteFileW DeputyExitProcess DeputyGetProcAddress DeputyLoadLibraryA DeputyLoadLibraryExA DeputyLoadLibraryExW DeputyLoadLibraryW DeputyLoadModule DeputyMoveFileA DeputyMoveFileExA DeputyMoveFileExW DeputyMoveFileW DeputyOpenFile DeputyReadFile DeputySetFilePointer DeputyVerInstallFileA DeputyVerInstallFileW DeputyWinExec DeputyWriteFile Deputy_hread Deputy_hwrite Deputy_lclose Deputy_lcreat Deputy_llseek Deputy_lopen Deputy_lread Deputy_lwrite Java_com_sassafras_ksapi_KeyAuthenticate Java_com_sassafras_ksapi_KeyGetIndSession Java_com_sassafras_ksapi_KeyGetIndSessionEx Java_com_sassafras_ksapi_KeyGetInfo Java_com_sassafras_ksapi_KeyGetOptions Java_com_sassafras_ksapi_KeyGetSession Java_com_sassafras_ksapi_KeyGetSessionEx Java_com_sassafras_ksapi_KeyGetSessionState Java_com_sassafras_ksapi_KeyGetSessionStatus Java_com_sassafras_ksapi_KeyGetSessionTrust Java_com_sassafras_ksapi_KeyGetTransport Java_com_sassafras_ksapi_KeyLogon Java_com_sassafras_ksapi_KeyMessage Java_com_sassafras_ksapi_KeyObtain Java_com_sassafras_ksapi_KeyReturn Java_com_sassafras_ksapi_KeySession Java_com_sassafras_ksapi_KeySetOptions Java_com_sassafras_ksapi_KeySetTransport Java_com_sassafras_ksapi_KeyStatus Java_com_sassafras_ksapi_KeyStatusEx Java_com_sassafras_ksapi_KeySupported Java_com_sassafras_ksapi_KeyUpdate Java_com_sassafras_ksapi_KeyVersion KALib_Control KALib_ControlAsync KALib_ControlFlat KALib_ControlFlatAsync KALib_Invalidate KALib_LSGetMessage KALib_LSQuery KALib_LSRelease KALib_LSRequest KALib_LSUpdate KALib_LibVersion KALib_Pass16 KALib_Post KALib_Probe KALib_Query KALib_Request KALib_Status KALib_StatusAsync KALib_StatusFlat KALib_StatusFlatAsync KALib_Validate KALib_Version KeyAuditControl KeyAuditInfo KeyAuditList KeyAuditOffline KeyAuthenticate KeyDisplayServerPage KeyEncrypt KeyGetHostInfo KeyGetIndRemoteInfo KeyGetIndSession KeyGetIndSessionEx KeyGetInfo KeyGetMessage KeyGetMessageEx KeyGetOptions KeyGetPrefData KeyGetRemoteInfo KeyGetSession KeyGetSessionEx KeyGetSessionState KeyGetSessionStatus KeyGetSessionTrust KeyGetTransport KeyInform KeyInitLib KeyKillLib KeyLaunch KeyLockIdent KeyLog KeyLogon KeyMessage KeyObtain KeyObtainEx KeyObtainGid KeyPoll KeyPortAvailable KeyPortCreate KeyPortInfo KeyPortList KeyPortModify KeyPortReturn KeyPortScannable KeyPromptIdent KeyQuit KeyReturn KeySendRequest KeySession KeySetOptions KeySetTransport KeyStatus KeyStatusEx KeySupported KeyTimeInfo KeyTimeSync KeyTimeSyncEx KeyUpdate KeyVersion LSEnumProviders LSFreeHandle LSGetMessage LSInstall LSLicenseUnitsGet LSLicenseUnitsSet LSQuery LSRelease LSRequest LSUpdate key_apic_call key_apic_getdata key_apic_getntld key_apic_start key_apic_stop

Name

.text

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

c66c5fd1d782c9f2d26c7367127c291eb1886832a5dbeb9f29dad8ef170039a8

advapi32

kernel32

user32

version

generic