ef41144e9de411cd49a3957577a0840d916f2c74e82e16043d9f37af4c6b58b3

Sharing

Copy URL Twitter E-mail

General

Target
ef41144e9de411cd49a3957577a0840d916f2c74e82e16043d9f37af4c6b58b3
Size 96KB
Sample261017-tyf8aawxcs
SHA256 ef41144e9de411cd49a3957577a0840d916f2c74e82e16043d9f37af4c6b58b3
MD5 5f376f2bcd2fbe98ff5f3c6e12f5189e
SHA1 e8e5ad98f152a736e90f176c06842030acb392e0
SHA512 4650451b7af55dacb051af9c56c78d81148aef0e44efaf0b3f89c37b343216a95244b66961e75b4ae595d7f155eb8025a05e1e7defdc22a3a0332b7b9af06af3
SSDEEP 1536:mOv6l94uaBIgsNPbRnTHO4fFP57MgZ8C7mKk:m4PsBRnTHOU5YgZ8CKK
TLSH
T1AAA33A04F79700F9E1AB4834B92EEBBE0627BD358862CD5DE744CA825D73F20E625752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef41144e9de411cd49a3957577a0840d916f2c74e82e16043d9f37af4c6b58b3

File Explorer

ef41144e9de411cd49a3957577a0840d916f2c74e82e16043d9f37af4c6b58b3

.dll 96KB

ef41144e9de411cd49a3957577a0840d916f2c74e82e16043d9f37af4c6b58b3

IMPHASH e37d2e10404edc8f42475edcd13768a2
SHA256 ef41144e9de411cd49a3957577a0840d916f2c74e82e16043d9f37af4c6b58b3
MD5 5f376f2bcd2fbe98ff5f3c6e12f5189e
SHA1 e8e5ad98f152a736e90f176c06842030acb392e0
SHA512 4650451b7af55dacb051af9c56c78d81148aef0e44efaf0b3f89c37b343216a95244b66961e75b4ae595d7f155eb8025a05e1e7defdc22a3a0332b7b9af06af3
SSDEEP 1536:mOv6l94uaBIgsNPbRnTHO4fFP57MgZ8C7mKk:m4PsBRnTHOU5YgZ8CKK
TLSH
T1AAA33A04F79700F9E1AB4834B92EEBBE0627BD358862CD5DE744CA825D73F20E625752
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

d3d9

Direct3DCreate9

ddraw

DirectDrawCreateEx

dsound

DirectSoundEnumerateW DirectSoundCaptureEnumerateW

kernel32

CloseHandle DisableThreadLibraryCalls EnumResourceNamesW FindResourceW FormatMessageW GetComputerNameW GetDateFormatW GetEnvironmentVariableW GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetTickCount GetTimeFormatW GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc IsBadStringPtrW K32EnumProcessModules K32EnumProcesses K32GetModuleBaseNameW LoadLibraryW LoadResource MultiByteToWideChar OpenProcess SizeofResource lstrcmpW

ntdll

_vsnprintf

ole32

CLSIDFromString CoCreateInstance CoTaskMemFree PropVariantClear StringFromGUID2

oleaut32

SysAllocString SysFreeString VariantInit VariantClear VariantCopy VariantChangeType SafeArrayAccessData SafeArrayUnaccessData

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsicmp _wcsnicmp free fwrite getenv memcmp memcpy memmove strchr strcmp strcspn strlen wcschr wcsrchr wcsstr

user32

EnumDisplayDevicesW LoadStringW wsprintfW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

36KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

28KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ef41144e9de411cd49a3957577a0840d916f2c74e82e16043d9f37af4c6b58b3

d3d9

ddraw

dsound

kernel32

ntdll

ole32

oleaut32

ucrtbase

user32

version

generic