65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba

Sharing

Copy URL Twitter E-mail

General

Target
65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba
Size 106KB
Sample261018-rtb2naft6v
SHA256 65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba
MD5 08db70a6121eef63f7862bc2b53c91b4
SHA1 e3206a3a936c460d71f58bc77049d7cb5b796fee
SHA512 8c62fa80c5fe2f4484ba70a9573e9d1b791b38f443e185c082785badcbfd5fb423ce434a66aa436326ec4ad099c579fdd8ac8c1b31771b337d0d092e5f41cb48
SSDEEP 1536:2DV25+olBqRyz0RyNkxwmchmV4arwpE8BbdJdHDGHDFY027+/71d/P:X8Ru0RyN4Agk5dJyJ26Dn
TLSH
T181B31802F75250BAC429C171876B5333A632FC8D1620AB2F1254FA383FB1A565F7DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba

File Explorer

65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba

.exe 106KB

65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba

IMPHASH 690c3e18c5c4751e922dbdd46667dc89
SHA256 65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba
MD5 08db70a6121eef63f7862bc2b53c91b4
SHA1 e3206a3a936c460d71f58bc77049d7cb5b796fee
SHA512 8c62fa80c5fe2f4484ba70a9573e9d1b791b38f443e185c082785badcbfd5fb423ce434a66aa436326ec4ad099c579fdd8ac8c1b31771b337d0d092e5f41cb48
SSDEEP 1536:2DV25+olBqRyz0RyNkxwmchmV4arwpE8BbdJdHDGHDFY027+/71d/P:X8Ru0RyN4Agk5dJyJ26Dn
TLSH
T181B31802F75250BAC429C171876B5333A632FC8D1620AB2F1254FA383FB1A565F7DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

DefSubclassProc InitCommonControls SetWindowSubclass

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontW CreatePen CreateSolidBrush DeleteDC DeleteObject GetStockObject GetTextExtentPoint32W GetTextMetricsW IntersectClipRect LineTo MoveToEx Rectangle RestoreDC RoundRect SaveDC SelectObject SetBkMode SetTextColor SetViewportOrgEx TextOutW

iphlpapi

GetAdaptersAddresses

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateEventW CreateFileW CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection ExitProcess FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcessId GetExitCodeProcess GetFileAttributesW GetFileSizeEx GetLastError GetLocalTime GetModuleFileNameW GetProcAddress GetStartupInfoA GetTempPathW GetTickCount InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalFree MoveFileExW MultiByteToWideChar OpenEventW OpenProcess OutputDebugStringW Process32FirstW Process32NextW QueryFullProcessImageNameW ReadFile SetEvent SetFilePointerEx SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile lstrcmpiW lstrcpynW lstrlenW

msvcrt

__C_specific_handler __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _fmode _initterm _onexit _snwprintf _stricmp _strnicmp _vsnwprintf _wcsicmp _wcsnicmp _wtoi abort calloc exit fprintf free fwrite malloc memchr memcmp memcpy memmove realloc signal strchr strcmp strlen strncmp strrchr vfprintf wcscat_s wcscmp wcscpy_s wcslen wcsncpy_s wcspbrk wcsrchr

ole32

CoCreateInstance CoInitializeEx CoUninitialize

shell32

CommandLineToArgvW SHChangeNotify SHGetFolderPathW ShellExecuteW Shell_NotifyIconW

user32

AdjustWindowRectEx AppendMenuW BeginPaint CharLowerW CreateAcceleratorTableW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyAcceleratorTable DestroyIcon DestroyMenu DestroyWindow DispatchMessageW DrawFocusRect DrawFrameControl DrawTextW EndPaint EnumWindows FillRect GetCapture GetClientRect GetCursorPos GetDC GetDlgCtrlID GetMessageW GetParent GetSysColorBrush GetSystemMetrics GetWindow GetWindowLongPtrW GetWindowRect GetWindowTextW GetWindowThreadProcessId InflateRect InvalidateRect IsIconic IsWindow IsWindowVisible KillTimer LoadCursorW LoadIconW LoadImageW MessageBoxW MoveWindow PostMessageW PostQuitMessage PtInRect RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SendMessageW SetCapture SetCursor SetForegroundWindow SetLayeredWindowAttributes SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackMouseEvent TrackPopupMenu TranslateAcceleratorW TranslateMessage UpdateWindow wsprintfW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

HttpQueryInfoA HttpQueryInfoW InternetCloseHandle InternetOpenUrlW InternetOpenW InternetReadFile InternetSetOptionW

Name

.text

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba

advapi32

comctl32

gdi32

iphlpapi

kernel32

msvcrt

ole32

shell32

user32

version

wininet

generic