9f66881096b0712cdfc819884d9b2a455889b94747abda943d38a8839f27f6f1

Sharing

Copy URL Twitter E-mail

General

Target
9f66881096b0712cdfc819884d9b2a455889b94747abda943d38a8839f27f6f1
Size 2.4MB
Sample261020-hel4msav7n
SHA256 9f66881096b0712cdfc819884d9b2a455889b94747abda943d38a8839f27f6f1
MD5 661d7f6f27293db025ffcaf28a8149a9
SHA1 65fd67acc849f0c2d2ca68e1d1cd742b3fa42d09
SHA512 e21003fc99f98f93538f135a7e2ddd36841252e0175747b88c426440e33625689abc63d7c211ccd1cee384dd7eb8acc462e4a0f118a92798f61a939e510c7348
SSDEEP 49152:RQQRuSfX4GnW5hKtY2mg+equBXvoUghsipl0PSWoRGw7uOMkBjxFT6fjarSj8Ro+:Vnv3BXvuqip6qWbwqOMkJxFufjJTy
TLSH
T1A6C502B2ABF99077C17202336D2AAA3124B6BDFD873095CF65943A1D1D712C26937B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9f66881096b0712cdfc819884d9b2a455889b94747abda943d38a8839f27f6f1

File Explorer

9f66881096b0712cdfc819884d9b2a455889b94747abda943d38a8839f27f6f1

.exe 2.4MB

9f66881096b0712cdfc819884d9b2a455889b94747abda943d38a8839f27f6f1

IMPHASH 63ce74585e12df29709d11c5bf5828aa
SHA256 9f66881096b0712cdfc819884d9b2a455889b94747abda943d38a8839f27f6f1
MD5 661d7f6f27293db025ffcaf28a8149a9
SHA1 65fd67acc849f0c2d2ca68e1d1cd742b3fa42d09
SHA512 e21003fc99f98f93538f135a7e2ddd36841252e0175747b88c426440e33625689abc63d7c211ccd1cee384dd7eb8acc462e4a0f118a92798f61a939e510c7348
SSDEEP 49152:RQQRuSfX4GnW5hKtY2mg+equBXvoUghsipl0PSWoRGw7uOMkBjxFT6fjarSj8Ro+:Vnv3BXvuqip6qWbwqOMkJxFufjJTy
TLSH
T1A6C502B2ABF99077C17202336D2AAA3124B6BDFD873095CF65943A1D1D712C26937B13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

115178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcpyW DeleteFileW FindNextFileW lstrcmpiW RemoveDirectoryW FindClose FindFirstFileW GetBinaryTypeW CreateToolhelp32Snapshot Process32NextW GetSystemInfo Module32FirstW Process32FirstW GetProcAddress lstrlenW MultiByteToWideChar InterlockedIncrement InterlockedDecrement InterlockedExchange GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateFileW HeapFree HeapAlloc ExitThread GetCurrentThreadId CreateThread ExitProcess GetCommandLineA HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind LCMapStringW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType SetFilePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess IsProcessorFeaturePresent HeapCreate HeapDestroy HeapSize GetLocaleInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage LoadLibraryW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc SetStdHandle FlushFileBuffers WriteConsoleW SetEndOfFile GetProcessHeap MulDiv GetCurrentDirectoryW GlobalUnlock GlobalLock GetFileSize GlobalAlloc LocalFree FormatMessageW SystemTimeToFileTime LocalFileTimeToFileTime SetFileTime lstrcpynW GetLocalTime GetFileAttributesW WideCharToMultiByte WriteFile GetModuleHandleW CreateDirectoryW FindResourceExW ReleaseMutex GetLastError CreateMutexW GetCommandLineW LockResource SizeofResource LoadResource FindResourceW FreeResource CloseHandle GetTempPathW GetModuleFileNameW TerminateProcess OpenProcess WaitForSingleObject ReadFile CreateProcessW

user32

GetDC GetCursorPos DestroyWindow GetFocus MapWindowPoints GetSysColor IntersectRect IsWindowVisible IsRectEmpty GetUpdateRect EndPaint BeginPaint GetActiveWindow IsWindowEnabled FillRect CharPrevW SetRect DrawTextW GetWindowRgn UpdateLayeredWindow MoveWindow CreateCaret HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen DestroyMenu TrackPopupMenu EnableMenuItem AppendMenuW CreatePopupMenu GetCaretBlinkTime UpdateWindow GetKeyNameTextW MapVirtualKeyExW GetKeyboardLayout SetWindowTextW SetForegroundWindow DrawTextA wsprintfA InvalidateRgn GetGUIThreadInfo ReleaseDC GetWindowTextW GetWindowTextLengthW EqualRect CharNextW SetCursor UnionRect InflateRect OffsetRect CreateWindowExW GetClassInfoExW RegisterClassExW LoadCursorW RegisterClassW SetPropW GetPropW GetWindowLongW CallWindowProcW GetSystemMetrics LoadImageW SendMessageW GetWindowRect GetParent MonitorFromWindow GetMonitorInfoW SetWindowPos GetWindow EnableWindow GetMessageW SetFocus TranslateMessage DispatchMessageW IsWindow SetWindowLongW DefWindowProcW GetClientRect PostMessageW PostQuitMessage ScreenToClient ShowWindow wsprintfW ReleaseCapture SetCapture SetTimer KillTimer InvalidateRect GetKeyState MessageBoxW SetWindowRgn IsZoomed IsIconic CreateAcceleratorTableW PtInRect

advapi32

RegSetValueW RegDeleteValueW RegDeleteKeyW RegOpenKeyW RegCreateKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

DragQueryFileW ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation SHChangeNotify CommandLineToArgvW ShellExecuteW

ole32

CoTaskMemFree CoCreateInstance CoUninitialize CoInitialize DoDragDrop OleDuplicateData OleLockRunning CLSIDFromProgID CLSIDFromString ReleaseStgMedium CreateStreamOnHGlobal

shlwapi

SHDeleteKeyW PathIsDirectoryEmptyW PathFileExistsW

wininet

InternetConnectW HttpSendRequestW HttpOpenRequestW InternetOpenW

ws2_32

gethostbyname WSAStartup gethostname

gdi32

SaveDC SelectClipRgn ExtSelectClipRgn CreateRectRgnIndirect GetClipBox CombineRgn StretchBlt CreateDIBSection SetStretchBltMode CreateCompatibleBitmap CreateSolidBrush LineTo MoveToEx CreatePenIndirect TextOutW GetTextExtentPoint32W GetCharABCWidthsW BitBlt SetTextColor SetBkMode GetObjectA GdiFlush PtInRegion CreateRectRgn GetBitmapBits SetBitmapBits GetTextExtentPointA CreatePatternBrush CreateRoundRectRgn GetTextMetricsW SelectObject PlayEnhMetaFile DeleteDC GetStockObject GetObjectW RestoreDC Rectangle CreateEnhMetaFileW CloseEnhMetaFile SetWindowOrgEx RemoveFontMemResourceEx AddFontMemResourceEx CreatePen CreateDIBitmap GetEnhMetaFileHeader GetDeviceCaps CreateCompatibleDC SetBkColor DeleteObject CreateFontIndirectW

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetPropertyItem GdiplusStartup GdiplusShutdown GdipFree GdipAlloc GdipDeleteBrush GdipCreatePen1 GdipDeletePen GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCreatePath GdipDeletePath GdipDeleteGraphics GdipDeleteFont GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipDisposeImage GdipCreateSolidFill GdipSetPenMode GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipAddPathLine ord1 GdipCreateFromHDC GdipSetTextRenderingHint GdipSetInterpolationMode GdipSetSmoothingMode GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipFillPath GdipDrawString GdipMeasureString GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipCloneBrush GdipCloneImage GdipTranslateWorldTransform GdipRotateWorldTransform GdipDrawImageRectI GdipGetImageWidth GdipGetImageHeight

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

Sharing

General

Malware Config

Signatures

File Explorer

9f66881096b0712cdfc819884d9b2a455889b94747abda943d38a8839f27f6f1

kernel32

user32

advapi32

shell32

ole32

shlwapi

wininet

ws2_32

gdi32

oleaut32

comctl32

gdiplus

imm32

generic