84c9fddb002bb4c8a5e1211e99738ff3ed0b24ca7c44f943baa430fcb96a777e

Sharing

Copy URL Twitter E-mail

General

Target
84c9fddb002bb4c8a5e1211e99738ff3ed0b24ca7c44f943baa430fcb96a777e
Size 3.1MB
Sample261020-rtfd3s1tft
SHA256 84c9fddb002bb4c8a5e1211e99738ff3ed0b24ca7c44f943baa430fcb96a777e
MD5 3fede385e8106b712fca6ed01aaf31cd
SHA1 97796aee3ba86c9b0a0b5d85ec86bf4e9b847acb
SHA512 245d0ec09c906996511efd1a333a5b90dbd91dbfac39c1077b1a4a1a5981de77717d687ad7888da4276f3275447ebedac49c4fc11fad80bd99e0b59bd219081d
SSDEEP 98304:PifxCaarYAa7OtIob1l3T7lgfUuj5/wu5NZV5:PifxF5AB3hTgsud/7fT5
TLSH
T131E523407ED2C076D6F316701976EBBD46BEB9A00A3099DB63D41EBD4821AC097387B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84c9fddb002bb4c8a5e1211e99738ff3ed0b24ca7c44f943baa430fcb96a777e

File Explorer

84c9fddb002bb4c8a5e1211e99738ff3ed0b24ca7c44f943baa430fcb96a777e

.exe 3.1MB

84c9fddb002bb4c8a5e1211e99738ff3ed0b24ca7c44f943baa430fcb96a777e

IMPHASH 5961a2fdf5ffe76c72781d659e8b1460
SHA256 84c9fddb002bb4c8a5e1211e99738ff3ed0b24ca7c44f943baa430fcb96a777e
MD5 3fede385e8106b712fca6ed01aaf31cd
SHA1 97796aee3ba86c9b0a0b5d85ec86bf4e9b847acb
SHA512 245d0ec09c906996511efd1a333a5b90dbd91dbfac39c1077b1a4a1a5981de77717d687ad7888da4276f3275447ebedac49c4fc11fad80bd99e0b59bd219081d
SSDEEP 98304:PifxCaarYAa7OtIob1l3T7lgfUuj5/wu5NZV5:PifxF5AB3hTgsud/7fT5
TLSH
T131E523407ED2C076D6F316701976EBBD46BEB9A00A3099DB63D41EBD4821AC097387B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

245730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenFileMappingW CreateFileMappingW MapViewOfFile UnmapViewOfFile SetCurrentDirectoryW LockResource SizeofResource FreeResource LoadResource FindResourceW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetExitCodeProcess FlushFileBuffers WriteFile SetFileAttributesW GetCurrentDirectoryW MoveFileExW GetTickCount GetTempPathW ExitProcess Sleep ResumeThread OutputDebugStringA GetFileAttributesA CopyFileW GetModuleFileNameA TerminateProcess GetCurrentProcessId CreateProcessW WritePrivateProfileStringW CreateThread DeleteFileW GetFullPathNameW GetPrivateProfileIntW GetPrivateProfileStringW GetModuleHandleW GetProcAddress VirtualFreeEx WriteProcessMemory VirtualAllocEx WaitForSingleObject CreateRemoteThread GetLastError GetCurrentProcess CreateDirectoryW GetFileAttributesW WideCharToMultiByte MultiByteToWideChar DecodePointer OpenProcess HeapFree GetProcessHeap HeapAlloc GetModuleFileNameW CloseHandle WriteConsoleW SetEndOfFile HeapSize GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode SetFilePointerEx LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc ReadFile CreateFileW LoadLibraryW MulDiv GetACP SetFilePointer GetFileType DuplicateHandle SystemTimeToFileTime DosDateTimeToFileTime SetFileTime GetFileSize InterlockedIncrement InterlockedDecrement GetLocalTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetCommandLineA GetCommandLineW GetStdHandle GetModuleHandleExW

user32

EndDialog PostQuitMessage GetWindowLongW SetWindowLongW SetLayeredWindowAttributes LoadImageW IsIconic MessageBoxW AppendMenuW GetSystemMenu DialogBoxParamW SetWindowRgn GetWindowRect GetClientRect RedrawWindow SetWindowTextW GetWindowTextLengthW GetWindowTextW GetSysColor ClientToScreen SetCaretPos ShowCaret HideCaret CreateCaret SetRect GetUpdateRect CharNextW DefWindowProcW IsWindow ShowWindow DispatchMessageW TranslateMessage SetFocus GetMessageW EnableWindow GetWindow SetWindowPos GetMonitorInfoW MonitorFromWindow GetParent SendMessageW GetSystemMetrics CallWindowProcW GetPropW SetPropW PostMessageW RegisterClassW LoadCursorW RegisterClassExW GetClassInfoExW CreateWindowExW GetKeyState GetDC InvalidateRect SetTimer KillTimer SetCapture ReleaseCapture PtInRect ReleaseDC DestroyWindow GetFocus MapWindowPoints IsRectEmpty EndPaint BeginPaint CharPrevW GetCursorPos FillRect InvalidateRgn IntersectRect CreateAcceleratorTableW MoveWindow OffsetRect InflateRect SetCursor wvsprintfW DrawTextW ScreenToClient

gdi32

SetWindowOrgEx DeleteDC RestoreDC BitBlt SaveDC CreateCompatibleBitmap CreateCompatibleDC GetDeviceCaps SelectClipRgn ExtSelectClipRgn CreatePen GetStockObject CreateFontIndirectW SelectObject GetTextMetricsW GetObjectA Rectangle DeleteObject CreateRoundRectRgn GetObjectW CreateDIBSection CreateRectRgnIndirect GetClipBox CombineRgn StretchBlt SetStretchBltMode ExtTextOutW SetBkColor CreateSolidBrush LineTo MoveToEx CreatePenIndirect RoundRect SetTextColor SetBkMode TextOutW GetTextExtentPoint32W GetCharABCWidthsW

advapi32

OpenProcessToken RegSetValueExW RegCreateKeyExW RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW

shell32

ShellExecuteW

ole32

CLSIDFromProgID CoCreateInstance OleLockRunning CoInitialize CoUninitialize CLSIDFromString

gdiplus

GdipBitmapUnlockBits GdipCreateFontFromLogfontA GdipCreateFontFromDC GdiplusStartup GdipCreateBitmapFromFile GdipFree GdipAlloc GdipDisposeImage GdipGetImageWidth GdipDrawString GdipSetTextRenderingHint GdipCreateFromHDC GdipSetStringFormatLineAlign GdipGetImageHeight GdipBitmapLockBits GdipCloneBrush GdiplusShutdown GdipSetStringFormatAlign GdipDeleteBrush GdipCreateStringFormat GdipDeleteStringFormat GdipDeleteGraphics GdipDeleteFont GdipCreateLineBrushI

comctl32

_TrackMouseEvent ord17

ws2_32

connect WSAGetLastError select getsockopt ioctlsocket closesocket gethostbyname inet_addr htons socket WSAStartup

wininet

InternetCloseHandle InternetReadFile HttpQueryInfoW InternetOpenUrlW InternetOpenW

shlwapi

PathRemoveFileSpecW PathAppendW PathRemoveFileSpecA

bcrypt

BCryptGetProperty BCryptCreateHash BCryptHashData BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptDestroyKey BCryptGenRandom BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt

crypt32

CryptStringToBinaryW

oleaut32

VariantInit SysAllocString VariantClear SysFreeString

Name

.text

Size

374KB

Virtual Size

373KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

117KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

84c9fddb002bb4c8a5e1211e99738ff3ed0b24ca7c44f943baa430fcb96a777e

kernel32

user32

gdi32

advapi32

shell32

ole32

gdiplus

comctl32

ws2_32

wininet

shlwapi

bcrypt

crypt32

oleaut32

generic