687a144947b7efa2680e0fa567c34c359af58b6d03b245136201792830f28790

Sharing

Copy URL Twitter E-mail

General

Target
687a144947b7efa2680e0fa567c34c359af58b6d03b245136201792830f28790
Size 3.3MB
Sample261020-rtjfqs1tfv
SHA256 687a144947b7efa2680e0fa567c34c359af58b6d03b245136201792830f28790
MD5 f39f4c1d1839c912fbfaa11b7a566d5a
SHA1 5a809ee1a779579e769f582acc4cbddc598ad53c
SHA512 0905fa613f11bd33724e965fbee65f9e734749147d07c12ff5295723a485c178230b8e1f96f53267c7980d13679e8de927f19d74cf829cce850e4935ed0ce40c
SSDEEP 49152:fEzL3moET9PkTW2oTr0l002uMpA5UQv74Klef9npcE:iDmoET9PHUl00IA5pNe
TLSH
T154F5BE01A1E280B3D43A71B2406733368BA88E411E15E7EF975CFDAD7E31D91A61B64F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
687a144947b7efa2680e0fa567c34c359af58b6d03b245136201792830f28790

File Explorer

687a144947b7efa2680e0fa567c34c359af58b6d03b245136201792830f28790

.dll 3.3MB

687a144947b7efa2680e0fa567c34c359af58b6d03b245136201792830f28790

IMPHASH 197f68d754773ec4936126b6e2025dd9
SHA256 687a144947b7efa2680e0fa567c34c359af58b6d03b245136201792830f28790
MD5 f39f4c1d1839c912fbfaa11b7a566d5a
SHA1 5a809ee1a779579e769f582acc4cbddc598ad53c
SHA512 0905fa613f11bd33724e965fbee65f9e734749147d07c12ff5295723a485c178230b8e1f96f53267c7980d13679e8de927f19d74cf829cce850e4935ed0ce40c
SSDEEP 49152:fEzL3moET9PkTW2oTr0l002uMpA5UQv74Klef9npcE:iDmoET9PHUl00IA5pNe
TLSH
T154F5BE01A1E280B3D43A71B2406733368BA88E411E15E7EF975CFDAD7E31D91A61B64F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

854606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

winmm

midiOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause waveOutReset waveOutClose waveOutRestart waveOutGetNumDevs waveOutUnprepareHeader midiStreamRestart midiStreamClose midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen waveOutOpen

ws2_32

connect gethostname inet_addr inet_ntoa gethostbyname WSAStartup WSACleanup select send closesocket WSAAsyncSelect htons socket setsockopt recvfrom ioctlsocket ntohl getsockname ntohs __WSAFDIsSet WSAGetLastError accept getpeername listen recv bind

rasapi32

RasHangUpA RasGetConnectStatusA

kernel32

GetFileSize GetCurrentProcess TerminateProcess OpenProcess GetWindowsDirectoryA GetSystemDirectoryA MultiByteToWideChar SetLastError GetTimeZoneInformation GetLocaleInfoA SetFilePointer WideCharToMultiByte MapViewOfFile CreateFileMappingA LocalFree UnmapViewOfFile FormatMessageA FileTimeToSystemTime CreateMutexA ReleaseMutex SuspendThread SetNamedPipeHandleState WaitNamedPipeA OpenFileMappingA OpenEventA TlsAlloc TlsFree TlsSetValue TlsGetValue InterlockedIncrement InterlockedDecrement GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA GetStdHandle SetHandleCount GetFileType SetStdHandle GetACP HeapSize ExitThread RaiseException GetLocalTime GetSystemTime RtlUnwind GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime LocalReAlloc GlobalHandle LocalAlloc lstrcmpA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers DuplicateHandle lstrcpynA FileTimeToLocalFileTime CreateToolhelp32Snapshot Process32First Process32Next TerminateThread CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource lstrlenW GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GetDriveTypeA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA MoveFileA DeleteFileA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableW SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW UnhandledExceptionFilter IsValidLocale IsValidCodePage EnumSystemLocalesA CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr GetLocaleInfoW InterlockedExchange GetVersion

user32

GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx SetFocus IsIconic PeekMessageA SetMenu GetMenu DeleteMenu GetSystemMenu DefWindowProcA GetClassInfoA IsZoomed PostQuitMessage CopyAcceleratorTableA EnumDisplaySettingsA ClientToScreen EnableMenuItem GetSubMenu GetDlgCtrlID CreateAcceleratorTableA GetKeyState TranslateAcceleratorA IsWindowEnabled CreateMenu ModifyMenuA AppendMenuA CreatePopupMenu DrawIconEx CreateIconFromResource CreateIconFromResourceEx RegisterClipboardFormatA SetRectEmpty DispatchMessageA GetMessageA WindowFromPoint DrawFocusRect DrawEdge DrawFrameControl LoadIconA TranslateMessage GetDesktopWindow GetClassNameA CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect GetWindowThreadProcessId ShowWindow SystemParametersInfoA LoadImageA FindWindowA GetDlgItem FindWindowExA GetWindowTextA GetSysColorBrush LoadStringA UnregisterClassA GetMenuCheckMarkDimensions GetMenuState SetMenuItemBitmaps CheckMenuItem MoveWindow IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle GetForegroundWindow SetWindowTextA RegisterClassA GetMenuItemCount GetMenuItemID CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetLastActivePopup RegisterWindowMessageA GetWindowPlacement GetNextDlgTabItem GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA DestroyWindow CreateDialogIndirectParamA EndDialog

gdi32

SetViewportOrgEx SetMapMode SetTextColor SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC CreateBitmap SelectObject CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect OffsetViewportOrgEx GetTextExtentPoint32A GetDeviceCaps GetROP2 GetBkColor GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn PathToRegion EndPath BeginPath GetWindowOrgEx GetViewportOrgEx GetWindowExtEx GetDIBits RealizePalette SelectPalette StretchBlt CreatePalette GetSystemPaletteEntries DeleteObject SelectClipRgn CreatePolygonRgn GetClipRgn SetStretchBltMode CreateRectRgnIndirect SetBkColor SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo ExtSelectClipRgn GetViewportExtEx PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextMetricsA CreateDCA CreateCompatibleBitmap GetPolyFillMode CreateDIBitmap GetStretchBltMode

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegOpenKeyExA RegSetValueExA RegQueryValueA RegEnumValueA RegCreateKeyExA RegCloseKey

shell32

Shell_NotifyIconA SHGetSpecialFolderPathA ShellExecuteA

ole32

OleInitialize CLSIDFromString CoCreateInstance OleRun CLSIDFromProgID OleUninitialize

oleaut32

UnRegisterTypeLi LoadTypeLi LHashValOfNameSys RegisterTypeLi SafeArrayPutElement SafeArrayCreate SafeArrayDestroy SysAllocString VariantInit VariantCopyInd SafeArrayGetElement SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetDim SafeArrayGetLBound SafeArrayGetUBound VariantChangeType VariantClear

comctl32

ord17 ImageList_Destroy

wsock32

getservbyname shutdown

wininet

InternetCloseHandle

comdlg32

GetSaveFileNameA GetFileTitleA ChooseColorA GetOpenFileNameA

generic

count=14, id=12, version=7291,

count=9, id=11, version=8047,

count=6, id=10, version=8047,

count=44, id=14, version=7299,

count=44, id=19, version=8022,

count=1, id=11, version=8966,

count=74, id=10, version=8966,

count=28, id=19, version=8034,

count=699, id=1, productName=Unmarked objects,

count=3, id=93, version=2179,

count=113, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=247, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=128, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=89, productName=Unmarked objects (old),

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,