48db2ddcc81839bbd26c206696a47dc772fb7892603616da09657cd976533f69[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
48db2ddcc81839bbd26c206696a47dc772fb7892603616da09657cd976533f69.exe
Size 516KB
Sample261024-ay4h2aws9j
SHA256 48db2ddcc81839bbd26c206696a47dc772fb7892603616da09657cd976533f69
MD5 0469ef66217caf2da44e5924cf0a40a8
SHA1 6ad230e48333e488814ec2b7a973e395f301083a
SHA512 2a8ea19eeef944fe8a486badede439e8adac5e3d004646beb497a2209ad025af9f5d2659429c30822772011c5f808884e91efca2e0cf2f62b2458d188f91e003
SSDEEP 6144:XHgKGUhX6nz3DliEwcy9ct/AJzu2Qh6k68U0KeXUsDi4eYTdQI98hCI9Ec9dcEPY:3+Gmry9IAR0KCeYTdQC8Ew7
TLSH
T1C0B41B11B744ECA9D062B1BD4A4BC9C6D7337A850720AAD723D0F67B1F269844DBEBC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48db2ddcc81839bbd26c206696a47dc772fb7892603616da09657cd976533f69.exe

File Explorer

48db2ddcc81839bbd26c206696a47dc772fb7892603616da09657cd976533f69.exe

.exe 516KB

48db2ddcc81839bbd26c206696a47dc772fb7892603616da09657cd976533f69.exe

IMPHASH 8714c0e28f108fd3445d8230b0328a62
SHA256 48db2ddcc81839bbd26c206696a47dc772fb7892603616da09657cd976533f69
MD5 0469ef66217caf2da44e5924cf0a40a8
SHA1 6ad230e48333e488814ec2b7a973e395f301083a
SHA512 2a8ea19eeef944fe8a486badede439e8adac5e3d004646beb497a2209ad025af9f5d2659429c30822772011c5f808884e91efca2e0cf2f62b2458d188f91e003
SSDEEP 6144:XHgKGUhX6nz3DliEwcy9ct/AJzu2Qh6k68U0KeXUsDi4eYTdQI98hCI9Ec9dcEPY:3+Gmry9IAR0KCeYTdQC8Ew7
TLSH
T1C0B41B11B744ECA9D062B1BD4A4BC9C6D7337A850720AAD723D0F67B1F269844DBEBC1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

220592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdiplusStartup GdiplusShutdown GdipCreatePath GdipDeletePath GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipFillPath GdipFillEllipse GdipFillPolygon GdipDrawArc GdipDrawLine GdipRotateWorldTransform GdipTranslateWorldTransform GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipAddPathArc GdipClosePathFigure

user32

GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW PostQuitMessage CreateWindowExW IsWindow DestroyWindow ShowWindow DrawFrameControl SetWindowPos CreateDialogParamW IsDlgButtonChecked EndDialog GetDlgItem SetDlgItemInt GetDlgItemInt SendDlgItemMessageW SetFocus SetTimer KillTimer EnableWindow IsWindowEnabled GetSystemMetrics CreatePopupMenu DestroyMenu AppendMenuW CheckRadioButton DrawFocusRect InflateRect DialogBoxParamW FillRect CheckDlgButton MoveWindow SetDlgItemTextW TrackPopupMenu DrawTextW UpdateWindow GetWindowLongW SetForegroundWindow GetDC ReleaseDC InvalidateRect SetWindowTextW GetWindowTextW GetWindowTextLengthW GetClientRect GetWindowRect AdjustWindowRectEx MessageBoxW GetSysColor GetWindowLongPtrW MapDialogRect IsDialogMessageW GetParent SetWindowLongPtrW GetSysColorBrush

gdi32

Polygon MoveToEx GetObjectW SetTextColor SetBkMode SelectObject RoundRect LineTo GetTextExtentPoint32W GetStockObject GetDeviceCaps Ellipse DeleteObject CreateSolidBrush CreatePen CreateFontIndirectW

comctl32

InitCommonControlsEx

winmm

waveInGetNumDevs waveOutGetDevCapsW waveOutOpen waveOutClose waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite waveInGetDevCapsW waveInOpen waveInClose waveInPrepareHeader waveInUnprepareHeader waveInAddBuffer waveInStart waveInReset waveOutReset waveOutGetNumDevs

uxtheme

CloseThemeData DrawThemeBackground OpenThemeData SetWindowTheme

shell32

SHGetPathFromIDListW SHGetKnownFolderPath SHBrowseForFolderW ShellExecuteExW SHGetFolderPathW

ole32

CoTaskMemFree CoInitializeEx CoUninitialize

comdlg32

GetOpenFileNameW

ws2_32

inet_pton freeaddrinfo getaddrinfo WSAGetLastError WSACleanup WSAStartup socket sendto select recvfrom ntohs htons htonl getsockname connect closesocket bind __WSAFDIsSet inet_ntop

bcrypt

BCryptGenRandom BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider

mfplat

MFStartup MFCreateMediaType MFCreateSample MFCreateMemoryBuffer MFShutdown

mfreadwrite

MFCreateSinkWriterFromURL

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpConnect

kernel32

FindFirstFileExW FindClose ReadConsoleW GetFileSizeEx GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType LCMapStringW ExitProcess GetCurrentProcess ReadFile GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread InitializeCriticalSectionEx EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader FindNextFileW GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW GetStartupInfoW HeapReAlloc MoveFileExW GetLastError WriteFile DeleteFileW CreateFileW MultiByteToWideChar WideCharToMultiByte FindResourceW SizeofResource LockResource LoadResource GetTickCount CreateThread Sleep DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetComputerNameW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW MulDiv GetModuleFileNameW GetTickCount64 GetLocalTime CreateEventW WaitForSingleObject ResetEvent SetEvent IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers InitializeSListHead HeapSize SetEndOfFile WriteConsoleW CloseHandle GetFileAttributesW CreateDirectoryW GetEnvironmentVariableW GetProcAddress GetStdHandle IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree SetUnhandledExceptionFilter TerminateProcess VirtualProtect LoadLibraryExW

Name

.text

Size

325KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

48db2ddcc81839bbd26c206696a47dc772fb7892603616da09657cd976533f69.exe

gdiplus

user32

gdi32

comctl32

winmm

uxtheme

shell32

ole32

comdlg32

ws2_32

bcrypt

mfplat

mfreadwrite

winhttp

kernel32

generic