c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061

Sharing

Copy URL Twitter E-mail

General

Target
c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061
Size 683KB
Sample261024-jalgzsav2n
SHA256 c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061
MD5 17ae30d5879c0716433a5ef97b626912
SHA1 fdf13ad12b771b8344d3a19e4ab4753de8743ed2
SHA512 123366f44ca80c14b0f3ce705f77968596bc7b41ba12f0985e021d78928959c459df13b9bef19b08f942f72af5ad601b9d74b3531bc9007b24f088c55f0f645d
SSDEEP 12288:x/hFpTzDKSj5QMJXUGCfBjn3/Svi3PX9rUmKhWq:x/hFtz9tQMJbe3PNr/KhW
TLSH
T181E49E65A79402F9E0B7C278CE578902E77378450371A6EF03D196B25F276E09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061

File Explorer

c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061

.exe 683KB

c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061

IMPHASH 037b0f3bc4bff7522888c1e6b336200b
SHA256 c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061
MD5 17ae30d5879c0716433a5ef97b626912
SHA1 fdf13ad12b771b8344d3a19e4ab4753de8743ed2
SHA512 123366f44ca80c14b0f3ce705f77968596bc7b41ba12f0985e021d78928959c459df13b9bef19b08f942f72af5ad601b9d74b3531bc9007b24f088c55f0f645d
SSDEEP 12288:x/hFpTzDKSj5QMJXUGCfBjn3/Svi3PX9rUmKhWq:x/hFtz9tQMJbe3PNr/KhW
TLSH
T181E49E65A79402F9E0B7C278CE578902E77378450371A6EF03D196B25F276E09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

200340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

InitCommonControlsEx

dwmapi

DwmIsCompositionEnabled DwmGetWindowAttribute

shell32

SHGetKnownFolderPath ShellExecuteW

ole32

CoTaskMemFree CoInitializeEx CoUninitialize

advapi32

RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey

kernel32

GetProcessHeap FreeEnvironmentStringsW SetStdHandle HeapReAlloc GetStdHandle GetEnvironmentVariableW SetEnvironmentVariableW CreateFileW FileTimeToLocalFileTime GetDriveTypeW GetFileAttributesExW GetLogicalDriveStringsW CloseHandle WaitForSingleObject GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess GlobalMemoryStatusEx GetLocalTime GetNativeSystemInfo FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryW QueryFullProcessImageNameW GetComputerNameW FileTimeToSystemTime HeapSize WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapFree HeapAlloc WriteFile ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread WriteConsoleW SetEndOfFile MultiByteToWideChar ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead LocalFree FormatMessageA GetLocaleInfoEx TryAcquireSRWLockExclusive CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileInformationByHandle GetTempPathW AreFileApisANSI GetLastError CopyFileW GetFileInformationByHandleEx GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread RtlUnwind

user32

EnumDisplayDevicesW EnumDisplaySettingsW LoadIconW LoadCursorW GetWindowThreadProcessId EnumWindows GetWindowLongPtrW ClientToScreen GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW UpdateWindow GetSystemMetrics MonitorFromRect IsIconic IsWindowVisible FlashWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW SendMessageTimeoutW SendMessageW DispatchMessageW TranslateMessage GetMessageW GetMonitorInfoW EnumDisplayMonitors SetProcessDPIAware EnableWindow

gdi32

DeleteObject CreateFontW

Name

.text

Size

359KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

183KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c9d1e871882c5978f8a9c570bdb524f154b8630552801752e3d28b99716f9061

comctl32

dwmapi

shell32

ole32

advapi32

kernel32

user32

gdi32

generic