b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5

Sharing

Copy URL Twitter E-mail

General

Target
b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5
Size 2.3MB
Sample261024-jalsraszhw
SHA256 b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5
MD5 1df0a3a96505e1557f57e27b432c67d8
SHA1 e9708e7131ace47d202df997c3a141c2d920c641
SHA512 410db52190e61cb4841c79cece9922319ca5ff5c0751328d859ed143cae5b0e17bffd62bff5c06eea0affef1c329266178668080482445385e82e2ebaf4bafb4
SSDEEP 49152:wus28DDmg27RnWGj54c47z+GCXm8mz3jwhn:EPDD527BWGIHKxmz32n
TLSH
T157B50119F2D414E4E8B79638CDFA9041D6737C418B34E24F3AAD4A6A1F736D09D3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5

File Explorer

b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5

.exe 2.3MB

b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5

IMPHASH d90de68fd7514a7cb7f921d5a327cde9
SHA256 b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5
MD5 1df0a3a96505e1557f57e27b432c67d8
SHA1 e9708e7131ace47d202df997c3a141c2d920c641
SHA512 410db52190e61cb4841c79cece9922319ca5ff5c0751328d859ed143cae5b0e17bffd62bff5c06eea0affef1c329266178668080482445385e82e2ebaf4bafb4
SSDEEP 49152:wus28DDmg27RnWGj54c47z+GCXm8mz3jwhn:EPDD527BWGIHKxmz32n
TLSH
T157B50119F2D414E4E8B79638CDFA9041D6737C418B34E24F3AAD4A6A1F736D09D3A722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

102440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Data\Projects\GDPRDlg1.0\x64\Release\GDPRDlg.pdb

kernel32

LocalFree SetFileAttributesW WideCharToMultiByte GetVersionExW FindResourceExW GetCurrentProcess SetEndOfFile WriteConsoleW FlushFileBuffers SetStdHandle GetStringTypeW GetConsoleCP LoadLibraryExW FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId DeleteCriticalSection GetFileType ReadConsoleW GetConsoleMode GetCurrentThreadId SetFilePointer LeaveCriticalSection EnterCriticalSection GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetUserGeoID SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW SetLastError GetCPInfo GetOEMCP OutputDebugStringW QueryPerformanceCounter ReadFile CreateFileW GlobalLock GlobalAlloc LockResource LoadResource SizeofResource FindResourceW MultiByteToWideChar GetProcAddress WritePrivateProfileStructW GetPrivateProfileStructW WritePrivateProfileStringW GetPrivateProfileIntW SetFilePointerEx GetGeoInfoW FreeLibrary LoadLibraryW GetModuleFileNameW GetPrivateProfileStringW CloseHandle GetLastError CreateMutexW GetCommandLineW GetACP IsValidCodePage GetProcessHeap SetEnvironmentVariableA WriteFile GetStdHandle GetTimeZoneInformation Sleep HeapSize GetModuleHandleExW ExitProcess RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader CreateDirectoryW IsProcessorFeaturePresent IsDebuggerPresent HeapReAlloc HeapFree HeapAlloc GetSystemTimeAsFileTime DecodePointer EncodePointer GlobalFree InitializeCriticalSectionAndSpinCount GlobalUnlock

user32

SetWindowPos ShowWindow GetSystemMetrics SetFocus CreateWindowExW PostMessageW LoadStringW DestroyWindow GetDC ReleaseDC InvalidateRect DrawTextW SendMessageW GetClientRect SetWindowRgn EnableWindow FillRect BeginPaint EndPaint SetCursor GetCursorPos ScreenToClient PtInRect DefWindowProcW PostQuitMessage UpdateWindow GetMessageW TranslateMessage DispatchMessageW LoadCursorW RegisterClassExW SetWindowLongPtrW GetWindowLongPtrW ReleaseCapture SetCapture

gdi32

GetTextExtentPoint32W SetBkColor CreateSolidBrush CreateRectRgn GetObjectW CreateFontW CreateCompatibleBitmap CreateCompatibleDC DeleteObject GetStockObject GetDeviceCaps SelectObject SetTextColor SetBkMode BitBlt DeleteDC

advapi32

SetEntriesInAclW RegOpenKeyExW RegEnumKeyW SetNamedSecurityInfoW RegQueryValueExW GetNamedSecurityInfoW RegCloseKey

shell32

ShellExecuteW SHGetSpecialFolderPathW CommandLineToArgvW

ole32

CoCreateInstance CreateStreamOnHGlobal CoUninitialize CoInitialize

wininet

InternetOpenUrlW InternetReadFile InternetCloseHandle InternetOpenW

gdiplus

GdipAlloc GdipCloneImage GdipFree GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdiplusStartup GdipDeleteBrush GdiplusShutdown GdipCreateBitmapFromStream GdipCreateSolidFill GdipCreateFromHDC GdipCreateBitmapFromFile GdipFillRectangleI GdipDrawImageRectRect GdipSetInterpolationMode GdipDeleteGraphics GdipCreateHBITMAPFromBitmap

shlwapi

PathFindFileNameW PathRemoveFileSpecW PathFileExistsW

comctl32

_TrackMouseEvent InitCommonControlsEx

msimg32

AlphaBlend

Name

.text

Size

185KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5

kernel32

user32

gdi32

advapi32

shell32

ole32

wininet

gdiplus

shlwapi

comctl32

msimg32

generic