d0e2910167770cc1b27aa35532d541f10c2ef414c6597d51550687fd4c76d32c

Sharing

Copy URL Twitter E-mail

General

Target
d0e2910167770cc1b27aa35532d541f10c2ef414c6597d51550687fd4c76d32c
Size 258KB
Sample261027-ar6d2sat7q
SHA256 d0e2910167770cc1b27aa35532d541f10c2ef414c6597d51550687fd4c76d32c
MD5 b2ba881c0bd4793497975b700faf87a9
SHA1 586245fbfb7e51ccf0f3e585e32a6d64a5d8893a
SHA512 5a12b83e3575415a317cb234acff0fdb3f635540cdade10feacc744dab1827c9ae3ffbc24b7f2be182ed06ae3fa40181d1a25d48f40f3ef3990ab02530f09670
SSDEEP 6144:Q0ffHxKbDxle1H/0+9PILAPMeHRzCBV+UdvrEFp7hKf4IMy/:RfZCvg/0+UoCBjvrEH7M4I3
TLSH
T1D2448C0032D083FDE5BE0A3875785A6555FE783C1B79C8CF535409AA5E3CAC29A35B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d0e2910167770cc1b27aa35532d541f10c2ef414c6597d51550687fd4c76d32c

File Explorer

d0e2910167770cc1b27aa35532d541f10c2ef414c6597d51550687fd4c76d32c

.dll 258KB

d0e2910167770cc1b27aa35532d541f10c2ef414c6597d51550687fd4c76d32c

IMPHASH caaf99e38405dca4e6adbc7904b271a7
SHA256 d0e2910167770cc1b27aa35532d541f10c2ef414c6597d51550687fd4c76d32c
MD5 b2ba881c0bd4793497975b700faf87a9
SHA1 586245fbfb7e51ccf0f3e585e32a6d64a5d8893a
SHA512 5a12b83e3575415a317cb234acff0fdb3f635540cdade10feacc744dab1827c9ae3ffbc24b7f2be182ed06ae3fa40181d1a25d48f40f3ef3990ab02530f09670
SSDEEP 6144:Q0ffHxKbDxle1H/0+9PILAPMeHRzCBV+UdvrEFp7hKf4IMy/:RfZCvg/0+UoCBjvrEH7M4I3
TLSH
T1D2448C0032D083FDE5BE0A3875785A6555FE783C1B79C8CF535409AA5E3CAC29A35B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30000

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\Win32\ExplorerPatcher.IA-32.pdb

kernel32

LoadLibraryW CreateThread GetWindowsDirectoryW GetProcAddress GetCurrentProcessId GetModuleHandleW FreeLibrary QueryFullProcessImageNameW AllocConsole VirtualQuery LoadLibraryExW WaitForMultipleObjects WaitForSingleObject GetModuleFileNameA CreateSemaphoreExW HeapFree ReleaseSemaphore GetCurrentThreadId ReleaseMutex FormatMessageW OutputDebugStringW WaitForSingleObjectEx OpenSemaphoreW HeapAlloc CreateMutexExW GetProcessHeap WideCharToMultiByte DebugBreak IsDebuggerPresent ReadFile CreateFileW GetSystemInfo DecodePointer WriteConsoleW HeapSize GetStringTypeW FlushFileBuffers CloseHandle GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc GetFileSizeEx SetFilePointerEx ReadConsoleW SetEndOfFile SetStdHandle MultiByteToWideChar GetConsoleMode GetConsoleOutputCP WriteFile GetStdHandle LCMapStringW ExitProcess TerminateProcess GetCurrentProcess UnhandledExceptionFilter GetFileType DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue LoadLibraryExA DisableThreadLibraryCalls SetEvent GetLastError CreateEventW OpenProcess GetSystemDirectoryW FindClose CompareStringOrdinal GetModuleFileNameW GetModuleHandleExW SetLastError VirtualProtect FlsGetValue FlsAlloc InterlockedFlushSList RaiseException InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter IsProcessorFeaturePresent FreeConsole FindFirstFileW FreeEnvironmentStringsW CreateDirectoryW

user32

SystemParametersInfoW RegisterWindowMessageW GetSystemMetricsForDpi SetWindowLongW GetClassNameW FindWindowW SetPropW MapWindowPoints EnumPropsA SetMenuItemInfoW InvalidateRect GetAncestor GetWindowTextW GetParent RedrawWindow GetWindowLongW GetMenuItemInfoW GetClassWord PostMessageW FindWindowExW GetWindowRect GetPropW GetMenuItemCount CreateWindowExW SendMessageW RemovePropW LoadAcceleratorsW TrackPopupMenu

advapi32

RegCreateKeyExW RegGetValueW RegOpenKeyExW RegNotifyChangeKeyValue RegSetKeyValueW RegCloseKey AllocateAndInitializeSid RegQueryValueExW RegSetValueExW FreeSid CheckTokenMembership

shell32

SHChangeNotify ord526 SHGetFolderPathW

ole32

CoCreateInstance

shlwapi

StrStrIW PathStripPathW PathFileExistsW SHGetValueW

uxtheme

SetWindowThemeAttribute

comctl32

ord413 ord412 ord410

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

dbghelp

ImageDirectoryEntryToDataEx

ntdll

RtlUnwind

Name

.text

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d0e2910167770cc1b27aa35532d541f10c2ef414c6597d51550687fd4c76d32c

kernel32

user32

advapi32

shell32

ole32

shlwapi

uxtheme

comctl32

dwmapi

dbghelp

ntdll

generic