a8d081e83c97f9d4b1a9cbcf3aaf6093a8773dc3a26a4e396068bbb51b662efc

Sharing

Copy URL Twitter E-mail

General

Target
a8d081e83c97f9d4b1a9cbcf3aaf6093a8773dc3a26a4e396068bbb51b662efc
Size 220KB
Sample261027-c7debahz91
SHA256 a8d081e83c97f9d4b1a9cbcf3aaf6093a8773dc3a26a4e396068bbb51b662efc
MD5 8c46fdd51f253431d6ae5d934ae95888
SHA1 f81f860e29c596167318e350d500602812425672
SHA512 065fdd9179c153b3d8bf31f9209f9fec122baec59be565c67100e6640299ee7968cc707c301d378929e1bc4dac15996f0d61006ce66485e5049af02f4165d9ae
SSDEEP 3072:ohpKSXKP85EiQiJ6JW9JeBlmzT6WjLUYz5J0fEy:nW5hXd9kGzpn5J0fE
TLSH
T16C24B54073EA5615F6B747306CFE62616A36BC226F73C6CF6600212D1DB27E1AE74362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8d081e83c97f9d4b1a9cbcf3aaf6093a8773dc3a26a4e396068bbb51b662efc

File Explorer

a8d081e83c97f9d4b1a9cbcf3aaf6093a8773dc3a26a4e396068bbb51b662efc

.dll 220KB

a8d081e83c97f9d4b1a9cbcf3aaf6093a8773dc3a26a4e396068bbb51b662efc

IMPHASH a0d52830c1f9f5fd42a41eac92b791f9
SHA256 a8d081e83c97f9d4b1a9cbcf3aaf6093a8773dc3a26a4e396068bbb51b662efc
MD5 8c46fdd51f253431d6ae5d934ae95888
SHA1 f81f860e29c596167318e350d500602812425672
SHA512 065fdd9179c153b3d8bf31f9209f9fec122baec59be565c67100e6640299ee7968cc707c301d378929e1bc4dac15996f0d61006ce66485e5049af02f4165d9ae
SSDEEP 3072:ohpKSXKP85EiQiJ6JW9JeBlmzT6WjLUYz5J0fEy:nW5hXd9kGzpn5J0fE
TLSH
T16C24B54073EA5615F6B747306CFE62616A36BC226F73C6CF6600212D1DB27E1AE74362
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32

BSTR_UserFree BSTR_UserMarshal BSTR_UserSize BSTR_UserUnmarshal SysAllocString SysAllocStringLen VARIANT_UserFree VARIANT_UserMarshal VARIANT_UserSize VARIANT_UserUnmarshal VariantClear VariantInit

ole32

CoMarshalInterface CoReleaseMarshalData CoUnmarshalInterface CreateStreamOnHGlobal HMENU_UserFree HMENU_UserMarshal HMENU_UserSize HMENU_UserUnmarshal HWND_UserFree HWND_UserMarshal HWND_UserSize HWND_UserUnmarshal

user32

ChildWindowFromPointEx ClientToScreen GetAncestor GetClientRect GetGUIThreadInfo GetWindow GetWindowLongW GetWindowThreadProcessId IsChild IsWindow IsWindowVisible LoadStringA LoadStringW MapWindowPoints RealGetWindowClassW ScreenToClient SendMessageW WindowFromPoint

rpcrt4

CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_QueryInterface IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrDllCanUnloadNow NdrDllGetClassObject NdrOleAllocate NdrOleFree NdrStubCall2 NdrStubForwardingFunction

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _strdup _wcsicmp calloc free fwrite getenv memcmp memcpy memmove strchr strcmp strcpy strcspn strlen wcslen wcstoul

kernel32

CloseHandle CreateFileMappingW DisableThreadLibraryCalls DuplicateHandle EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount GlobalAddAtomW GlobalAlloc GlobalDeleteAtom GlobalFree GlobalGetAtomNameW HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryW LoadResource MapViewOfFile MultiByteToWideChar OpenProcess RaiseException SizeofResource UnmapViewOfFile WideCharToMultiByte

ntdll

_vsnprintf

Sharing

General

Malware Config

Signatures

File Explorer

a8d081e83c97f9d4b1a9cbcf3aaf6093a8773dc3a26a4e396068bbb51b662efc

oleaut32

ole32

user32

rpcrt4

ucrtbase

kernel32

ntdll

generic