4955a18c5de0387bc5c3b83e1e7cc09f4058c092aab350723e748ed1a00eae49

Sharing

Copy URL Twitter E-mail

General

Target
4955a18c5de0387bc5c3b83e1e7cc09f4058c092aab350723e748ed1a00eae49
Size 2.9MB
Sample261027-e5fg1aav7v
SHA256 4955a18c5de0387bc5c3b83e1e7cc09f4058c092aab350723e748ed1a00eae49
MD5 44ab5c530584f467c07b141ad803bdfc
SHA1 fca16920b17a21f869dc9b4e5fb4b67eab347842
SHA512 daf3eb3e307cc70be1c24166f6ae1621d9308791fc635299d258f30d509f925adbbe0f936eec90311b57c0178159b8b6bfacdfbea116538b5c143861a9390615
SSDEEP 49152:nNdDGViZaH7/p+Slo8+56LaShsyIWxmSUPlo0DRZh/1TC9333W4:NBGViCwdux3UPlo0VZpQ333p
TLSH
T1F0E55C13F284753EC85A2A36863395E4993BB76179128C27E7FC394C8F354906A3E7C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4955a18c5de0387bc5c3b83e1e7cc09f4058c092aab350723e748ed1a00eae49

File Explorer

4955a18c5de0387bc5c3b83e1e7cc09f4058c092aab350723e748ed1a00eae49

.exe 2.9MB

4955a18c5de0387bc5c3b83e1e7cc09f4058c092aab350723e748ed1a00eae49

IMPHASH 32fbe81dfedd5c097347c36839ca94c4
SHA256 4955a18c5de0387bc5c3b83e1e7cc09f4058c092aab350723e748ed1a00eae49
MD5 44ab5c530584f467c07b141ad803bdfc
SHA1 fca16920b17a21f869dc9b4e5fb4b67eab347842
SHA512 daf3eb3e307cc70be1c24166f6ae1621d9308791fc635299d258f30d509f925adbbe0f936eec90311b57c0178159b8b6bfacdfbea116538b5c143861a9390615
SSDEEP 49152:nNdDGViZaH7/p+Slo8+56LaShsyIWxmSUPlo0DRZh/1TC9333W4:NBGViCwdux3UPlo0VZpQ333p
TLSH
T1F0E55C13F284753EC85A2A36863395E4993BB76179128C27E7FC394C8F354906A3E7C6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2860668

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

mpr

WNetEnumResourceW WNetGetUniversalNameW WNetGetConnectionW WNetCloseEnum WNetOpenEnumW

comdlg32

GetSaveFileNameW GetOpenFileNameW

comctl32

FlatSB_SetScrollInfo InitCommonControls ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB FlatSB_GetScrollInfo ImageList_Write ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_Draw ImageList_Remove

shell32

SHBrowseForFolderW SHGetMalloc SHGetFileInfoW SHChangeNotify Shell_NotifyIconW ShellExecuteW SHGetPathFromIDListW ShellExecuteExW

user32

CopyImage SetMenuItemInfoW GetMenuItemInfoW DefFrameProcW ScrollWindowEx GetDlgCtrlID FrameRect RegisterWindowMessageW GetMenuStringW FillRect SendMessageA EnumWindows ShowOwnedPopups GetClassInfoW GetScrollRange SetActiveWindow GetActiveWindow DrawEdge GetKeyboardLayoutList OemToCharBuffA LoadBitmapW EnumChildWindows SendNotifyMessageW GetScrollBarInfo UnhookWindowsHookEx SetCapture GetCapture ShowCaret CreatePopupMenu GetMenuItemID CharLowerBuffW PostMessageW SetWindowLongW IsZoomed SetParent DrawMenuBar GetClientRect IsChild IsIconic CallNextHookEx ShowWindow GetWindowTextW SetForegroundWindow IsDialogMessageW DestroyWindow RegisterClassW EndMenu CharNextW GetFocus GetDC SetFocus ReleaseDC ExitWindowsEx GetClassLongW SetScrollRange DrawTextW CharToOemBuffA PeekMessageA MessageBeep SetClassLongW SetRectEmpty RemovePropW GetSubMenu DestroyIcon IsWindowVisible DispatchMessageA UnregisterClassW GetTopWindow SendMessageW SendMessageTimeoutW LoadStringW CreateMenu CharLowerW SetWindowRgn SetWindowPos GetMenuItemCount GetSysColorBrush GetWindowDC DrawTextExW ReplyMessage GetScrollInfo SetWindowTextW GetMessageExtraInfo GetSysColor EnableScrollBar TrackPopupMenu DrawIconEx GetClassNameW GetMessagePos GetIconInfo SetScrollInfo GetKeyNameTextW GetDesktopWindow SetCursorPos GetCursorPos SetMenu GetMenuState GetMenu SetRect GetKeyState GetCursor KillTimer WaitMessage TranslateMDISysAccel GetWindowPlacement CreateWindowExW GetMessageW GetDCEx PeekMessageW MonitorFromWindow SetTimer WindowFromPoint BeginPaint RegisterClipboardFormatW MapVirtualKeyW OffsetRect IsWindowUnicode DispatchMessageW TrackPopupMenuEx DefMDIChildProcW WaitForInputIdle GetSystemMenu SetScrollPos GetScrollPos InflateRect DrawFocusRect ReleaseCapture LoadCursorW ScrollWindow GetLastActivePopup GetSystemMetrics CharUpperBuffW ClientToScreen SetWindowPlacement GetMonitorInfoW CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow EnableWindow GetWindowThreadProcessId RedrawWindow EndPaint MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW ActivateKeyboardLayout GetParent InsertMenuItemW GetPropW MessageBoxW SetPropW UpdateWindow MsgWaitForMultipleObjects DestroyMenu SetWindowsHookExW AdjustWindowRectEx IsWindow DrawIcon EnumThreadWindows InvalidateRect GetKeyboardState ScreenToClient DrawFrameControl BringWindowToTop SetCursor CreateIcon RemoveMenu AppendMenuW GetKeyboardLayoutNameW TranslateMessage MapWindowPoints EnumDisplayMonitors CallWindowProcW DestroyCursor PostQuitMessage ShowScrollBar LoadImageW EnableMenuItem HideCaret FindWindowExW LoadIconW SystemParametersInfoW MonitorFromPoint GetWindow GetWindowRect GetWindowLongW InsertMenuW IsWindowEnabled IsDialogMessageA FindWindowW GetKeyboardLayout DeleteMenu

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

SafeArrayPutElement LoadTypeLib GetErrorInfo VariantInit VariantClear SysFreeString SysReAllocStringLen SafeArrayCreate SafeArrayGetElement GetActiveObject SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound VariantCopy RegisterTypeLib VariantChangeType VariantCopyInd

advapi32

RegSetValueExW RegEnumKeyExW AdjustTokenPrivileges OpenThreadToken GetUserNameW RegDeleteKeyW LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegQueryInfoKeyW AllocateAndInitializeSid FreeSid EqualSid RegDeleteValueW RegFlushKey RegQueryValueExW RegEnumValueW GetTokenInformation InitializeSecurityDescriptor RegCloseKey RegCreateKeyExW SetSecurityDescriptorDacl

netapi32

NetWkstaGetInfo NetApiBufferFree

msvcrt

memcpy

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpSetTimeouts WinHttpSetStatusCallback WinHttpConnect WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpWriteData WinHttpSetCredentials WinHttpQueryDataAvailable WinHttpSetOption WinHttpSendRequest WinHttpQueryOption

kernel32

SetFileAttributesW SetFileTime GetACP GetExitCodeProcess IsBadWritePtr CloseHandle LocalFree GetCurrentProcessId SizeofResource VirtualProtect UpdateResourceW TerminateThread QueryPerformanceFrequency IsDebuggerPresent FindNextFileW GetFullPathNameW VirtualFree HeapAlloc ExitProcess WriteProfileStringW GetCPInfoExW RtlUnwind GetCPInfo GetStdHandle GetTimeZoneInformation FileTimeToLocalFileTime GetModuleHandleW FreeLibrary HeapDestroy CompareFileTime ReadFile CreateProcessW TransactNamedPipe GetLastError GetModuleFileNameW SetLastError FindResourceW OpenMutexW CreateThread CompareStringW CopyFileW CreateMutexW LoadLibraryA ResetEvent MulDiv FreeResource GetDriveTypeW GetVersion RaiseException MoveFileW GlobalAddAtomW GetSystemTimeAsFileTime FormatMessageW OpenProcess SwitchToThread GetExitCodeThread OutputDebugStringW GetCurrentThread GetLogicalDrives LocalFileTimeToFileTime SetNamedPipeHandleState LoadLibraryExW TerminateProcess LockResource BeginUpdateResourceW FileTimeToSystemTime GetShortPathNameW GetCurrentThreadId UnhandledExceptionFilter MoveFileExW GlobalFindAtomW VirtualQuery GlobalFree VirtualQueryEx Sleep EnterCriticalSection SetFilePointer ReleaseMutex FlushFileBuffers LoadResource SuspendThread GetTickCount EnumResourceLanguagesW WritePrivateProfileStringW GetFileSize GlobalDeleteAtom GetStartupInfoW GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc GetSystemInfo GetCommandLineW LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate GetWindowsDirectoryW DeviceIoControl LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage lstrlenW QueryPerformanceCounter SetEndOfFile lstrcmpW HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW GetSystemDirectoryW DeleteFileW GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile CreateNamedPipeW ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW IsValidLocale TlsSetValue EndUpdateResourceW CreateDirectoryW GetOverlappedResult GetSystemDefaultUILanguage EnumCalendarInfoW GetProfileStringW LocalAlloc GetUserDefaultLangID RemoveDirectoryW IsDBCSLeadByte CreateEventW GetPrivateProfileStringW WaitForMultipleObjectsEx GetThreadLocale SetThreadLocale

ole32

StgCreateDocfileOnILockBytes CoCreateInstance CLSIDFromString CoUninitialize IsEqualGUID OleInitialize CoFreeUnusedLibraries CreateILockBytesOnHGlobal CLSIDFromProgID OleUninitialize CoDisconnectObject CoInitialize CoTaskMemFree CoTaskMemAlloc StringFromCLSID

gdi32

Arc Pie SetBkMode SelectPalette CreateCompatibleBitmap ExcludeClipRect RectVisible SetWindowOrgEx MaskBlt AngleArc Chord SetTextColor StretchBlt SetDIBits SetViewportOrgEx CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable RoundRect RestoreDC SetRectRgn GetTextMetricsW RemoveFontResourceW GetWindowOrgEx CreatePalette CreateBrushIndirect PatBlt LineDDA PolyBezierTo GetStockObject CreateSolidBrush Polygon Rectangle MoveToEx DeleteDC SaveDC BitBlt Ellipse FrameRgn GetDeviceCaps GetBitmapBits GetTextExtentPoint32W GetClipBox Polyline IntersectClipRect GetSystemPaletteEntries CreateBitmap AddFontResourceW CreateDIBitmap GetStretchBltMode CreateDIBSection CreatePenIndirect SetStretchBltMode GetDIBits CreateFontIndirectW PolyBezier LineTo GetRgnBox EnumFontsW CreateHalftonePalette DeleteObject SelectObject ExtFloodFill UnrealizeObject SetBkColor CreateCompatibleDC GetObjectW GetBrushOrgEx GetCurrentPositionEx SetROP2 GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel ArcTo GdiFlush SetPixel EnumFontFamiliesExW GetPaletteEntries

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

29KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

151B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

76B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

155KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4955a18c5de0387bc5c3b83e1e7cc09f4058c092aab350723e748ed1a00eae49

mpr

comdlg32

comctl32

shell32

user32

version

oleaut32

advapi32

netapi32

msvcrt

winhttp

kernel32

ole32

gdi32

generic