a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028

Sharing

Copy URL Twitter E-mail

General

Target
a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028
Size 4.9MB
Sample261027-e5fsrsav7w
SHA256 a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028
MD5 5aa7ed2d1b386bbda2a4a69b3a4fe432
SHA1 8ebdf2754bcdc0467efb02bbc69583946074fe64
SHA512 6da5226e6f7d747981bfda6e1767d4d8643529137e50924d6ef26533a269660321810a02f91e1d91819c9889778d49259f5444f5e025bb6fbd676367022cc116
SSDEEP 98304:9QieREYGnl05yEEMvkB3DAq76svA4h4e9OR2:+tRM3DAqu
TLSH
T1BB36AF10B647C277ED510570653DBAAF542A7E140B6888D3E3C82F2E59B4AD32A33F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028

File Explorer

a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028

.exe 4.9MB

a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028

IMPHASH 596dd0b7849e9ff78492bc269d5cb555
SHA256 a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028
MD5 5aa7ed2d1b386bbda2a4a69b3a4fe432
SHA1 8ebdf2754bcdc0467efb02bbc69583946074fe64
SHA512 6da5226e6f7d747981bfda6e1767d4d8643529137e50924d6ef26533a269660321810a02f91e1d91819c9889778d49259f5444f5e025bb6fbd676367022cc116
SSDEEP 98304:9QieREYGnl05yEEMvkB3DAq76svA4h4e9OR2:+tRM3DAqu
TLSH
T1BB36AF10B647C277ED510570653DBAAF542A7E140B6888D3E3C82F2E59B4AD32A33F67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3467343

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Rhino\Safe\Install\FileDown\safedownloader\bin\Win32\release_static\2345SafeDownloader.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

gdiplus

GdipCloneBitmapArea GdipGetCellDescent GdipSetInterpolationMode GdipSetLinePresetBlend GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipEndContainer GdipSetSmoothingMode GdipCreateMatrix GdipGetStringFormatAlign GdipDeletePath GdipDisposeImageAttributes GdipCreateMatrix2 GdipDeleteBrush GdipGetLineSpacing GdipSetLineWrapMode GdipCreateLineBrushI GdipDrawImageRectRect GdipSaveGraphics GdipCreateFontFamilyFromName GdipGetEmHeight GdipGetStringFormatLineAlign GdipAddPathString GdipGetTextRenderingHint GdipGetFamily GdipSetCompositingQuality GdipSetImageAttributesColorMatrix GdipGetLineTransform GdipDeleteFontFamily GdipGetInterpolationMode GdipCreateRegionPath GdipAddPathLineI GdipAddPathBezierI GdipCombineRegionPath GdipAddPathEllipseI GdipAddPathArcI GdipAddPathRectangleI GdipCombineRegionRegion GdipGetBrushType GdipSetLineTransform GdipSetTextureTransform GdipSetCompositingMode GdipCreateHBITMAPFromBitmap GdipDrawPath GdipDrawString GdipSetImageAttributesWrapMode GdipGetFontStyle GdipCreateFromHDC GdipTransformRegion GdipBeginContainer2 GdipCreateTexture GdipGetTextureTransform GdipSetPixelOffsetMode GdipCloneStringFormat GdipSetTextRenderingHint GdipGetCellAscent GdipStringFormatGetGenericTypographic GdipRotateWorldTransform GdipRestoreGraphics GdipCloneBrush GdipMeasureString GdipDeleteRegion GdipGetImageGraphicsContext GdipFillRectangleI ord1 GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipGetFontSize GdipTranslateWorldTransform GdipDeletePen GdipCreatePen1 GdipSetStringFormatAlign GdipDrawImageRectRectI GdipDeleteMatrix GdipGetFamilyName GdipCloneRegion GdipSetStringFormatFlags GdipGetImagePixelFormat GdipCloneBitmapAreaI GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipBitmapUnlockBits GdipGetPropertyItem GdipCreateBitmapFromStream GdipImageSelectActiveFrame GdipBitmapLockBits GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetImageWidth GdipGetPropertyItemSize GdipCreateSolidFill GdipGetClipBoundsI GdipScaleWorldTransform GdipSetClipRectI GdipClosePathFigure GdipGetSmoothingMode GdipSetStringFormatTrimming GdipFillPath GdipGetPathWorldBounds GdipMultiplyWorldTransform GdipGraphicsClear GdipSetPenDashStyle GdipDrawLine GdipFillEllipse GdipDrawArcI GdipCreateImageAttributes GdipDrawRectangle GdiplusStartup GdipSaveImageToFile GdipGetImageEncodersSize GdipGetImageRawFormat GdipFree GdipDisposeImage GdipAlloc GdipCloneImage GdipLoadImageFromFileICM GdipGetImageEncoders GdipLoadImageFromFile GdipGetMatrixElements GdipSetClipRegion

kernel32

DeleteFileW GetFileSize GetACP GlobalMemoryStatusEx WaitForMultipleObjects WaitForSingleObject SetEvent ExpandEnvironmentStringsW GetCurrentProcess LocalFree LockResource GetSystemInfo LoadResource FindResourceW lstrcmpiW GetLongPathNameW GetFileAttributesExW ResumeThread CreateEventW ResetEvent WideCharToMultiByte CreateProcessW GetExitCodeProcess GetComputerNameExW OpenProcess GlobalAlloc GlobalFree lstrcpyW LoadLibraryA CreateMutexW ReleaseMutex TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection SetFileTime GetFileTime LoadLibraryExW OpenFileMappingW UnmapViewOfFile MapViewOfFile FindNextFileW SystemTimeToFileTime GetSystemTime CreateDirectoryW GetFullPathNameW RemoveDirectoryW GetTempPathW SetFileAttributesW GetCurrentDirectoryW GetWindowsDirectoryW CopyFileW GetTempFileNameW MoveFileW SwitchToThread GetFileSizeEx FormatMessageW DeviceIoControl QueryPerformanceFrequency QueryPerformanceCounter EncodePointer GetStringTypeW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW MoveFileExW SetUnhandledExceptionFilter TerminateProcess ReadFile InitializeSListHead IsDebuggerPresent GetStartupInfoW lstrcmpW SizeofResource MulDiv SetWaitableTimer CreateWaitableTimerW LocalAlloc FreeResource GlobalLock GlobalUnlock MapViewOfFileEx GetModuleHandleA DisableThreadLibraryCalls CreateThread VirtualProtect GetModuleHandleExW OutputDebugStringA HeapCreate FlushInstructionCache OutputDebugStringW InterlockedPopEntrySList InterlockedPushEntrySList VirtualAlloc VirtualFree LoadLibraryExA GetFileType AreFileApisANSI InterlockedCompareExchange LockFile GetFullPathNameA UnlockFileEx HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile CreateFileA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapCompact UnlockFile CreateFileMappingA LockFileEx FormatMessageA FlushFileBuffers RtlUnwind ExitThread FreeLibraryAndExitThread ExitProcess SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle WriteConsoleW ReleaseSemaphore CreateSemaphoreW SetEndOfFile GetTickCount InterlockedExchangeAdd SetLastError InterlockedExchange InterlockedIncrement IsProcessorFeaturePresent GetFileInformationByHandle Thread32Next Thread32First SuspendThread CreateToolhelp32Snapshot GetThreadContext SetThreadContext OpenThread InterlockedDecrement GetUserDefaultLangID GetProcessHeap HeapDestroy HeapAlloc HeapReAlloc MultiByteToWideChar HeapSize HeapFree CreateFileMappingW GetStdHandle FileTimeToSystemTime GetPrivateProfileStringW VirtualQuery GetLogicalDriveStringsW GetEnvironmentVariableW QueryDosDeviceW FreeLibrary LoadLibraryW GetCurrentProcessId GetLocalTime CreateFileW SetFilePointer WriteFile GetCurrentThreadId GetModuleHandleW GetProcAddress lstrcatW GetFileAttributesW FindClose lstrcpynW lstrlenW FindFirstFileW GetVersionExW CloseHandle GetModuleFileNameW Sleep GetDiskFreeSpaceW DeleteCriticalSection DecodePointer RaiseException InitializeCriticalSectionAndSpinCount GetLastError UnhandledExceptionFilter

user32

UnionRect UpdateLayeredWindow FillRect MsgWaitForMultipleObjects SetRectEmpty GetClassLongW SetCaretPos LoadImageW LoadBitmapW DrawTextW DrawIconEx GetIconInfo ToAscii GetCaretBlinkTime GetKeyboardState GetSysColor IsClipboardFormatAvailable GetClipboardData CloseClipboard SetClipboardData EmptyClipboard GetAncestor RegisterWindowMessageW EnumThreadWindows CreateAcceleratorTableW DestroyAcceleratorTable LoadStringW GetAsyncKeyState InvalidateRgn OpenClipboard SetTimer SetRect GetMonitorInfoW IsChild PtInRect MapWindowPoints GetPropW RemovePropW SetPropW LoadMenuW TrackPopupMenu GetSubMenu GetMenuDefaultItem DestroyIcon IsMenu RegisterClassExW GetClassInfoExW GetWindowTextLengthW GetDC MessageBoxW MonitorFromWindow SetWindowRgn AdjustWindowRectEx ShowWindowAsync GetWindow ValidateRect MoveWindow BringWindowToTop SetParent GetDlgItem KillTimer SetMenuDefaultItem DestroyMenu BeginPaint EndPaint EnableWindow GetWindowTextW GetKeyState ScreenToClient TrackMouseEvent SetCapture ReleaseCapture SetWindowTextW DialogBoxParamW PostMessageW EqualRect EnumChildWindows CreateWindowExW IsWindow OffsetRect RedrawWindow CopyRect ClientToScreen IsRectEmpty IntersectRect LoadCursorW GetWindowDC SetCursor GetClientRect IsZoomed InvalidateRect GetDCEx IsIconic ReleaseDC GetCursorPos wsprintfW GetWindowThreadProcessId GetWindowRect GetFocus SetWindowPos GetSystemMetrics AttachThreadInput GetForegroundWindow SetFocus GetClassNameW GetParent GetMessageW DispatchMessageW PeekMessageW TranslateMessage PostThreadMessageW CharPrevW CharNextW GetDesktopWindow SystemParametersInfoW IsWindowVisible GetWindowLongW DefWindowProcW CallWindowProcW DestroyWindow SendMessageW LoadIconW SetForegroundWindow EndDialog UnregisterClassW SetWindowLongW PostQuitMessage ShowWindow

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegDeleteValueW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW

ole32

OleUninitialize CoInitialize CoCreateGuid OleInitialize CoUninitialize CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CreateStreamOnHGlobal CoGetClassObject StringFromGUID2 CLSIDFromProgID CLSIDFromString OleLockRunning CoCreateInstance

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderPathW SHGetFolderPathW DragQueryFileW DragFinish Shell_NotifyIconW

oleaut32

SysAllocString VarUI4FromStr LoadRegTypeLi VariantInit LoadTypeLi OleCreateFontIndirect DispCallFunc SysStringLen SysAllocStringLen VariantClear SysFreeString

shlwapi

ord12 PathFindFileNameW PathAppendW StrDupW StrToIntA

comctl32

_TrackMouseEvent InitCommonControlsEx

gdi32

SetTextAlign RemoveFontMemResourceEx GetGlyphOutlineW GetCharABCWidthsW GetGlyphIndicesW GetTextExtentPointI SetBkMode GetFontData GdiFlush GetTextFaceW EnumFontFamiliesExW GetFontUnicodeRanges AddFontMemResourceEx GetOutlineTextMetricsW DeleteDC CreateSolidBrush DeleteObject CreateFontIndirectW GetObjectW GetStockObject GetRgnBox SetViewportOrgEx CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt CreatePolygonRgn CreateRectRgnIndirect SetWorldTransform SetGraphicsMode GetDeviceCaps SetBkColor SetTextColor EnumFontsW GetClipBox CreateDIBSection PtInRegion CreateRoundRectRgn GetMapMode SetMapMode GetTextMetricsW GetDIBits CreateDCW ExtTextOutW

msimg32

AlphaBlend

urlmon

CoInternetCreateZoneManager CoInternetCreateSecurityManager

wininet

InternetOpenW HttpQueryInfoW HttpSendRequestW InternetCloseHandle InternetConnectW InternetReadFile HttpOpenRequestW

imm32

ImmAssociateContextEx ImmGetCompositionStringW ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmNotifyIME

usp10

ScriptShape ScriptItemize ScriptFreeCache

winmm

timeGetTime

psapi

GetMappedFileNameW

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

692KB

Virtual Size

691KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

43KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

223KB

Virtual Size

222KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028

version

gdiplus

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

comctl32

gdi32

msimg32

urlmon

wininet

imm32

usp10

winmm

psapi

generic