f8a4f34744c5e451242feaaa5bdc895c2d702edba3293c93ed619d47cd778468

Sharing

Copy URL Twitter E-mail

General

Target
f8a4f34744c5e451242feaaa5bdc895c2d702edba3293c93ed619d47cd778468
Size 1.5MB
Sample261027-jmvlesstht
SHA256 f8a4f34744c5e451242feaaa5bdc895c2d702edba3293c93ed619d47cd778468
MD5 b9f7426ea43c68a52c216b6d9bbc3aae
SHA1 6b82a61452470eb6d179db62a020ee3898437a04
SHA512 722624ee4236dd4e98eefc2397df7392a5356b11f37166aa67d71a2b9355037572f6d7996c5c578c117b75eea5cf2f5e69686a0d41492cdab9520654695e414e
SSDEEP 49152:YVyUkI4ujKeT/ZvTDrhjBqmu2WarSj8RoTCCW:RfujKeT/ZvTfvGJTy
TLSH
T1C475CE21778AC039E6B226B099399B96543EBD717B76CCCB63C4796C48306E15E34B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8a4f34744c5e451242feaaa5bdc895c2d702edba3293c93ed619d47cd778468

File Explorer

f8a4f34744c5e451242feaaa5bdc895c2d702edba3293c93ed619d47cd778468

.exe 1.5MB

f8a4f34744c5e451242feaaa5bdc895c2d702edba3293c93ed619d47cd778468

IMPHASH 5a99d03856ee9c5125ee42feee942527
SHA256 f8a4f34744c5e451242feaaa5bdc895c2d702edba3293c93ed619d47cd778468
MD5 b9f7426ea43c68a52c216b6d9bbc3aae
SHA1 6b82a61452470eb6d179db62a020ee3898437a04
SHA512 722624ee4236dd4e98eefc2397df7392a5356b11f37166aa67d71a2b9355037572f6d7996c5c578c117b75eea5cf2f5e69686a0d41492cdab9520654695e414e
SSDEEP 49152:YVyUkI4ujKeT/ZvTDrhjBqmu2WarSj8RoTCCW:RfujKeT/ZvTfvGJTy
TLSH
T1C475CE21778AC039E6B226B099399B96543EBD717B76CCCB63C4796C48306E15E34B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

335443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wevtapi

EvtNext EvtClose EvtSubscribe EvtCreateRenderContext EvtRender

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

kernel32

CreateMutexW OpenEventW Sleep WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId CreateProcessW OpenProcess GetTickCount GetTickCount64 FindResourceExW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW lstrcmpiW QueryFullProcessImageNameW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW LoadLibraryW ResetEvent CreateEventW LCMapStringEx GetVersionExW IsWow64Process LocalFree OpenMutexW GetProcessTimes ProcessIdToSessionId GetSystemTimeAsFileTime GetWindowsDirectoryW OpenFileMappingW MapViewOfFile UnmapViewOfFile LocaleNameToLCID SetThreadUILanguage GetThreadUILanguage WaitForMultipleObjectsEx CreateFileMappingW DebugBreak ReleaseSemaphore WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetModuleFileNameA GetModuleHandleExW WideCharToMultiByte ExpandEnvironmentStringsW FindFirstChangeNotificationW FindNextChangeNotification GetFileSizeEx GetFileTime MulDiv lstrcmpW SetEnvironmentVariableW GetFileAttributesW GetFileSize SetEndOfFile SetFilePointer WakeAllConditionVariable TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter HeapReAlloc WaitForSingleObject GetStringTypeW QueryPerformanceCounter TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead SleepConditionVariableSRW EncodePointer GetStartupInfoW RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA GetCommandLineW ExitProcess GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree ReleaseMutex HeapAlloc SetEvent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapDestroy RaiseException DecodePointer ReadFile FindCloseChangeNotification DeleteFileW WritePrivateProfileStringW GetPrivateProfileStringW FormatMessageW GetCurrentThreadId SetLastError GetLastError CloseHandle IsDebuggerPresent WriteFile CreateFileW OutputDebugStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetCPInfo WriteConsoleW VirtualProtect EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW

user32

GetWindowTextLengthW GetWindowTextW DrawTextW EnumWindows IsIconic MonitorFromWindow SystemParametersInfoW LoadImageW GetWindow GetDesktopWindow FillRect GetSysColorBrush GetSysColor SetCursor SetWindowTextW RedrawWindow ReleaseDC GetDlgCtrlID SetDlgItemTextW GetDlgItem IsWindow ChangeWindowMessageFilterEx GetMonitorInfoW MonitorFromPoint IsDialogMessageW GetLastActivePopup GetCursorPos SetForegroundWindow TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu KillTimer SetTimer MsgWaitForMultipleObjectsEx CreateDialogParamW ShowWindow CallWindowProcW PostQuitMessage DefWindowProcW SendMessageW UnregisterHotKey RegisterHotKey RegisterWindowMessageW GetClassNameW EnumChildWindows GetParent GetWindowLongW MapWindowPoints GetWindowRect GetClientRect InvalidateRect GetDC SetWindowPos LoadStringW DestroyIcon LoadCursorW GetWindowThreadProcessId FindWindowW SetWindowLongW MessageBoxW MessageBoxA AllowSetForegroundWindow GetSystemMetrics EnableWindow CharNextW DestroyWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW PostMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW SetUserObjectInformationW IsWindowVisible

gdi32

SelectObject DeleteObject CreatePen CreateCompatibleDC CreateCompatibleBitmap GetDeviceCaps DeleteDC Polygon

advapi32

FreeSid RegFlushKey StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx OpenServiceW OpenSCManagerW ControlService CloseServiceHandle ChangeServiceConfigW CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW LookupPrivilegeValueW RegCloseKey CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken RegOpenKeyExW RegEnumKeyExW RegDeleteKeyW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegDeleteValueW RegCreateKeyExW

shell32

Shell_NotifyIconW SHQueryUserNotificationState ShellExecuteW SetCurrentProcessExplicitAppUserModelID

ole32

CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoInitialize StringFromGUID2 CoUninitialize CoTaskMemAlloc CoCreateGuid IIDFromString

oleaut32

VariantClear VariantInit SysAllocString VarUI4FromStr SysFreeString VarI4FromStr VarR8FromStr VarDateFromStr VarDecFromStr VarDecCmp

comctl32

ord381 ord345

uxtheme

SetWindowTheme

winhttp

WinHttpOpen WinHttpCrackUrl WinHttpQueryHeaders WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpConnect WinHttpSendRequest WinHttpWriteData WinHttpReadData WinHttpCloseHandle WinHttpSetStatusCallback WinHttpOpenRequest WinHttpSetOption WinHttpAddRequestHeaders WinHttpSetCredentials

Sharing

General

Malware Config

Signatures

File Explorer

f8a4f34744c5e451242feaaa5bdc895c2d702edba3293c93ed619d47cd778468

userenv

wevtapi

wtsapi32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

uxtheme

winhttp

generic