5d21c6996b1a734e50ff1635d2db8b9b1ec477043224317e7a1f559d7378b8aa

Sharing

Copy URL Twitter E-mail

General

Target
5d21c6996b1a734e50ff1635d2db8b9b1ec477043224317e7a1f559d7378b8aa
Size 774KB
Sample261027-mk5kdsdc43
SHA256 5d21c6996b1a734e50ff1635d2db8b9b1ec477043224317e7a1f559d7378b8aa
MD5 7a6478bd30fbd8d9d58466c73fb7c9fd
SHA1 976ffb1fa52269d753ca1c50d625bacf640bfdd1
SHA512 69f0b3f2e31fe4a187bec3aba95448b75074e76ba91a4b7f01f3344a5b9f4f833f3d67299809da639004dd1457142c1e58fa3e73687accd46946a9e37cd7a0fb
SSDEEP 24576:2/Tzjlvg2YgZOrjQpED/qBOGfhoEUhglSForGcQWPiNp:0zjlvRYPrj/GJoFodXaNp
TLSH
T1E7F48D81F5E395F0D02E2931316FB73FDE3514484A2989A7DBF82D44EFB569101EB28A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d21c6996b1a734e50ff1635d2db8b9b1ec477043224317e7a1f559d7378b8aa

File Explorer

5d21c6996b1a734e50ff1635d2db8b9b1ec477043224317e7a1f559d7378b8aa

.dll 774KB

5d21c6996b1a734e50ff1635d2db8b9b1ec477043224317e7a1f559d7378b8aa

IMPHASH b569041fef0494da5d4db6eec8e3d7f0
SHA256 5d21c6996b1a734e50ff1635d2db8b9b1ec477043224317e7a1f559d7378b8aa
MD5 7a6478bd30fbd8d9d58466c73fb7c9fd
SHA1 976ffb1fa52269d753ca1c50d625bacf640bfdd1
SHA512 69f0b3f2e31fe4a187bec3aba95448b75074e76ba91a4b7f01f3344a5b9f4f833f3d67299809da639004dd1457142c1e58fa3e73687accd46946a9e37cd7a0fb
SSDEEP 24576:2/Tzjlvg2YgZOrjQpED/qBOGfhoEUhglSForGcQWPiNp:0zjlvRYPrj/GJoFodXaNp
TLSH
T1E7F48D81F5E395F0D02E2931316FB73FDE3514484A2989A7DBF82D44EFB569101EB28A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

465872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d3d9.pdb

gdi32

CreateCompatibleDC CreateDIBSection CreateFontW CreateRectRgn DeleteObject ExtTextOutW GetDeviceCaps GetTextExtentPoint32W SelectObject SetBkColor SetBkMode SetTextColor

user32

CallWindowProcW ClientToScreen CloseClipboard DefWindowProcW EmptyClipboard GetAsyncKeyState GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetFocus GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardState GetMessageExtraInfo IsWindowUnicode LoadCursorA MonitorFromWindow OpenClipboard ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetProcessDPIAware SetWindowLongW ToUnicode TrackMouseEvent

kernel32

CopyFileA DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection FlushInstructionCache FreeLibrary GetCurrentProcess GetFileAttributesA GetLastError GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetProcAddress GetSystemDirectoryA GetTempPathA GetTickCount GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSection IsBadReadPtr LeaveCriticalSection LoadLibraryA MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency Sleep TlsGetValue VerSetConditionMask VirtualAlloc VirtualFree VirtualProtect VirtualQuery WideCharToMultiByte lstrcpynA

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-heap-l1-1-0

calloc free malloc

api-ms-win-crt-math-l1-1-0

pow

api-ms-win-crt-private-l1-1-0

memchr strchr strrchr strstr

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table _exit _initialize_onexit_table _initterm _initterm_e _register_onexit_function abort

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf _wfopen fclose fflush fopen fread fseek ftell fwrite

api-ms-win-crt-string-l1-1-0

strcmp strncmp strncpy wcslen

api-ms-win-crt-utility-l1-1-0

qsort

shell32

ShellExecuteW

Name

.text

Size

651KB

Virtual Size

650KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

61B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5d21c6996b1a734e50ff1635d2db8b9b1ec477043224317e7a1f559d7378b8aa

gdi32

user32

kernel32

dwmapi

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

shell32

generic