9c715203d83b27738d0ff3e2ed4220699d20695a28c16c14819602b573f06a07

Sharing

Copy URL Twitter E-mail

General

Target
9c715203d83b27738d0ff3e2ed4220699d20695a28c16c14819602b573f06a07
Size 141KB
Sample261027-mmmscszz8j
SHA256 9c715203d83b27738d0ff3e2ed4220699d20695a28c16c14819602b573f06a07
MD5 8a7cfba2d0b5f31cd4601bb9a34b8c6f
SHA1 96ebed017f202a4902861e517b3b19da193ceba6
SHA512 6e85eba2ee1b730bee60ebaf7117250659c8d45faafcbd36fe3e84bc7c30e6d1bbf3cf557a8fe8798443a561cb1ed2271dc12b94360999971297728b0a9d1304
SSDEEP 3072:1yAHIXY02JNE0qdqBmM8DGE8Knyu3sbYh0DgMNckVPxIiTbdrlU:1yAoXX2DqJNDGE8KnL3sbQChdK
TLSH
T136E37D00E996D077E78F043595AB9B3ABF212549CBB39FC7F7408DCA84615D09E3A70A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9c715203d83b27738d0ff3e2ed4220699d20695a28c16c14819602b573f06a07

File Explorer

9c715203d83b27738d0ff3e2ed4220699d20695a28c16c14819602b573f06a07

.dll 141KB

9c715203d83b27738d0ff3e2ed4220699d20695a28c16c14819602b573f06a07

IMPHASH 85b3085863ffad3aad7fcc88c5624455
SHA256 9c715203d83b27738d0ff3e2ed4220699d20695a28c16c14819602b573f06a07
MD5 8a7cfba2d0b5f31cd4601bb9a34b8c6f
SHA1 96ebed017f202a4902861e517b3b19da193ceba6
SHA512 6e85eba2ee1b730bee60ebaf7117250659c8d45faafcbd36fe3e84bc7c30e6d1bbf3cf557a8fe8798443a561cb1ed2271dc12b94360999971297728b0a9d1304
SSDEEP 3072:1yAHIXY02JNE0qdqBmM8DGE8Knyu3sbYh0DgMNckVPxIiTbdrlU:1yAoXX2DqJNDGE8KnL3sbQChdK
TLSH
T136E37D00E996D077E78F043595AB9B3ABF212549CBB39FC7F7408DCA84615D09E3A70A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

99088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW LogonUserW RegOpenKeyExW RegQueryValueExW

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileMappingW CreateProcessW CreateToolhelp32Snapshot DisableThreadLibraryCalls ExitProcess ExpandEnvironmentStringsW FindResourceW FlushInstructionCache FreeLibrary GetCommandLineW GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetPrivateProfileIntW GetPrivateProfileSectionW GetPrivateProfileStringW GetProcAddress GetSystemDirectoryW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetThreadContext GetTickCount64 GetVolumeInformationW InitializeSListHead InterlockedFlushSList IsProcessorFeaturePresent K32GetModuleInformation LoadLibraryW LoadResource LocalAlloc LocalFree LockResource MapViewOfFile MulDiv OpenFileMappingW Process32FirstW Process32NextW QueryPerformanceCounter ReleaseSRWLockExclusive ResumeThread SetEnvironmentVariableW SetLastError SetThreadContext SizeofResource Sleep SleepConditionVariableSRW SuspendThread TerminateProcess TryAcquireSRWLockExclusive UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WakeAllConditionVariable lstrcatW lstrcmpiW lstrcpyW

crypt32

CryptProtectData CryptUnprotectData

samcli

NetUserGetInfo

user32

CallNextHookEx ClientToScreen DispatchMessageW EnumChildWindows EnumWindows GetAncestor GetAsyncKeyState GetCapture GetClassNameW GetClientRect GetCursorPos GetFocus GetForegroundWindow GetKeyState GetMessageW GetMonitorInfoW GetParent GetSystemMetrics GetWindowRect GetWindowThreadProcessId IsRectEmpty IsWindowVisible KillTimer MonitorFromWindow PostMessageW PtInRect RegisterHotKey SendInput SetActiveWindow SetCursorPos SetForegroundWindow SetTimer SetWindowPos SetWindowsHookExW ShowWindow TranslateMessage VkKeyScanW WindowFromPoint keybd_event

ole32

CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemFree CoUninitialize PropVariantClear

shell32

CommandLineToArgvW SHGetPropertyStoreForWindow SetCurrentProcessExplicitAppUserModelID

shlwapi

ord437 PathCanonicalizeW PathRemoveFileSpecW StrStrIW

oleaut32

SysAllocStringLen SysFreeString SysStringLen VariantClear VariantInit

msvcrt

?terminate@@YAXXZ _CxxThrowException __CppXcptFilter __CxxFrameHandler3 __getmainargs _amsg_exit _beginthreadex _callnewh _errno _except_handler4_common _initterm _initterm_e _msize _wcsicmp _wsystem ceil free isspace iswalnum iswdigit malloc memcpy memmove memset realloc strcpy_s strlen towlower towupper wcslen wcsrchr wcsstr wcstoul

Name

.text

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

14B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9c715203d83b27738d0ff3e2ed4220699d20695a28c16c14819602b573f06a07

advapi32

kernel32

crypt32

samcli

user32

ole32

shell32

shlwapi

oleaut32

msvcrt

generic