2ac4f3b9d2b67864dec0eef05b3994bc9a452196583d1bb5f402f61f210a1b62

Sharing

Copy URL Twitter E-mail

General

Target
2ac4f3b9d2b67864dec0eef05b3994bc9a452196583d1bb5f402f61f210a1b62
Size 704KB
Sample261030-ar7bcat1cw
SHA256 2ac4f3b9d2b67864dec0eef05b3994bc9a452196583d1bb5f402f61f210a1b62
MD5 4f9faca36e897346f88de6159fb8afa6
SHA1 23e05ef3e57457094ac7b7905da1f32fcedd5cfc
SHA512 82cbc2c5f1dee9e59787610d983ac97a581fc3248a8fc986a5315ed0b93f5fc8d3cc87b5f41699c059981d1c8cd3e522e3365e1d4e83fd0e68ca81d94428ebfe
SSDEEP 12288:nWsdoRk8jF0M2hF6YngJsghYZqhvBWhY5FyouFb0NxIo70LeC:nldoRk8jF0MoFlgwGqH
TLSH
T154E40950A1C6A75AD417037068EEBA22BB3C6921B337DBC7B2089A7C4FD57D16D34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ac4f3b9d2b67864dec0eef05b3994bc9a452196583d1bb5f402f61f210a1b62

File Explorer

2ac4f3b9d2b67864dec0eef05b3994bc9a452196583d1bb5f402f61f210a1b62

.dll 704KB

2ac4f3b9d2b67864dec0eef05b3994bc9a452196583d1bb5f402f61f210a1b62

IMPHASH 0f17d88f382e193e2e021078909b6850
SHA256 2ac4f3b9d2b67864dec0eef05b3994bc9a452196583d1bb5f402f61f210a1b62
MD5 4f9faca36e897346f88de6159fb8afa6
SHA1 23e05ef3e57457094ac7b7905da1f32fcedd5cfc
SHA512 82cbc2c5f1dee9e59787610d983ac97a581fc3248a8fc986a5315ed0b93f5fc8d3cc87b5f41699c059981d1c8cd3e522e3365e1d4e83fd0e68ca81d94428ebfe
SSDEEP 12288:nWsdoRk8jF0M2hF6YngJsghYZqhvBWhY5FyouFb0NxIo70LeC:nldoRk8jF0MoFlgwGqH
TLSH
T154E40950A1C6A75AD417037068EEBA22BB3C6921B337DBC7B2089A7C4FD57D16D34B12
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

202592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ole32

CLIPFORMAT_UserFree CLIPFORMAT_UserMarshal CLIPFORMAT_UserSize CLIPFORMAT_UserUnmarshal CLSIDFromProgID CLSIDFromString CoCreateInstance CoGetClassObject CoMarshalInterface CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoUnmarshalInterface CreateBindCtx CreateGenericComposite CreateStreamOnHGlobal HWND_UserFree HWND_UserMarshal HWND_UserSize HWND_UserUnmarshal MkParseDisplayName ReleaseStgMedium STGMEDIUM_UserFree STGMEDIUM_UserMarshal STGMEDIUM_UserSize STGMEDIUM_UserUnmarshal StringFromCLSID

oleaut32

BSTR_UserFree BSTR_UserMarshal BSTR_UserSize BSTR_UserUnmarshal SysAllocString SysAllocStringLen SysFreeString SysStringLen

shell32

ShellExecuteExW

rpcrt4

CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_QueryInterface IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrClientCall2 NdrDllCanUnloadNow NdrDllGetClassObject NdrOleAllocate NdrOleFree

shlwapi

DelayLoadFailureHook ord2 PathCreateFromUrlW PathFindExtensionW StrChrW StrCmpNIW StrCmpNW UrlCanonicalizeW UrlCombineW UrlCompareW UrlGetPartW UrlUnescapeW

wininet

CommitUrlCacheEntryW CreateUrlCacheEntryW FtpGetFileSize HttpEndRequestW HttpOpenRequestW HttpQueryInfoA HttpQueryInfoW HttpSendRequestExW HttpSendRequestW InternetCloseHandle InternetConnectW InternetErrorDlg InternetLockRequestFile InternetOpenUrlW InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetReadFile InternetSetOptionW InternetSetStatusCallbackW InternetUnlockRequestFile InternetWriteFile

user32

CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW EnableWindow EndDialog GetDlgItem GetPropW KillTimer LoadIconW LoadStringW MessageBoxW MsgWaitForMultipleObjects PeekMessageW PostMessageW RegisterClassExW RegisterClipboardFormatW SendDlgItemMessageW SetDlgItemTextW SetPropW SetTimer TranslateMessage UnregisterClassW wsprintfW

advapi32

RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _recalloc _strdup _wcsdup _wcsicmp _wcsnicmp calloc free fwrite getenv iswalpha iswcntrl iswspace iswupper malloc memcmp memcpy memmove memset realloc strchr strcmp strcpy strcspn strlen towlower wcschr wcscmp wcscpy wcscspn wcslen wcsrchr wcstol

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW FindResourceW FreeLibrary GetDriveTypeW GetEnvironmentVariableW GetFileAttributesW GetFileSizeEx GetFileTime GetModuleFileNameW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetTempFileNameW GetTempPathW GetTickCount GetVersionExW GlobalAlloc GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc IdnToAscii InitOnceExecuteOnce InitializeCriticalSectionEx IsBadStringPtrA IsBadStringPtrW IsWow64Process LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource MultiByteToWideChar RaiseException ReadFile RemoveDirectoryW ResolveDelayLoadedAPI SetFilePointerEx SizeofResource TlsAlloc TlsFree TlsGetValue TlsSetValue WideCharToMultiByte lstrcmpW lstrcmpiW

ntdll

RtlIpv6AddressToStringExW RtlIpv6StringToAddressW _chkstk _vsnprintf

AsyncGetClassBits AsyncInstallDistributionUnit BindAsyncMoniker CDLGetLongPathNameA CDLGetLongPathNameW CoGetClassObjectFromURL CoInstall CoInternetCombineIUri CoInternetCombineUrl CoInternetCombineUrlEx CoInternetCompareUrl CoInternetCreateSecurityManager CoInternetCreateZoneManager CoInternetGetProtocolFlags CoInternetGetSecurityUrl CoInternetGetSecurityUrlEx CoInternetGetSession CoInternetIsFeatureEnabled CoInternetIsFeatureEnabledForUrl CoInternetIsFeatureZoneElevationEnabled CoInternetParseIUri CoInternetParseUrl CoInternetQueryInfo CoInternetSetFeatureEnabled CompareSecurityIds CopyBindInfo CopyStgMedium CreateAsyncBindCtx CreateAsyncBindCtxEx CreateFormatEnumerator CreateIUriBuilder CreateURLMoniker CreateURLMonikerEx CreateURLMonikerEx2 CreateUri CreateUriWithFragment DllCanUnloadNow DllGetClassObject DllInstall DllRegisterServer DllRegisterServerEx DllUnregisterServer Extract FaultInIEFeature FindMediaType FindMediaTypeClass FindMimeFromData GetClassFileOrMime GetClassURL GetComponentIDFromCLSSPEC GetIUriPriv GetMarkOfTheWeb GetSoftwareUpdateInfo HlinkGoBack HlinkGoForward HlinkNavigateMoniker HlinkNavigateString HlinkSimpleNavigateToMoniker HlinkSimpleNavigateToString IEInstallScope IsAsyncMoniker IsLoggingEnabledA IsLoggingEnabledW IsValidURL MkParseDisplayNameEx ObtainUserAgentString PrivateCoInstall RegisterBindStatusCallback RegisterFormatEnumerator RegisterMediaTypeClass RegisterMediaTypes ReleaseBindInfo RevokeBindStatusCallback RevokeFormatEnumerator SetSoftwareUpdateAdvertisementState ShouldShowIntranetWarningSecband URLDownloadA URLDownloadToCacheFileA URLDownloadToCacheFileW URLDownloadToFileA URLDownloadToFileW URLDownloadW URLOpenBlockingStreamA URLOpenBlockingStreamW URLOpenPullStreamA URLOpenPullStreamW URLOpenStreamA URLOpenStreamW UrlMkBuildVersion UrlMkGetSessionOption UrlMkSetSessionOption WriteHitLogging ZonesReInit

Sharing

General

Malware Config

Signatures

File Explorer

2ac4f3b9d2b67864dec0eef05b3994bc9a452196583d1bb5f402f61f210a1b62

ole32

oleaut32

shell32

rpcrt4

shlwapi

wininet

user32

advapi32

ucrtbase

kernel32

ntdll

generic