ebc583ffd4a129bcece74819bba831b24b7ebd071795073077fd2678b84e8642

General

Target
ebc583ffd4a129bcece74819bba831b24b7ebd071795073077fd2678b84e8642
Size 160KB
Sample261030-ayqbeaf18x
SHA256 ebc583ffd4a129bcece74819bba831b24b7ebd071795073077fd2678b84e8642
MD5 e57d146ee9dff95d094965962e8ee917
SHA1 2b71e25c7fa9e592674970218dfaef11c1b379c2
SHA512 afc817c2f600a8afa66a9c5e358620cc6558b6dbbb8eacb9f98ad258af9a048330d87cd737ac7faacf639c5b9ee5b982549eb5bec2ace85f66cbf6d89721113e
SSDEEP 1536:m0X6sMS7ZLd+RsZyuT45fJ/K6rtrmMBvgeSb80WPWCTP35XibxSUcwDP57p:jXISlLXyuT47rt6kvg5mibUK7p
TLSH
T106F309E5B9C2BB5BC64B8730B4EE6226F533653637A752C7160D1B3409E77C0AA3C621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebc583ffd4a129bcece74819bba831b24b7ebd071795073077fd2678b84e8642

File Explorer

ebc583ffd4a129bcece74819bba831b24b7ebd071795073077fd2678b84e8642

.dll 160KB

ebc583ffd4a129bcece74819bba831b24b7ebd071795073077fd2678b84e8642

IMPHASH 4c3bfd7a523d385e6f2c2ab6787ef4a6
SHA256 ebc583ffd4a129bcece74819bba831b24b7ebd071795073077fd2678b84e8642
MD5 e57d146ee9dff95d094965962e8ee917
SHA1 2b71e25c7fa9e592674970218dfaef11c1b379c2
SHA512 afc817c2f600a8afa66a9c5e358620cc6558b6dbbb8eacb9f98ad258af9a048330d87cd737ac7faacf639c5b9ee5b982549eb5bec2ace85f66cbf6d89721113e
SSDEEP 1536:m0X6sMS7ZLd+RsZyuT45fJ/K6rtrmMBvgeSb80WPWCTP35XibxSUcwDP57p:jXISlLXyuT47rt6kvg5mibUK7p
TLSH
T106F309E5B9C2BB5BC64B8730B4EE6226F533653637A752C7160D1B3409E77C0AA3C621
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

31088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d3d9

Direct3DCreate9

ddraw

DirectDrawCreateEx

dsound

DirectSoundCaptureEnumerateW DirectSoundEnumerateW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ole32

CLSIDFromString CoCreateInstance CoTaskMemFree PropVariantClear StringFromGUID2

oleaut32

SafeArrayAccessData SafeArrayUnaccessData SysAllocString SysFreeString VariantChangeType VariantClear VariantCopy VariantInit

user32

EnumDisplayDevicesW LoadStringW wsprintfW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsicmp _wcsnicmp free fwrite getenv memcpy memmove strchr strcmp strcpy strcspn strlen wcschr wcslen wcsrchr wcsstr

kernel32

CloseHandle DisableThreadLibraryCalls EnumResourceNamesW FindResourceW FormatMessageW GetComputerNameW GetDateFormatW GetEnvironmentVariableW GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetTickCount GetTimeFormatW GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc IsBadStringPtrW K32EnumProcessModules K32EnumProcesses K32GetModuleBaseNameW LoadLibraryW LoadResource MultiByteToWideChar OpenProcess SizeofResource lstrcmpW

ntdll

_chkstk _vsnprintf

Sharing

General

Malware Config

Signatures

File Explorer

ebc583ffd4a129bcece74819bba831b24b7ebd071795073077fd2678b84e8642

d3d9

ddraw

dsound

version

ole32

oleaut32

user32

ucrtbase

kernel32

ntdll

generic