126b8e6fcda30fff82d8fad1e34e27c5cbe3f3257c4255c3a669870b0c550556

Sharing

Copy URL Twitter E-mail

General

Target
126b8e6fcda30fff82d8fad1e34e27c5cbe3f3257c4255c3a669870b0c550556
Size 346KB
Sample261030-e5dneawt9k
SHA256 126b8e6fcda30fff82d8fad1e34e27c5cbe3f3257c4255c3a669870b0c550556
MD5 2e97507c76bfb335abe7df71bed8dc2f
SHA1 02886b5d789fb80bc3c4a36d049dcb76580ac346
SHA512 fb0b42dfa9973ebd16c03331ddd295e23e9c91b14228225f58a39037d91a8eb6cc6fbcf826dc4887b5bf32187dac6d204bc23ff56e9cb0a1dfb68f26337ee52e
SSDEEP 6144:l/lRXQKGriOr8XglSQSFDEmEzPttdXp3FeNF71mYPI2M+Fpb++5FOyOH:nRAKGrpgXgfmWd53YFzFR7TO
TLSH
T1A2748E11F742E032C99519700766DBA69AACBD304F6568C773C42FBEE9702C1AB39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
126b8e6fcda30fff82d8fad1e34e27c5cbe3f3257c4255c3a669870b0c550556

File Explorer

126b8e6fcda30fff82d8fad1e34e27c5cbe3f3257c4255c3a669870b0c550556

.exe 346KB

126b8e6fcda30fff82d8fad1e34e27c5cbe3f3257c4255c3a669870b0c550556

IMPHASH 6211831bb0865445455c24a18ac9805a
SHA256 126b8e6fcda30fff82d8fad1e34e27c5cbe3f3257c4255c3a669870b0c550556
MD5 2e97507c76bfb335abe7df71bed8dc2f
SHA1 02886b5d789fb80bc3c4a36d049dcb76580ac346
SHA512 fb0b42dfa9973ebd16c03331ddd295e23e9c91b14228225f58a39037d91a8eb6cc6fbcf826dc4887b5bf32187dac6d204bc23ff56e9cb0a1dfb68f26337ee52e
SSDEEP 6144:l/lRXQKGriOr8XglSQSFDEmEzPttdXp3FeNF71mYPI2M+Fpb++5FOyOH:nRAKGrpgXgfmWd53YFzFR7TO
TLSH
T1A2748E11F742E032C99519700766DBA69AACBD304F6568C773C42FBEE9702C1AB39F16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

149204

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\working\kagura\project\Rance7\System40.131Project\Release\System40.pdb

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetOpenStatus ImmGetCompositionStringA ImmGetDefaultIMEWnd ImmSetCompositionFontA

winmm

mixerGetNumDevs mixerClose mciSendCommandA mixerSetControlDetails mixerGetDevCapsA mixerGetID mixerGetControlDetailsA mixerGetLineControlsA timeBeginPeriod timeGetTime timeEndPeriod timeGetDevCaps mixerOpen mixerGetLineInfoA

kernel32

Sleep WaitForSingleObject SetEvent CloseHandle ResetEvent CreateEventA FindFirstFileA FindNextFileA FindClose ReadFile CreateMutexA GetCurrentDirectoryA OpenProcess SetCurrentDirectoryA GetLastError CreateFileA GetFileSize GetTickCount GetExitCodeProcess WriteFile SizeofResource FindResourceA LockResource LoadResource EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection OutputDebugStringA GetSystemDefaultUILanguage GetUserDefaultUILanguage GetACP MultiByteToWideChar LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW LoadLibraryA VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer SetLastError RaiseException RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW GetStartupInfoW IsDebuggerPresent SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleFileNameA CreateDirectoryA RemoveDirectoryA DeleteFileA GetDriveTypeA GlobalMemoryStatusEx GetProcAddress GetVersionExA WriteConsoleW GetDiskFreeSpaceA GetTempPathA GetModuleHandleA GetProcessHeap SetStdHandle GetStringTypeW SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode DecodePointer CreateFileW FreeLibrary

user32

UnregisterClassA DeleteMenu AppendMenuA SetWindowTextW MessageBoxA GetClassInfoA CreateDialogParamA ModifyMenuA CreatePopupMenu InsertMenuItemA GetWindowThreadProcessId CreateWindowExW ModifyMenuW LoadMenuA OpenIcon SetWindowPos MessageBoxW GetActiveWindow RegisterWindowMessageA ClientToScreen DestroyMenu SetCapture PostQuitMessage WINNLSEnableIME CloseWindow GetCursorPos ReleaseDC InvalidateRect GetParent GetDesktopWindow KillTimer GetDlgItem GetClientRect FindWindowA PtInRect LoadIconA SetCursor SendMessageA SendDlgItemMessageA ReleaseCapture SetCursorPos CheckMenuRadioItem DispatchMessageA GetMenu GetMenuItemCount TranslateMessage PeekMessageA SystemParametersInfoA ScreenToClient GetSystemMenu GetWindowRect DestroyWindow PostMessageA MoveWindow SetMenu DrawMenuBar EnableMenuItem UpdateWindow SetForegroundWindow FillRect BeginPaint EndPaint IsIconic CheckRadioButton GetWindowTextA SetWindowTextA IsDlgButtonChecked CheckDlgButton EnableWindow ChangeDisplaySettingsA EnumDisplaySettingsA GetSubMenu LoadCursorFromFileA RegisterClassA DefWindowProcA TranslateAcceleratorA LoadAcceleratorsA SetDlgItemTextW SetDlgItemTextA LoadCursorA GetDC EndDialog GetSystemMetrics DialogBoxParamA DrawIcon wsprintfA ShowWindow SetTimer SetWindowLongA CallWindowProcA GetWindowLongA LoadBitmapA CreateWindowExA SetFocus

gdi32

DeleteDC SelectObject CreateDIBSection BitBlt GetStockObject SetTextColor SetStretchBltMode StretchBlt SetBrushOrgEx GetDeviceCaps TextOutA SetBkMode CreateFontIndirectA CreateCompatibleDC DeleteObject

comdlg32

GetSaveFileNameA

advapi32

RegSetValueExA RegCreateKeyExA RegQueryValueExA RegDeleteValueA RegCloseKey RegFlushKey

shell32

ShellExecuteA

ole32

CoInitialize CoCreateInstance CoUninitialize

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

dinput

DirectInputCreateEx

ijl15

ord2 ord5 ord3

Name

.text

Size

242KB

Virtual Size

241KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

126b8e6fcda30fff82d8fad1e34e27c5cbe3f3257c4255c3a669870b0c550556

imm32

winmm

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

version

dinput

ijl15

generic