510d553b59d97735a2318234f742c79ddc19e27acacc31801169568bdebe8e02

Sharing

Copy URL Twitter E-mail

General

Target
510d553b59d97735a2318234f742c79ddc19e27acacc31801169568bdebe8e02
Size 3.4MB
Sample261030-e5dy6swt9p
SHA256 510d553b59d97735a2318234f742c79ddc19e27acacc31801169568bdebe8e02
MD5 2d6edb5a63b8e6741744f513e56e7dcb
SHA1 0b456c5921ce1ed42c400721dab53324453a123c
SHA512 120907c70cca2bd003075ea843ffd1a8738e6c49ae31817137129d94d10ceb868cadecb181204521aba519aaa147d9dc8fbf2b92171c89b1ba4e4da47fa53f92
SSDEEP 49152:kZ1I+9dRA3EJyXtgXR/R15ZUTRyF4NDEubL0DBMj1d6875qfTPSoz00PUEUURY3a:G9dmVy+FI41dB5KT6E00PUVSHR
TLSH
T17EF58E17A6A402FCD0B6C1BDCE9A9913EB72740943719AEF06E085625F676F05F3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
510d553b59d97735a2318234f742c79ddc19e27acacc31801169568bdebe8e02

File Explorer

510d553b59d97735a2318234f742c79ddc19e27acacc31801169568bdebe8e02

.exe 3.4MB

510d553b59d97735a2318234f742c79ddc19e27acacc31801169568bdebe8e02

IMPHASH 43d35972575ab24a82017a89bce44338
SHA256 510d553b59d97735a2318234f742c79ddc19e27acacc31801169568bdebe8e02
MD5 2d6edb5a63b8e6741744f513e56e7dcb
SHA1 0b456c5921ce1ed42c400721dab53324453a123c
SHA512 120907c70cca2bd003075ea843ffd1a8738e6c49ae31817137129d94d10ceb868cadecb181204521aba519aaa147d9dc8fbf2b92171c89b1ba4e4da47fa53f92
SSDEEP 49152:kZ1I+9dRA3EJyXtgXR/R15ZUTRyF4NDEubL0DBMj1d6875qfTPSoz00PUEUURY3a:G9dmVy+FI41dB5KT6E00PUVSHR
TLSH
T17EF58E17A6A402FCD0B6C1BDCE9A9913EB72740943719AEF06E085625F676F05F3E312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2199076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d2d1

ord1

dwrite

DWriteCreateFactory

user32

TranslateMessage LoadImageW DestroyIcon LoadIconW TrackPopupMenuEx GetClientRect SetClipboardData CloseClipboard DispatchMessageW DefWindowProcW OpenClipboard RegisterClassExW CreateWindowExW ShowWindow SetWindowPos SetTimer KillTimer GetSystemMetrics SetForegroundWindow BeginPaint EndPaint InvalidateRect GetWindowRect GetCursorPos EmptyClipboard EnumDisplayMonitors MessageBoxW PostMessageW PostQuitMessage GetDpiForWindow ScreenToClient GetWindowLongPtrW SetWindowLongPtrW LoadCursorW SystemParametersInfoW DestroyWindow GetMessageW CreatePopupMenu DestroyMenu AppendMenuW TrackPopupMenu

ws2_32

getaddrinfo freeaddrinfo ntohl socket shutdown setsockopt send WSAStartup WSACleanup accept bind closesocket connect htonl htons listen recv select inet_pton

shell32

CommandLineToArgvW ShellExecuteW SHGetKnownFolderPath Shell_NotifyIconW

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpOpen WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpSetStatusCallback WinHttpQueryDataAvailable WinHttpReadData WinHttpQueryOption WinHttpConnect WinHttpCloseHandle

wininet

InternetSetOptionW

rasapi32

RasEnumEntriesW

kernel32

GetFileSizeEx GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapFree HeapAlloc GetStdHandle HeapSize FreeLibraryAndExitThread ExitThread SetFilePointerEx LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetCPInfo CreateThread ReadConsoleW LCMapStringEx DecodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapReAlloc CreateHardLinkW GetCommandLineW GetTickCount64 GetModuleFileNameW LocalFree CloseHandle ExitProcess CreateProcessW CreateDirectoryW CreateFileW FlushFileBuffers WriteFile GetLocalTime GetFileAttributesW MultiByteToWideChar WideCharToMultiByte Sleep FindClose FindFirstFileW FindNextFileW GetLocaleInfoEx CopyFileW GetCurrentProcessId MoveFileExW ReadFile GetLastError PeekNamedPipe WaitNamedPipeW GetOverlappedResult CancelIoEx WaitForSingleObject CreateEventW SetEvent WaitForMultipleObjects GetEnvironmentStringsW FreeEnvironmentStringsW SetHandleInformation CreatePipe TerminateProcess OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetExitCodeProcess GlobalAlloc GlobalUnlock GlobalLock GetSystemTimeAsFileTime GetModuleHandleW FreeLibrary GetProcAddress SetConsoleCtrlHandler QueryPerformanceCounter QueryPerformanceFrequency GetSystemTime SystemTimeToFileTime GetTimeZoneInformation RtlUnwind IsValidCodePage GetACP GetOEMCP GetCommandLineA SetEnvironmentVariableW SetStdHandle WriteConsoleW SetEndOfFile GetFileInformationByHandleEx GetProcessHeap EncodePointer AreFileApisANSI GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW IsProcessorFeaturePresent WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive FormatMessageA SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable RtlPcToFileHeader RaiseException InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW

ole32

CoTaskMemFree CoInitializeEx CoCreateInstance

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

631KB

Virtual Size

630KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

75KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

510d553b59d97735a2318234f742c79ddc19e27acacc31801169568bdebe8e02

d2d1

dwrite

user32

ws2_32

shell32

iphlpapi

winhttp

wininet

rasapi32

kernel32

ole32

advapi32

generic