873efb815340c93c4b9fde049f5ec0e3fcee6e0e55b9ef6a62ab0445ef1d350c

Sharing

Copy URL Twitter E-mail

General

Target
873efb815340c93c4b9fde049f5ec0e3fcee6e0e55b9ef6a62ab0445ef1d350c
Size 508KB
Sample261030-jca42aav3y
SHA256 873efb815340c93c4b9fde049f5ec0e3fcee6e0e55b9ef6a62ab0445ef1d350c
MD5 30068024b45832746e636a5a7ba12c4a
SHA1 f5fff7fdf9c971c89cda09752bbe2eb2cb7714b4
SHA512 8b55b55b3167b25ac0d8ffceacf35d841e46abc5b564273e64fb5559d1815f1ae188ec11e3dd48026768f472252e9e963f12bbded3a6e40627f229a3a12f83af
SSDEEP 12288:eZIYP8XfKGVxm2OwfwGLxB9qWVbx7pwdc:eZIYP8XfKGKwL9qcbROdc
TLSH
T1E4B40923A062C076D5152AF2A775073D78F8962118BA8813FFE8CDF1BC755338BA691D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
873efb815340c93c4b9fde049f5ec0e3fcee6e0e55b9ef6a62ab0445ef1d350c

File Explorer

873efb815340c93c4b9fde049f5ec0e3fcee6e0e55b9ef6a62ab0445ef1d350c

.exe 508KB

873efb815340c93c4b9fde049f5ec0e3fcee6e0e55b9ef6a62ab0445ef1d350c

IMPHASH e8fee241fe1f685a7fa00ae8691a5692
SHA256 873efb815340c93c4b9fde049f5ec0e3fcee6e0e55b9ef6a62ab0445ef1d350c
MD5 30068024b45832746e636a5a7ba12c4a
SHA1 f5fff7fdf9c971c89cda09752bbe2eb2cb7714b4
SHA512 8b55b55b3167b25ac0d8ffceacf35d841e46abc5b564273e64fb5559d1815f1ae188ec11e3dd48026768f472252e9e963f12bbded3a6e40627f229a3a12f83af
SSDEEP 12288:eZIYP8XfKGVxm2OwfwGLxB9qWVbx7pwdc:eZIYP8XfKGKwL9qcbROdc
TLSH
T1E4B40923A062C076D5152AF2A775073D78F8962118BA8813FFE8CDF1BC755338BA691D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

378633

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVersionExA GetEnvironmentVariableA GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize RaiseException TerminateProcess IsBadWritePtr LCMapStringW SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW SetStdHandle IsBadCodePtr LCMapStringA LoadLibraryA FreeLibrary GetCommandLineA GetStartupInfoA CreateProcessA DeleteFileA GetFileSize WritePrivateProfileStringA WriteFile GetPrivateProfileStringA GetTickCount CreateDirectoryA SetFilePointer GetLocalTime GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetUserDefaultLCID Sleep GetModuleFileNameA GetProcAddress IsBadReadPtr HeapReAlloc ExitProcess GetModuleHandleA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection lstrcmpA lstrlenA ReleaseMutex WaitForSingleObject CreateMutexA VirtualFree VirtualAlloc lstrcmpiW lstrcmpW lstrlenW HeapCreate HeapDestroy RtlZeroMemory InterlockedDecrement InterlockedIncrement InterlockedExchangeAdd Process32Next Process32First MultiByteToWideChar HeapFree HeapAlloc GetProcessHeap ReadFile GetFileSizeEx CreateFileA GetOEMCP WideCharToMultiByte CloseHandle lstrcpynA OpenProcess Module32First CreateToolhelp32Snapshot GetComputerNameExA lstrcatA RtlMoveMemory CreateThread SetDllDirectoryA GetLastError GetCPInfo RtlUnwind FlushFileBuffers GetCurrentProcess SetErrorMode GetProcessVersion FindResourceA LoadResource LockResource GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA SetLastError lstrcpyA GlobalFlags MulDiv TlsGetValue LocalReAlloc TlsSetValue GlobalReAlloc TlsFree GlobalHandle TlsAlloc LocalFree LocalAlloc GlobalDeleteAtom lstrcmpiA GetCurrentThread GetCurrentThreadId

ws2_32

WSAGetLastError gethostname WSACleanup WSAStartup

imagehlp

MakeSureDirectoryPathExists

ole32

CoRegisterMessageFilter CoFreeUnusedLibraries OleUninitialize OleInitialize CoRevokeClassObject OleIsCurrentClipboard CLSIDFromProgID CLSIDFromString CoCreateInstance OleRun CoUninitialize CoInitialize OleFlushClipboard

shlwapi

StrToIntExW PathFindFileNameA PathRemoveFileSpecA PathRemoveBackslashA PathFindExtensionA PathGetArgsA PathFileExistsA StrToIntW

psapi

GetProcessImageFileNameW

user32

PeekMessageA GetMessageA TranslateMessage DispatchMessageA wsprintfA MessageBoxA GetWindowThreadProcessId GetWindowTextA FindWindowExA SetActiveWindow IsWindow AdjustWindowRectEx GetClientRect GetSysColor MapWindowPoints UpdateWindow LoadIconA LoadCursorA GetSysColorBrush LoadStringA UnregisterClassA PostThreadMessageA DestroyMenu CreateDialogIndirectParamA EndDialog CopyRect GetTopWindow GetCapture WinHelpA GetClassInfoA RegisterClassA GetMenu GetSubMenu GetMenuItemID DestroyWindow CreateWindowExA GetClassLongA SetPropA GetPropA CallWindowProcA PostQuitMessage PostMessageA SendMessageA SetCursor EnableWindow GetWindowLongA IsWindowEnabled GetLastActivePopup GetParent SetWindowsHookExA GetCursorPos IsWindowVisible ValidateRect CallNextHookEx GetKeyState GetActiveWindow GetNextDlgTabItem GetFocus EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState LoadBitmapA GetMenuCheckMarkDimensions RegisterClipboardFormatA GetClassNameA PtInRect GetWindowRect GetDlgCtrlID GetWindow ClientToScreen SetWindowTextA UnhookWindowsHookEx GetMenuItemCount GetDC ReleaseDC TabbedTextOutA DrawTextA GrayStringA GetDlgItem SendDlgItemMessageA IsDialogMessageA SetWindowLongA SetWindowPos ShowWindow SetFocus GetSystemMetrics GetWindowPlacement IsIconic SystemParametersInfoA RegisterWindowMessageA SetForegroundWindow GetForegroundWindow GetMessagePos GetMessageTime DefWindowProcA RemovePropA

gdi32

Escape ExtTextOutA TextOutA RectVisible PtVisible GetDeviceCaps GetClipBox ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetTextColor SetBkColor SelectObject RestoreDC SaveDC DeleteDC DeleteObject CreateBitmap GetStockObject GetObjectA

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegCreateKeyExA RegCloseKey RegSetValueExA RegOpenKeyExA

comctl32

ord17

oledlg

ord8

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime VariantInit SafeArrayGetDim SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetElemsize VarR8FromCy VarR8FromBool VariantChangeType LoadTypeLi LHashValOfNameSys RegisterTypeLi VariantCopy SafeArrayCreate SysAllocString VariantClear SafeArrayDestroy

Sharing

General

Malware Config

Signatures

File Explorer

873efb815340c93c4b9fde049f5ec0e3fcee6e0e55b9ef6a62ab0445ef1d350c

kernel32

ws2_32

imagehlp

ole32

shlwapi

psapi

user32

gdi32

winspool.drv

advapi32

comctl32

oledlg

oleaut32

generic