ec8c34c545c083cd47913335f3ee9abdb109d3990003ebf99d7d7329c9981718

Sharing

Copy URL Twitter E-mail

General

Target
ec8c34c545c083cd47913335f3ee9abdb109d3990003ebf99d7d7329c9981718
Size 790KB
Sample261030-qsd9yscw2v
SHA256 ec8c34c545c083cd47913335f3ee9abdb109d3990003ebf99d7d7329c9981718
MD5 bd9a4b57255a63a7937d1289d143ffaa
SHA1 0c71a38b32fe41eee60fb9304473e7b73ff3f564
SHA512 a64c230110c1e729188c6021aa6da9555a22f43ae347f70452bce2bcfd3cc3c54e626333f245485a85c53e2ad834d9c732feeecdc4aec479afe3da5ef841d32d
SSDEEP 12288:1Kwf6hwHSAcZbt5yorcaVF5oWlIxNo/8q3vDV1kczrck:1KwChwHSJrKWF5oAzvD8Pk
TLSH
T128059F2AEB94027CE0BAC179CD478D52FB71B44A03B19BDF07D049A65E277E0593EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec8c34c545c083cd47913335f3ee9abdb109d3990003ebf99d7d7329c9981718

File Explorer

ec8c34c545c083cd47913335f3ee9abdb109d3990003ebf99d7d7329c9981718

.dll 790KB

ec8c34c545c083cd47913335f3ee9abdb109d3990003ebf99d7d7329c9981718

IMPHASH 116fff951d0232b6851f3a581f760244
SHA256 ec8c34c545c083cd47913335f3ee9abdb109d3990003ebf99d7d7329c9981718
MD5 bd9a4b57255a63a7937d1289d143ffaa
SHA1 0c71a38b32fe41eee60fb9304473e7b73ff3f564
SHA512 a64c230110c1e729188c6021aa6da9555a22f43ae347f70452bce2bcfd3cc3c54e626333f245485a85c53e2ad834d9c732feeecdc4aec479afe3da5ef841d32d
SSDEEP 12288:1Kwf6hwHSAcZbt5yorcaVF5oWlIxNo/8q3vDV1kczrck:1KwChwHSJrKWF5oAzvD8Pk
TLSH
T128059F2AEB94027CE0BAC179CD478D52FB71B44A03B19BDF07D049A65E277E0593EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

336956

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

crypt32

CryptStringToBinaryA

winhttp

WinHttpSetTimeouts WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReadData

bcrypt

BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptDestroyKey BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptGenRandom

kernel32

CloseHandle MoveFileExW CreateProcessW WideCharToMultiByte WinExec MoveFileW OutputDebugStringA GetCurrentProcess lstrcmpW SetLastError LocalFree GetModuleHandleA GetModuleHandleW GetModuleFileNameA FindClose GetFileAttributesA OutputDebugStringW GetSystemInfo GetProcAddress CreateProcessA IsDebuggerPresent GetTickCount GetFileSize GetExitCodeProcess CreateThread DisableThreadLibraryCalls ExitProcess GetCurrentThread GetModuleFileNameW GetEnvironmentVariableW GetEnvironmentVariableA CreateEventW GetCurrentProcessId FlushFileBuffers SetFilePointerEx GetFileSizeEx GetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc Process32FirstW HeapAlloc GetFileType GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList RtlUnwindEx SuspendThread VirtualFree GetThreadContext SetThreadContext FlushInstructionCache DeleteFileW Process32NextW GetLastError Sleep MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess GetFileAttributesW CreateFileW WaitForSingleObject TerminateProcess WriteFile ReadFile WriteConsoleW HeapSize GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage ResumeThread VirtualProtect InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW SetEndOfFile GetConsoleOutputCP HeapReAlloc SetStdHandle ReadConsoleW GetSystemTimeAsFileTime LCMapStringEx DecodePointer GetConsoleMode HeapFree RtlUnwind EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageA GetLocaleInfoEx GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread CreateDirectoryW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx RtlPcToFileHeader RaiseException QueryPerformanceCounter

user32

CallWindowProcW FillRect SetWindowRgn GetClientRect GetSystemMetrics GetWindowRect wsprintfA GetWindowTextW ChildWindowFromPoint InvalidateRect UpdateWindow GetParent DrawTextW GetDlgItem LoadCursorW TranslateMessage RegisterHotKey TrackMouseEvent RegisterClassW GetDlgCtrlID DispatchMessageW ShowWindow GetWindowLongPtrW SendMessageW ScreenToClient SetWindowLongPtrW GetMessageW DefWindowProcW UnregisterHotKey DestroyWindow CreateWindowExW

gdi32

SetTextColor RoundRect SelectObject CreateFontW GetStockObject CreateRoundRectRgn SetBkMode CreatePen SetBkColor DeleteObject CreateSolidBrush

advapi32

CryptGetHashParam CryptDestroyHash CryptHashData RegNotifyChangeKeyValue CryptAcquireContextA CryptCreateHash RegCreateKeyA RegOpenKeyA RegDeleteKeyA RegCreateKeyExA RegSetKeySecurity RegSetValueExA ConvertStringSecurityDescriptorToSecurityDescriptorW AdjustTokenPrivileges RegCloseKey RegQueryValueExA LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA CryptAcquireContextW CryptReleaseContext

shell32

CommandLineToArgvW ShellExecuteA

ws2_32

htons htonl recv socket send listen closesocket bind accept WSAStartup setsockopt

iphlpapi

GetTcpTable

psapi

GetProcessImageFileNameA

rpcrt4

RpcStringFreeA UuidToStringA UuidCreate

Name

.text

Size

492KB

Virtual Size

491KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

236KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp00

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ec8c34c545c083cd47913335f3ee9abdb109d3990003ebf99d7d7329c9981718

crypt32

winhttp

bcrypt

kernel32

user32

gdi32

advapi32

shell32

ws2_32

iphlpapi

psapi

rpcrt4

generic