8049b4d662eaa6c13064f8773e15502d183b31d1ed0e8a965a50c28223fdf4b4

Sharing

Copy URL Twitter E-mail

General

Target
8049b4d662eaa6c13064f8773e15502d183b31d1ed0e8a965a50c28223fdf4b4
Size 564KB
Sample261102-2dgmbaxtcx
SHA256 8049b4d662eaa6c13064f8773e15502d183b31d1ed0e8a965a50c28223fdf4b4
MD5 ebe34853adc537330e0c36c08fa7c37a
SHA1 14c6e0a90fe26faa182c2c9f664fa2d6dcca1dec
SHA512 879c2abea6c7ae92f0eed1f5f4d3e522f8a53aa0b341ec978e2eefaf93306e0fde03ac0f82ecebe449c830e24904005d062d5a587f8b5dc3e7d91b124e9ab7fc
SSDEEP 12288:qtgXdqGT9i9RnKgAC9I7puUg3LgyMv1EWo148QTOrmOPCH:q1tu7pILCu4aqO6H
TLSH
T1CDC47B1179B2D036D1B392B05E78ABA544BEBD345F7246DF63840B2D5E209D2AB31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8049b4d662eaa6c13064f8773e15502d183b31d1ed0e8a965a50c28223fdf4b4

File Explorer

8049b4d662eaa6c13064f8773e15502d183b31d1ed0e8a965a50c28223fdf4b4

.exe 564KB

8049b4d662eaa6c13064f8773e15502d183b31d1ed0e8a965a50c28223fdf4b4

IMPHASH ed19f64e730a2fa0f7c59eb666f1cd79
SHA256 8049b4d662eaa6c13064f8773e15502d183b31d1ed0e8a965a50c28223fdf4b4
MD5 ebe34853adc537330e0c36c08fa7c37a
SHA1 14c6e0a90fe26faa182c2c9f664fa2d6dcca1dec
SHA512 879c2abea6c7ae92f0eed1f5f4d3e522f8a53aa0b341ec978e2eefaf93306e0fde03ac0f82ecebe449c830e24904005d062d5a587f8b5dc3e7d91b124e9ab7fc
SSDEEP 12288:qtgXdqGT9i9RnKgAC9I7puUg3LgyMv1EWo148QTOrmOPCH:q1tu7pILCu4aqO6H
TLSH
T1CDC47B1179B2D036D1B392B05E78ABA544BEBD345F7246DF63840B2D5E209D2AB31B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

175795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\mind_code\UpdateModule\bin\Win32\Release\Update.pdb

winhttp

WinHttpConnect WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpQueryDataAvailable

advapi32

RegCreateKeyExW CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW CryptDestroyKey CryptVerifySignatureW RegCloseKey CryptCreateHash RegSetValueExW RegQueryValueExW

comctl32

InitCommonControlsEx

user32

EnableWindow CreateDialogParamW PostMessageW DestroyWindow InflateRect GetDC MessageBoxW GetPropW SendMessageW EndDialog RemovePropW SetWindowTextW ShowWindow DispatchMessageW IsDialogMessageW PeekMessageW SetDlgItemTextW FrameRect SetPropW TranslateMessage MapDialogRect SetWindowLongW GetClientRect GetDlgItem DrawTextW DialogBoxParamW UpdateWindow ReleaseDC BeginPaint EndPaint

kernel32

FindFirstFileExW HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType HeapFree HeapAlloc GetACP GetStdHandle GetModuleHandleExW ExitProcess RaiseException RtlUnwind LoadLibraryW CreateTimerQueue ReadConsoleW MultiByteToWideChar WideCharToMultiByte ReadFile CreateFileW GetLastError CloseHandle IsValidCodePage GetFileSizeEx WriteFile WaitForMultipleObjects Sleep DeleteFileW CreateThread GetTempPathW OutputDebugStringW GetLocalTime FindFirstFileW GetFullPathNameW FindNextFileW TerminateProcess RemoveDirectoryW GetModuleFileNameW GetEnvironmentVariableW FindClose WaitForSingleObject GetFileAttributesW OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetProcAddress MoveFileExW CreateProcessW GetModuleHandleW GetTickCount LocalFree GetCommandLineW GetVersionExW MulDiv InterlockedPushEntrySList GetOEMCP GetCommandLineA HeapSize WriteConsoleW SetFilePointerEx SetStdHandle GetProcessHeap FreeEnvironmentStringsW CreateDirectoryW GetEnvironmentStringsW InterlockedPopEntrySList QueryDepthSList SetEndOfFile UnregisterWaitEx ReleaseSemaphore DuplicateHandle GetStringTypeW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer QueryPerformanceCounter LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW VirtualAlloc VirtualProtect VirtualFree InterlockedFlushSList

gdi32

SaveDC SelectObject CreateFontW GetStockObject GetDeviceCaps SetTextColor SetBkMode RestoreDC DeleteObject CreateSolidBrush RoundRect IntersectClipRect

shell32

CommandLineToArgvW

crypt32

CryptDecodeObjectEx CryptImportPublicKeyInfo

msimg32

GradientFill

Sharing

General

Malware Config

Signatures

File Explorer

8049b4d662eaa6c13064f8773e15502d183b31d1ed0e8a965a50c28223fdf4b4

winhttp

advapi32

comctl32

user32

kernel32

gdi32

shell32

crypt32

msimg32

generic