4dfedaa3cbebb6d5ae77348bc2b7f605c0207f3946b7e0c87dba85b0654dd967

Sharing

Copy URL Twitter E-mail

General

Target
4dfedaa3cbebb6d5ae77348bc2b7f605c0207f3946b7e0c87dba85b0654dd967
Size 1.4MB
Sample261102-japveaas2p
SHA256 4dfedaa3cbebb6d5ae77348bc2b7f605c0207f3946b7e0c87dba85b0654dd967
MD5 8879f13c616f7ba99c7be0774f2f480d
SHA1 5f4b7b2fb813da711c078f42f7a061babcc51772
SHA512 3c4d97b0225da4c92fa4054582a4d9387edd3ec9075e137b449d3ac375cfbadad1cf92988255e5beb011d57fd035d6a90cd36b2ba588246f5ceb64d11bcc332b
SSDEEP 24576:UWZ5/uyX8gUPaL89ICgo2fc9RgJBfhOB95Dr47iJ0nQZo2vI3:3DuyXflCgogcfgJ1hOlciSexvI
TLSH
T1AC65E0567BF1B07BE1F346F19FB6872480B1B9A16832450BB7D4830D1F70A529A3E672
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4dfedaa3cbebb6d5ae77348bc2b7f605c0207f3946b7e0c87dba85b0654dd967

File Explorer

4dfedaa3cbebb6d5ae77348bc2b7f605c0207f3946b7e0c87dba85b0654dd967

.exe 1.4MB

4dfedaa3cbebb6d5ae77348bc2b7f605c0207f3946b7e0c87dba85b0654dd967

IMPHASH 561ca01be3ee6ff2983b21ce213998d6
SHA256 4dfedaa3cbebb6d5ae77348bc2b7f605c0207f3946b7e0c87dba85b0654dd967
MD5 8879f13c616f7ba99c7be0774f2f480d
SHA1 5f4b7b2fb813da711c078f42f7a061babcc51772
SHA512 3c4d97b0225da4c92fa4054582a4d9387edd3ec9075e137b449d3ac375cfbadad1cf92988255e5beb011d57fd035d6a90cd36b2ba588246f5ceb64d11bcc332b
SSDEEP 24576:UWZ5/uyX8gUPaL89ICgo2fc9RgJBfhOB95Dr47iJ0nQZo2vI3:3DuyXflCgogcfgJ1hOlciSexvI
TLSH
T1AC65E0567BF1B07BE1F346F19FB6872480B1B9A16832450BB7D4830D1F70A529A3E672
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

360721

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\landun\workspace\p-ad0484fbdfe349d18f6d70b4084a70ba\src\product\win32\dbginfo\kvipgui.pdb

kernel32

SetEndOfFile DeleteFileW CreateDirectoryW GetCurrentProcessId SetFilePointer CreateProcessW OpenEventW GetCommandLineA LocalFree SetEvent CreateEventW GetSystemDirectoryW CreateMutexW WaitForMultipleObjects GetSystemTimeAsFileTime QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA GetThreadLocale GetLocaleInfoA GetACP GetVersionExA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy WriteFile GetFileSizeEx ReleaseMutex InterlockedCompareExchange WaitForSingleObject GlobalDeleteAtom OutputDebugStringW GetProcAddress GlobalGetAtomNameW InterlockedIncrement GetLocalTime InterlockedDecrement GetWindowsDirectoryW GlobalAddAtomW GetTickCount GetFileAttributesW lstrlenW FlushInstructionCache GetCurrentProcess GetCommandLineW GetVersionExW GetModuleHandleW LeaveCriticalSection EnterCriticalSection RaiseException DeleteCriticalSection InitializeCriticalSection InterlockedExchangeAdd SetLastError Sleep OpenProcess GetCurrentThreadId GlobalFree ReadFile GlobalLock SizeofResource GetLastError lstrlenA InterlockedExchange GetPrivateProfileStringW LoadLibraryW FindResourceExW WideCharToMultiByte GetFileSize FreeLibrary MultiByteToWideChar GetPrivateProfileIntW GlobalAlloc CloseHandle LockResource GlobalUnlock LoadResource FindResourceW FreeResource CreateFileW GetModuleFileNameW ResetEvent

user32

LoadImageW InflateRect LoadBitmapW FindWindowW LoadCursorW GetDesktopWindow RegisterClassExW CreateWindowExW GetDC ReleaseDC PostMessageW GetParent SystemParametersInfoW GetWindow SetWindowPos GetWindowRect AttachThreadInput GetWindowLongW SetForegroundWindow DefWindowProcW UnregisterClassA SendMessageTimeoutW MessageBoxA PostQuitMessage BringWindowToTop FillRect UpdateWindow MonitorFromPoint GetSystemMetrics PostThreadMessageW GetFocus IsRectEmpty GetDlgItem ReleaseCapture OffsetRect GetMessageW ScreenToClient DrawFrameControl SetRectEmpty SetCursor GetMonitorInfoW EqualRect CallWindowProcW DispatchMessageW IntersectRect MonitorFromWindow EndPaint SetTimer LoadIconW SetFocus IsWindowVisible TranslateMessage DrawIconEx DrawTextW IsChild SetCapture GetCursorPos GetNextDlgTabItem BeginPaint GetDlgCtrlID ClientToScreen SetRect UpdateLayeredWindow IsDialogMessageW PeekMessageW PtInRect DestroyIcon FindWindowExW ShowWindow SetWindowTextW GetForegroundWindow GetWindowThreadProcessId MoveWindow UnregisterClassW EnableWindow DestroyWindow IsWindowEnabled KillTimer GetActiveWindow GetClientRect MapWindowPoints SetActiveWindow InvalidateRect IsWindow GetClassInfoExW CopyRect SendMessageW SetWindowLongW RegisterWindowMessageW

gdi32

CreateDIBSection RestoreDC CreateCompatibleBitmap DeleteObject CreateBitmap ExtTextOutW SetTextColor LineTo MoveToEx RectInRegion CreateRectRgnIndirect GetClipRgn SetBkMode GetCurrentObject CreateCompatibleDC TextOutW GetTextExtentPoint32W GetTextColor OffsetRgn DeleteDC SetViewportOrgEx GetViewportOrgEx ExtSelectClipRgn CombineRgn RoundRect GetObjectA CreateFontW CreateSolidBrush Rectangle BitBlt GetDeviceCaps GetStockObject SetBkColor GetObjectW StretchBlt CreateRectRgn SelectClipRgn SetStretchBltMode CreateRoundRectRgn SaveDC SelectObject CreateFontIndirectW CreatePen

advapi32

SetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW InitializeSecurityDescriptor GetSecurityDescriptorSacl GetUserNameW RegQueryValueExW RegOpenKeyExW RegCloseKey SetSecurityDescriptorDacl

shell32

SHGetSpecialFolderPathW ShellExecuteW SHGetFolderPathW

ole32

CoInitialize CreateStreamOnHGlobal CoUninitialize

oleaut32

SysFreeString

msvcp80

?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z ?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB ??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ ??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z ??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z ?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z ?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ ?setw@std@@YA?AU?$_Smanip@H@1@H@Z ?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z ??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z ?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z ?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z ?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z ?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z ?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ ??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z ??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z ??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z ?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z ?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?uncaught_exception@std@@YA_NXZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z ?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ ?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V32@0@Z ?id@?$numpunct@_W@std@@2V0locale@2@A ??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z ??1_Lockit@std@@QAE@XZ ?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z ??0_Lockit@std@@QAE@H@Z ?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z ??1locale@std@@QAE@XZ ?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@@Z ??0locale@std@@QAE@XZ ?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0ABV12@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?is@?$ctype@_W@std@@QBE_NF_W@Z ??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z ?_Register@facet@locale@std@@QAEXXZ ?_Getcat@?$numpunct@_W@std@@SAIPAPBVfacet@locale@2@@Z ?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEX_NI@Z ?grouping@?$numpunct@_W@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ ?_Incref@facet@locale@std@@QAEXXZ ?thousands_sep@?$numpunct@_W@std@@QBE_WXZ ??Bid@locale@std@@QAEIXZ ?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ ?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ ?id@?$ctype@_W@std@@2V0locale@2@A ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z ??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?allocate@?$allocator@D@std@@QAEPADI@Z ?deallocate@?$allocator@D@std@@QAEXPADI@Z

shlwapi

StrToIntW PathFindFileNameW StrToIntA PathRemoveFileSpecW PathFileExistsW PathAppendW PathAddBackslashW

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

gdiplus

GdipCreatePen1 GdipFillRectangleI GdipAddPathStringI GdipDrawString GdipNewPrivateFontCollection GdipAddPathPieI GdipCreateFont GdipGetImageWidth GdipGetImagePixelFormat GdiplusShutdown GdipGraphicsClear GdipDeleteFontFamily GdipCreateBitmapFromScan0 GdipDeleteGraphics GdipDrawImagePointsRectI GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStream GdipCloneImage GdipLoadImageFromStream GdipDrawImageRectRect GdipDisposeImageAttributes GdipCreateFromHDC GdipGetImageGraphicsContext GdipFree GdipSetImageAttributesColorMatrix GdipDrawImageRectI GdipAlloc GdipGetImageHeight GdipDrawImageRectRectI GdipLoadImageFromFile GdipCreateImageAttributes GdipImageRotateFlip GdipCloneBitmapArea GdiplusStartup GdipDisposeImage GdipSetInterpolationMode GdipSetPixelOffsetMode GdipDeleteBrush GdipCreateLineBrushFromRectWithAngleI GdipSetPenLineJoin GdipCreateFontFromLogfontA GdipAddPathArc GdipCreatePath GdipGetFamily GdipSetStringFormatTrimming GdipFillPath GdipCreateStringFormat GdipSetStringFormatFlags GdipSetPenDashStyle GdipCloneFontFamily GdipDrawLine GdipSetCompositingQuality GdipDrawLinesI GdipSetPenStartCap GdipCreateFontFromDC GdipSetClipPath GdipDrawImageI GdipSetStringFormatAlign GdipDeleteStringFormat GdipGetFontCollectionFamilyCount GdipDeletePen GdipGetFontCollectionFamilyList GdipMeasureString GdipDeletePath GdipClosePathFigure GdipCreateFontFromLogfontW GdipPrivateAddFontFile GdipAddPathRectangleI GdipSetSmoothingMode GdipDeleteFont GdipDeletePrivateFontCollection GdipCreateSolidFill GdipAddPathArcI GdipFillRectangle GdipResetWorldTransform GdipDrawPath GdipRotateWorldTransform GdipCloneBrush GdipTranslateWorldTransform GdipSetPenMode GdipDrawRectangleI GdipGetFontSize GdipSetTextRenderingHint GdipSetPenEndCap GdipSetStringFormatLineAlign

msvcr80

_CxxThrowException _invalid_parameter_noinfo __CxxFrameHandler3 _stricmp _controlfp_s _invoke_watson ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook _except_handler4_common __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm _wcmdln exit _XcptFilter _cexit __wgetmainargs _amsg_exit ?terminate@@YAXXZ _decode_pointer _onexit _lock _encode_pointer __dllonexit _unlock ??8type_info@@QBE_NABV0@@Z wcstok strncmp isalpha tolower isalnum strchr isspace _vsnprintf_s fprintf memmove wcsncmp _localtime64_s _mktime64 iswspace _wcslwr_s strncpy_s _exit _wtoi64 ceil _mbschr wcscpy atoi abs wcschr ??0bad_cast@std@@QAE@ABV01@@Z ??0bad_cast@std@@QAE@PBD@Z ??1bad_cast@std@@UAE@XZ _wcsdup floor swprintf_s _mbsicmp wcscmp _beginthreadex _localtime64 strftime _wtoi _time64 __RTDynamicCast _wcsicmp _vscwprintf memcpy _waccess wcsrchr _recalloc wcscspn ??0exception@std@@QAE@ABV01@@Z ??0exception@std@@QAE@ABQBD@Z ??0exception@std@@QAE@XZ memcpy_s ??1exception@std@@UAE@XZ ?what@exception@std@@UBEPBDXZ free ??_V@YAXPAX@Z memmove_s _vscprintf labs strlen memset wcsspn _mbscmp strcmp calloc _purecall wcsstr _wtof ??2@YAPAXI@Z vswprintf_s vsprintf_s malloc wcslen ??3@YAXPAX@Z

Sharing

General

Malware Config

Signatures

File Explorer

4dfedaa3cbebb6d5ae77348bc2b7f605c0207f3946b7e0c87dba85b0654dd967

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp80

shlwapi

comctl32

msimg32

version

gdiplus

msvcr80

generic