0d4cc8cb9a297fe723af72f083a92c74a11347975467c6ca0cc28c081ccf2d10

Sharing

Copy URL Twitter E-mail

General

Target
0d4cc8cb9a297fe723af72f083a92c74a11347975467c6ca0cc28c081ccf2d10
Size 151KB
Sample261102-le6d3aay8m
SHA256 0d4cc8cb9a297fe723af72f083a92c74a11347975467c6ca0cc28c081ccf2d10
MD5 fb52408176c3fbef1162b119df88f167
SHA1 c2f9306e3f21d7a2468eae7b48cd9977711ab1ac
SHA512 6220a73246dafa04705a49ab5392b37e200b0605885ca22db842c268028e7bea637a90a1e38d7051789833189f65e519d7035f10d6678ce47e073f5b27c6fc66
SSDEEP 3072:hEOOnveQWJ/bgaS4Yb6ZmO9YAfCKRBmxz1moVydkCVEplDbIuh7SUMIckVPxIiTk:hvOnvePJ/bgaSpbCvrRBzoVydkCRuxu1
TLSH
T155E35B00EA46917EE79F5534867A9B3BEF242986CBA38DC7F7C08DC19C615D09E3530A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d4cc8cb9a297fe723af72f083a92c74a11347975467c6ca0cc28c081ccf2d10

File Explorer

0d4cc8cb9a297fe723af72f083a92c74a11347975467c6ca0cc28c081ccf2d10

.dll 151KB

0d4cc8cb9a297fe723af72f083a92c74a11347975467c6ca0cc28c081ccf2d10

IMPHASH 254207525692b93a9373aec62543cb68
SHA256 0d4cc8cb9a297fe723af72f083a92c74a11347975467c6ca0cc28c081ccf2d10
MD5 fb52408176c3fbef1162b119df88f167
SHA1 c2f9306e3f21d7a2468eae7b48cd9977711ab1ac
SHA512 6220a73246dafa04705a49ab5392b37e200b0605885ca22db842c268028e7bea637a90a1e38d7051789833189f65e519d7035f10d6678ce47e073f5b27c6fc66
SSDEEP 3072:hEOOnveQWJ/bgaS4Yb6ZmO9YAfCKRBmxz1moVydkCVEplDbIuh7SUMIckVPxIiTk:hvOnvePJ/bgaSpbCvrRBzoVydkCRuxu1
TLSH
T155E35B00EA46917EE79F5534867A9B3BEF242986CBA38DC7F7C08DC19C615D09E3530A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

108416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW LogonUserW RegCloseKey RegOpenKeyExW RegQueryValueExW

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileMappingW CreateFileW CreateMutexW CreateProcessW CreateToolhelp32Snapshot DeleteFileW DisableThreadLibraryCalls ExitProcess ExpandEnvironmentStringsW FindResourceW FlushInstructionCache FreeLibrary GetCommandLineW GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetPrivateProfileIntW GetPrivateProfileSectionW GetPrivateProfileStringW GetProcAddress GetSystemDirectoryW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetThreadContext GetTickCount64 GetVolumeInformationW InitializeSListHead InterlockedFlushSList IsProcessorFeaturePresent K32GetModuleInformation LoadLibraryW LoadResource LocalAlloc LocalFree LockResource MapViewOfFile MoveFileExW MulDiv OpenFileMappingW Process32FirstW Process32NextW QueryPerformanceCounter ReadFile ReleaseSRWLockExclusive ResumeThread SetEnvironmentVariableW SetLastError SetThreadContext SizeofResource Sleep SleepConditionVariableSRW SuspendThread TerminateProcess TryAcquireSRWLockExclusive UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WakeAllConditionVariable lstrcatW lstrcmpiW lstrcpyW

crypt32

CryptProtectData CryptUnprotectData

samcli

NetUserGetInfo

user32

CallNextHookEx ClientToScreen DispatchMessageW EnumChildWindows EnumWindows FindWindowExW GetAncestor GetAsyncKeyState GetCapture GetClassNameW GetClientRect GetCursorPos GetFocus GetForegroundWindow GetKeyState GetMessageW GetMonitorInfoW GetParent GetSystemMetrics GetWindowRect GetWindowTextW GetWindowThreadProcessId IsRectEmpty IsWindowVisible KillTimer MonitorFromWindow PostMessageW PtInRect RegisterHotKey SendInput SetActiveWindow SetCursorPos SetForegroundWindow SetTimer SetWindowPos SetWindowsHookExW ShowWindow TranslateMessage VkKeyScanW WindowFromPoint keybd_event

ole32

CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemFree CoUninitialize PropVariantClear

shell32

CommandLineToArgvW SHGetPropertyStoreForWindow SetCurrentProcessExplicitAppUserModelID

shlwapi

ord437 PathCanonicalizeW PathRemoveFileSpecW StrStrIW

oleaut32

SysAllocStringLen SysFreeString SysStringLen VariantClear VariantInit

msvcrt

?terminate@@YAXXZ _CxxThrowException __CppXcptFilter __CxxFrameHandler3 __getmainargs _amsg_exit _beginthreadex _callnewh _errno _except_handler4_common _initterm _initterm_e _msize _wcsicmp ceil free isspace iswalnum iswdigit malloc memcpy memmove memset realloc strcpy_s strlen towlower towupper wcslen wcsrchr wcstoul

Name

.text

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

14B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0d4cc8cb9a297fe723af72f083a92c74a11347975467c6ca0cc28c081ccf2d10

advapi32

kernel32

crypt32

samcli

user32

ole32

shell32

shlwapi

oleaut32

msvcrt

generic