86447687fec3ad107daa75aaf85b45139b99c09ada7f8e9d28d9f29d0114f663

Sharing

Copy URL Twitter E-mail

General

Target
86447687fec3ad107daa75aaf85b45139b99c09ada7f8e9d28d9f29d0114f663
Size 190KB
Sample261102-le6d3astcw
SHA256 86447687fec3ad107daa75aaf85b45139b99c09ada7f8e9d28d9f29d0114f663
MD5 6f2f8c30d0eaae6e1a8c7a574b25def7
SHA1 03e295dadbcd520f0b9b3af6fe62b5b5006bef96
SHA512 36c1b30bacbd6e26c9facdcf4d6b039417db5c7576956c437233db1bcacb5fe865cd8896e8a0b4e5a90e384523276016dffa4f106607c375c09ac9a8a1d61d2f
SSDEEP 3072:TceS9DDG1mhr5EhsatCAkx4S3OWFy6MQdP3ijDAEM715r7fckVPxIiTK1abVl:G9so2Zvkx4S3OWmjDAl/u
TLSH
T1BF142803E096507BE55AC43D8A438A22FB72B9858B50A7CF2B554FB90D67BD49F3C702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
86447687fec3ad107daa75aaf85b45139b99c09ada7f8e9d28d9f29d0114f663

File Explorer

86447687fec3ad107daa75aaf85b45139b99c09ada7f8e9d28d9f29d0114f663

.dll 190KB

86447687fec3ad107daa75aaf85b45139b99c09ada7f8e9d28d9f29d0114f663

IMPHASH 6e2fc6f3f08fc2be5e36fe2385547565
SHA256 86447687fec3ad107daa75aaf85b45139b99c09ada7f8e9d28d9f29d0114f663
MD5 6f2f8c30d0eaae6e1a8c7a574b25def7
SHA1 03e295dadbcd520f0b9b3af6fe62b5b5006bef96
SHA512 36c1b30bacbd6e26c9facdcf4d6b039417db5c7576956c437233db1bcacb5fe865cd8896e8a0b4e5a90e384523276016dffa4f106607c375c09ac9a8a1d61d2f
SSDEEP 3072:TceS9DDG1mhr5EhsatCAkx4S3OWFy6MQdP3ijDAEM715r7fckVPxIiTK1abVl:G9so2Zvkx4S3OWmjDAl/u
TLSH
T1BF142803E096507BE55AC43D8A438A22FB72B9858B50A7CF2B554FB90D67BD49F3C702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

119936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW LogonUserW RegCloseKey RegOpenKeyExW RegQueryValueExW

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileMappingW CreateFileW CreateMutexW CreateProcessW CreateToolhelp32Snapshot DeleteFileW DisableThreadLibraryCalls EncodePointer ExitProcess ExpandEnvironmentStringsW FindResourceW FlushInstructionCache FreeLibrary GetCommandLineW GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetPrivateProfileIntW GetPrivateProfileSectionW GetPrivateProfileStringW GetProcAddress GetSystemDirectoryW GetSystemTimeAsFileTime GetThreadContext GetTickCount64 GetVolumeInformationW InitializeSListHead InterlockedFlushSList K32GetModuleInformation LoadLibraryW LoadResource LocalAlloc LocalFree LockResource MapViewOfFile MoveFileExW MulDiv OpenFileMappingW Process32FirstW Process32NextW QueryPerformanceCounter RaiseException ReadFile ReleaseSRWLockExclusive ResumeThread RtlUnwindEx SetEnvironmentVariableW SetLastError SetThreadContext SizeofResource Sleep SleepConditionVariableSRW SuspendThread TerminateProcess UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WakeAllConditionVariable lstrcatW lstrcmpiW lstrcpyW

crypt32

CryptProtectData CryptUnprotectData

samcli

NetUserGetInfo

user32

CallNextHookEx ClientToScreen DispatchMessageW EnumChildWindows EnumWindows FindWindowExW GetAncestor GetAsyncKeyState GetCapture GetClassNameW GetClientRect GetCursorPos GetFocus GetForegroundWindow GetKeyState GetMessageW GetMonitorInfoW GetParent GetSystemMetrics GetWindowRect GetWindowTextW GetWindowThreadProcessId IsRectEmpty IsWindowVisible KillTimer MonitorFromWindow PostMessageW PtInRect RegisterHotKey SendInput SetActiveWindow SetCursorPos SetForegroundWindow SetTimer SetWindowPos SetWindowsHookExW ShowWindow TranslateMessage VkKeyScanW WindowFromPoint keybd_event

ole32

CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemFree CoUninitialize PropVariantClear

shell32

CommandLineToArgvW SHGetPropertyStoreForWindow SetCurrentProcessExplicitAppUserModelID

shlwapi

ord437 PathCanonicalizeW PathRemoveFileSpecW StrStrIW

oleaut32

SysAllocStringLen SysFreeString SysStringLen VariantClear VariantInit

msvcrt

?terminate@@YAXXZ _CxxThrowException __C_specific_handler __CppXcptFilter __CxxFrameHandler3 __DestructExceptionObject __getmainargs _amsg_exit _beginthreadex _callnewh _errno _initterm _initterm_e _local_unwind _msize _wcsicmp abort ceilf free isspace iswalnum iswdigit malloc memcmp memcpy memmove memset realloc strcmp strcpy_s strlen towlower towupper wcslen wcsrchr wcstoul

Name

.text

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

42B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

86447687fec3ad107daa75aaf85b45139b99c09ada7f8e9d28d9f29d0114f663

advapi32

kernel32

crypt32

samcli

user32

ole32

shell32

shlwapi

oleaut32

msvcrt

generic