e776425b1bc1e62ee8ff667745eaac9f361b7cf93754c3d195b995ad9d99c6f0

Sharing

Copy URL Twitter E-mail

General

Target
e776425b1bc1e62ee8ff667745eaac9f361b7cf93754c3d195b995ad9d99c6f0
Size 3.2MB
Sample261102-tyhfcabv4t
SHA256 e776425b1bc1e62ee8ff667745eaac9f361b7cf93754c3d195b995ad9d99c6f0
MD5 d1f754a5a96d5e7b7ba183177aa59179
SHA1 d326b73d4d7bd6dbc856854350cc47975376b0ee
SHA512 405149ad3fd9fcd00ffb0e3bc568991fa1fcb5281053f4e79ebd8983e98c7b592eb1427b0f59cc270c0f6280b43b321cd924460c83dcd32519c8b97c3e75f54e
SSDEEP 49152:Ro0Z39HDI+EM696SOwd8ny6k+48RIZnA9rS8l5DTIgyPgTQPNIm:RL3BDBvkfoo8RIZA9rS8DLQ1
TLSH
T1F0F58D20B792C076EA4E11B2156D8AAB58743F584B6194CBD3C83E3BAD311E37737A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e776425b1bc1e62ee8ff667745eaac9f361b7cf93754c3d195b995ad9d99c6f0

File Explorer

e776425b1bc1e62ee8ff667745eaac9f361b7cf93754c3d195b995ad9d99c6f0

.dll 3.2MB

e776425b1bc1e62ee8ff667745eaac9f361b7cf93754c3d195b995ad9d99c6f0

IMPHASH 08bde43e5184066366915e65b70a44bf
SHA256 e776425b1bc1e62ee8ff667745eaac9f361b7cf93754c3d195b995ad9d99c6f0
MD5 d1f754a5a96d5e7b7ba183177aa59179
SHA1 d326b73d4d7bd6dbc856854350cc47975376b0ee
SHA512 405149ad3fd9fcd00ffb0e3bc568991fa1fcb5281053f4e79ebd8983e98c7b592eb1427b0f59cc270c0f6280b43b321cd924460c83dcd32519c8b97c3e75f54e
SSDEEP 49152:Ro0Z39HDI+EM696SOwd8ny6k+48RIZnA9rS8l5DTIgyPgTQPNIm:RL3BDBvkfoo8RIZA9rS8DLQ1
TLSH
T1F0F58D20B792C076EA4E11B2156D8AAB58743F584B6194CBD3C83E3BAD311E37737A17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1924639

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\C++\Safe\Rhino\Safe\Install\RCSetup\Bin\Win32\release_static\pdb\RCWidgetPlugin.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

ws2_32

getsockopt listen recv recvfrom send sendto setsockopt shutdown socket connect WSAGetLastError closesocket getsockname freeaddrinfo getaddrinfo ntohl inet_addr ntohs htons WSACleanup WSAStartup getpeername bind ioctlsocket select accept

kernel32

GlobalAlloc GlobalFree WideCharToMultiByte lstrcpyW GetVersionExW FindFirstFileW lstrlenW FindClose GetFileAttributesW lstrcatW WriteFile SetFilePointer GetLocalTime GetUserDefaultLangID QueryDosDeviceW GetEnvironmentVariableW GetLogicalDriveStringsW VirtualQuery InterlockedIncrement InterlockedDecrement EnterCriticalSection LeaveCriticalSection GetVersionExA TryEnterCriticalSection InterlockedExchange GetSystemTimeAsFileTime OpenProcess GetCurrentProcess TerminateProcess GetStdHandle DuplicateHandle CreateProcessW GetStartupInfoW SetEvent CreateEventW GetLongPathNameW ExpandEnvironmentStringsW GetCurrentDirectoryW ResetEvent ReleaseMutex WaitForMultipleObjects CreateMutexW LocalFree FormatMessageW SetEndOfFile SetFileTime CreateDirectoryW SetFileAttributesW GetFileAttributesExW DeleteFileW MoveFileExW GetSystemInfo SetEnvironmentVariableA FindNextFileW FreeLibrary GetProcAddress LoadLibraryExW GetFileSize GetTickCount SetLastError InterlockedExchangeAdd LoadLibraryW GlobalMemoryStatusEx GetModuleHandleW SearchPathW ResumeThread LockResource LoadResource FindResourceW lstrcmpiW InitializeCriticalSection GetACP FileTimeToSystemTime SystemTimeToFileTime IsValidCodePage ReadFile HeapAlloc GetProcessHeap GetFileTime MultiByteToWideChar GetWindowsDirectoryW GetTempFileNameW MoveFileW LoadLibraryA DeviceIoControl GetFileSizeEx WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo lstrcmpW MulDiv SizeofResource SetWaitableTimer CreateWaitableTimerW LocalAlloc FreeResource GlobalLock GlobalUnlock UnmapViewOfFile CreateFileMappingW MapViewOfFileEx GetModuleHandleA DisableThreadLibraryCalls CreateThread VirtualProtect GetModuleHandleExW OutputDebugStringA HeapCreate HeapDestroy FlushInstructionCache IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetOEMCP GetFullPathNameA UnlockFileEx HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile CreateFileA DeleteFileA HeapReAlloc HeapCompact UnlockFile CreateFileMappingA LockFileEx FormatMessageA MapViewOfFile FlushFileBuffers GetFileType CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask lstrcpynW GetCurrentThreadId WaitForSingleObject GetTempPathW CloseHandle CreateFileW SetErrorMode RegisterWaitForSingleObject UnregisterWait GetThreadTimes GetCommandLineA GetEnvironmentStringsW GetModuleFileNameW GetCurrentProcessId Sleep GetDiskFreeSpaceW DeleteCriticalSection DecodePointer RaiseException GetLastError FreeEnvironmentStringsW InitializeCriticalSectionAndSpinCount GetFullPathNameW GetCommandLineW RtlUnwind ExitThread ExitProcess GetModuleFileNameA SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FindFirstFileExA HeapFree FindNextFileA SetStdHandle WriteConsoleW LockFile InterlockedCompareExchange AreFileApisANSI SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTime SetThreadContext GetThreadContext FreeLibraryAndExitThread ReleaseSemaphore InterlockedFlushSList QueryDepthSList UnregisterWaitEx Thread32Next Thread32First SuspendThread CreateToolhelp32Snapshot OpenThread

user32

MonitorFromWindow IsWindowVisible GetDC ShowWindowAsync AdjustWindowRectEx GetWindowTextLengthW DialogBoxParamW UnionRect GetClassLongW PostQuitMessage SetRect UpdateLayeredWindow FillRect MsgWaitForMultipleObjects SetRectEmpty AttachThreadInput SetCaretPos LoadImageW LoadBitmapW GetDesktopWindow SetForegroundWindow ToAscii GetCaretBlinkTime GetKeyboardState GetSystemMetrics DrawIconEx GetIconInfo GetSysColor IsClipboardFormatAvailable GetClipboardData CloseClipboard SetClipboardData EmptyClipboard GetAncestor RegisterWindowMessageW EnumThreadWindows CreateAcceleratorTableW LoadStringW GetFocus GetAsyncKeyState GetMonitorInfoW IsChild MapWindowPoints ValidateRect MoveWindow SetFocus ShowWindow InvalidateRgn OpenClipboard SetTimer SetWindowRgn GetClassNameW SetParent GetDlgItem KillTimer SetWindowTextW DestroyAcceleratorTable BeginPaint EndPaint EnableWindow GetKeyState ScreenToClient TrackMouseEvent SetCapture ReleaseCapture SetWindowPos EqualRect EnumChildWindows RedrawWindow CopyRect ClientToScreen IntersectRect GetWindowDC SetCursor GetClientRect IsZoomed GetParent InvalidateRect GetDCEx IsIconic ReleaseDC GetCursorPos CreateWindowExW RegisterClassExW IsRectEmpty LoadCursorW GetClassInfoExW CharPrevW CharNextW wsprintfW GetMessageW DispatchMessageW PeekMessageW TranslateMessage PostThreadMessageW SystemParametersInfoW GetWindowThreadProcessId GetWindow GetWindowRect MessageBoxW IsWindow GetForegroundWindow FindWindowW PtInRect GetWindowTextW PostMessageW GetActiveWindow LoadIconW EndDialog GetWindowLongW DefWindowProcW CallWindowProcW DestroyWindow SendMessageW UnregisterClassW SetWindowLongW SetPropW RemovePropW GetPropW OffsetRect

advapi32

RegQueryInfoKeyW RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW QueryServiceStatus CloseServiceHandle OpenSCManagerW StartServiceW OpenServiceW RegCloseKey

ole32

CoCreateInstance CoTaskMemFree CoTaskMemRealloc CreateStreamOnHGlobal CoTaskMemAlloc OleUninitialize StringFromGUID2 CLSIDFromProgID CLSIDFromString OleLockRunning CoGetClassObject OleInitialize

shell32

SHGetSpecialFolderPathW DragFinish DragQueryFileW SHGetFolderPathW SHGetPathFromIDListW SHBrowseForFolderW

oleaut32

SysAllocStringLen SysStringLen DispCallFunc VarUI4FromStr LoadTypeLi VariantInit LoadRegTypeLi SysAllocString VariantClear OleCreateFontIndirect SysFreeString

shlwapi

PathFindFileNameW ord12 StrToIntA PathAppendW StrDupW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdi32

CreateFontIndirectW CreateSolidBrush DeleteObject GetObjectW SetTextColor GetStockObject GetRgnBox SetViewportOrgEx CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt GetDeviceCaps CreatePolygonRgn CreateRectRgnIndirect SetWorldTransform SetGraphicsMode SetBkColor EnumFontsW PtInRegion CreateRoundRectRgn CreateDIBSection GetClipBox GetDIBits CreateDCW ExtTextOutW DeleteDC

msimg32

AlphaBlend

urlmon

CoInternetCreateZoneManager CoInternetCreateSecurityManager

imm32

ImmNotifyIME ImmAssociateContextEx ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmGetCompositionStringW

gdiplus

GdipCreateSolidFill GdipCloneBitmapArea GdipGetCellDescent GdipSetInterpolationMode GdipSetLinePresetBlend GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipEndContainer GdipSetSmoothingMode GdipCreateMatrix GdipGetStringFormatAlign GdipDeletePath GdipDisposeImageAttributes GdipCreateMatrix2 GdipDeleteBrush GdipGetLineSpacing GdipSetLineWrapMode GdipCreateLineBrushI GdipDrawImageRectRect GdipSaveGraphics GdipCreateFontFamilyFromName GdipGetEmHeight GdipGetStringFormatLineAlign GdipAddPathString GdipGetTextRenderingHint GdipGetFamily GdipSetCompositingQuality GdipSetImageAttributesColorMatrix GdipGetLineTransform GdipDeleteFontFamily GdipGetInterpolationMode GdipCreateRegionPath GdipAddPathLineI GdipAddPathBezierI GdipCombineRegionPath GdipAddPathEllipseI GdipAddPathArcI GdipAddPathRectangleI GdipCombineRegionRegion GdipSetStringFormatTrimming GdipSetLineTransform GdipSetTextureTransform GdipSetCompositingMode GdipCreateHBITMAPFromBitmap GdipTransformRegion GdipFillPath GdipGetPathWorldBounds GdipFillRectangleI ord1 GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipGetFontSize GdipTranslateWorldTransform GdipDeletePen GdipCreatePen1 GdipSetStringFormatAlign GdipDrawImageRectRectI GdipDeleteMatrix GdipGetFamilyName GdipCloneRegion GdipSetStringFormatFlags GdipGetImagePixelFormat GdipCloneBitmapAreaI GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipCloneImage GdipBitmapUnlockBits GdipGetPropertyItem GdipCreateBitmapFromStream GdipAlloc GdipDisposeImage GdipFree GdipImageSelectActiveFrame GdipBitmapLockBits GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetImageWidth GdipGetPropertyItemSize GdiplusStartup GdipMultiplyWorldTransform GdipGraphicsClear GdipSetPenDashStyle GdipDrawLine GdipDrawRectangle GdipSetPixelOffsetMode GdipScaleWorldTransform GdipSetClipRectI GdipClosePathFigure GdipGetSmoothingMode GdipDrawArcI GdipCreateImageAttributes GdipSetClipRegion GdipDrawPath GdipDrawString GdipSetImageAttributesWrapMode GdipGetClipBoundsI GdipGetFontStyle GdipCreateFromHDC GdipFillEllipse GdipBeginContainer2 GdipCreateTexture GdipGetTextureTransform GdipGetMatrixElements GdipCloneStringFormat GdipSetTextRenderingHint GdipGetCellAscent GdipStringFormatGetGenericTypographic GdipRotateWorldTransform GdipRestoreGraphics GdipCloneBrush GdipMeasureString GdipDeleteRegion GdipGetBrushType GdipGetImageGraphicsContext

winmm

timeGetTime

psapi

GetMappedFileNameW

generic

count=27, id=241, version=40116,

count=166, id=243, version=40116,

count=35, id=242, version=40116,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, productName=Unmarked objects (old),

count=3, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,

count=31, id=259, version=26706,

count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=123, id=261, version=26706,

count=36, id=260, version=26706,

count=2, id=260, version=27035,

count=61, id=261, version=27035,

count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=687, id=1, productName=Unmarked objects,

count=283, id=265, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,