a70d64178b5d81dd4b1980f3524f38012bee50213b87b3b1d7be1e88135a7dba

Sharing

Copy URL Twitter E-mail

General

Target
a70d64178b5d81dd4b1980f3524f38012bee50213b87b3b1d7be1e88135a7dba
Size 888KB
Sample261102-w9evpscv7y
SHA256 a70d64178b5d81dd4b1980f3524f38012bee50213b87b3b1d7be1e88135a7dba
MD5 e4712744ff736f152c64ea512cd09c31
SHA1 56d604d29df1f923aa31721dd705e2bc2b17720e
SHA512 c6f0129ca71b94866984023e5e3f05c5c01f73e92ca334679d44c8b9e1fc8b7f54bbc31b9aef9aec3fd4a03178f044cf95a87fcedf24a32f24292e07e8670a68
SSDEEP 6144:luFHaP7d/pQmznPkBBbcxGDWAAobze0dk5t/Qsg57ejRdHoguhoh0+OymPgYFbR6:RzX14X8ft4sJEDuhC9Fbe/Nx6Do9
TLSH
T1F8153A50B182BB26C80F037018EDA6397739692173ABDBD3B24899784FE57E27D35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a70d64178b5d81dd4b1980f3524f38012bee50213b87b3b1d7be1e88135a7dba

File Explorer

a70d64178b5d81dd4b1980f3524f38012bee50213b87b3b1d7be1e88135a7dba

.dll 888KB

a70d64178b5d81dd4b1980f3524f38012bee50213b87b3b1d7be1e88135a7dba

IMPHASH 9ccf06edabeb1975294860745d2cdc5f
SHA256 a70d64178b5d81dd4b1980f3524f38012bee50213b87b3b1d7be1e88135a7dba
MD5 e4712744ff736f152c64ea512cd09c31
SHA1 56d604d29df1f923aa31721dd705e2bc2b17720e
SHA512 c6f0129ca71b94866984023e5e3f05c5c01f73e92ca334679d44c8b9e1fc8b7f54bbc31b9aef9aec3fd4a03178f044cf95a87fcedf24a32f24292e07e8670a68
SSDEEP 6144:luFHaP7d/pQmznPkBBbcxGDWAAobze0dk5t/Qsg57ejRdHoguhoh0+OymPgYFbR6:RzX14X8ft4sJEDuhC9Fbe/Nx6Do9
TLSH
T1F8153A50B182BB26C80F037018EDA6397739692173ABDBD3B24899784FE57E27D35B41
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

333872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ole32

CLIPFORMAT_UserFree CLIPFORMAT_UserMarshal CLIPFORMAT_UserSize CLIPFORMAT_UserUnmarshal CoCreateInstance CoGetMalloc CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CreateBindCtx CreateErrorInfo CreateItemMoniker CreateStreamOnHGlobal GetErrorInfo GetRunningObjectTable HACCEL_UserFree HACCEL_UserMarshal HACCEL_UserSize HACCEL_UserUnmarshal HDC_UserFree HDC_UserMarshal HDC_UserSize HDC_UserUnmarshal HPALETTE_UserFree HPALETTE_UserMarshal HPALETTE_UserSize HPALETTE_UserUnmarshal HWND_UserFree HWND_UserMarshal HWND_UserSize HWND_UserUnmarshal SetErrorInfo StringFromGUID2 WdtpInterfacePointer_UserMarshal WdtpInterfacePointer_UserSize WdtpInterfacePointer_UserUnmarshal

rpcrt4

CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_QueryInterface CreateProxyFromTypeInfo CreateStubFromTypeInfo IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrClientCall2 NdrDllCanUnloadNow NdrDllGetClassObject NdrOleAllocate NdrOleFree NdrStubCall2 NdrStubForwardingFunction RpcRaiseException

user32

CopyIcon CreateIconFromResourceEx DestroyIcon GetClientRect GetDC GetIconInfo GetSysColor GetWindowLongW ReleaseDC SetWindowLongW

gdi32

BitBlt CreateBitmap CreateCompatibleDC CreateDIBSection CreateDIBitmap CreateFontIndirectW DeleteDC DeleteEnhMetaFile DeleteMetaFile DeleteObject EnumFontFamiliesExW GdiGetCharDimensions GetCurrentObject GetDIBits GetDeviceCaps GetEnhMetaFileBits GetEnhMetaFileHeader GetObjectW GetPaletteEntries GetTextFaceW GetTextMetricsW PlayEnhMetaFile PlayMetaFile SelectObject SetBkColor SetEnhMetaFileBits SetMapMode SetMetaFileBitsEx SetTextColor SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx StretchBlt

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteKeyW RegEnumKeyExA RegEnumKeyExW RegOpenKeyExA RegOpenKeyExW RegQueryValueA RegQueryValueExA RegQueryValueW RegSetValueExW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf __stdio_common_vswprintf_s _assert _create_locale _free_locale _strdup _strnicmp _wcsdup _wcsicmp _wcsnicmp bsearch calloc ceil floor fmod free fwrite getenv iswalpha iswspace malloc memcmp memcpy memmove memset pow realloc strchr strcmp strcpy strcspn strlen strtol towlower towupper wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcsspn wcstod wcstol wcstoul

kernel32

CloseHandle CompareStringW ConvertDefaultLocale CreateFileMappingW CreateFileW DebugBreak DelayLoadFailureHook DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW FindActCtxSectionGuid FindResourceExW FindResourceW FreeLibrary FreeResource GetCurrencyFormatW GetEnvironmentVariableW GetFileSize GetFinalPathNameByHandleW GetLocaleInfoW GetModuleFileNameW GetModuleHandleW GetNumberFormatW GetProcAddress GetSystemDefaultLCID GetSystemDirectoryW GetSystemTime GetTickCount GetTimeFormatW GetVersion GlobalAlloc GlobalFree HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW IsWow64Process LZClose LZOpenFileW LZRead LZSeek LeaveCriticalSection LoadLibraryExW LoadLibraryW LoadResource LockResource MapViewOfFile MulDiv MultiByteToWideChar RaiseException ReadFile ResolveDelayLoadedAPI SearchPathW SizeofResource UnmapViewOfFile WideCharToMultiByte WriteFile lstrcmpiW

ntdll

_alldiv _allrem _aulldiv _vsnprintf

BSTR_UserFree BSTR_UserMarshal BSTR_UserSize BSTR_UserUnmarshal BstrFromVector ClearCustData CreateDispTypeInfo CreateErrorInfo CreateStdDispatch CreateTypeLib CreateTypeLib2 DispCallFunc DispGetIDsOfNames DispGetParam DispInvoke DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer DosDateTimeToVariantTime GetActiveObject GetAltMonthNames GetErrorInfo GetRecordInfoFromGuids GetRecordInfoFromTypeInfo GetVarConversionLocaleSetting LHashValOfNameSys LHashValOfNameSysA LPSAFEARRAY_Marshal LPSAFEARRAY_Size LPSAFEARRAY_Unmarshal LPSAFEARRAY_UserFree LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserSize LPSAFEARRAY_UserUnmarshal LoadRegTypeLib LoadTypeLib LoadTypeLibEx OACreateTypeLib2 OaBuildVersion OleCreateFontIndirect OleCreatePictureIndirect OleCreatePropertyFrame OleCreatePropertyFrameIndirect OleIconToCursor OleLoadPicture OleLoadPictureEx OleLoadPictureFile OleLoadPictureFileEx OleLoadPicturePath OleSavePictureFile OleTranslateColor QueryPathOfRegTypeLib RegisterActiveObject RegisterTypeLib RegisterTypeLibForUser RevokeActiveObject SafeArrayAccessData SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayAllocDescriptorEx SafeArrayCopy SafeArrayCopyData SafeArrayCreate SafeArrayCreateEx SafeArrayCreateVector SafeArrayCreateVectorEx SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor SafeArrayGetDim SafeArrayGetElement SafeArrayGetElemsize SafeArrayGetIID SafeArrayGetLBound SafeArrayGetRecordInfo SafeArrayGetUBound SafeArrayGetVartype SafeArrayLock SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayRedim SafeArraySetIID SafeArraySetRecordInfo SafeArrayUnaccessData SafeArrayUnlock SetErrorInfo SetOaNoCache SetVarConversionLocaleSetting SysAllocString SysAllocStringByteLen SysAllocStringLen SysFreeString SysReAllocString SysReAllocStringLen SysStringByteLen SysStringLen SystemTimeToVariantTime UnRegisterTypeLib UnRegisterTypeLibForUser UserBSTR_free_inst UserBSTR_free_local UserBSTR_from_local UserBSTR_to_local UserEXCEPINFO_free_inst UserEXCEPINFO_free_local UserEXCEPINFO_from_local UserEXCEPINFO_to_local UserHWND_free_inst UserHWND_free_local UserHWND_from_local UserHWND_to_local UserMSG_free_inst UserMSG_free_local UserMSG_from_local UserMSG_to_local UserVARIANT_free_inst UserVARIANT_free_local UserVARIANT_from_local UserVARIANT_to_local VARIANT_UserFree VARIANT_UserMarshal VARIANT_UserSize VARIANT_UserUnmarshal VarAbs VarAdd VarAnd VarBoolFromCy VarBoolFromDate VarBoolFromDec VarBoolFromDisp VarBoolFromI1 VarBoolFromI2 VarBoolFromI4 VarBoolFromI8 VarBoolFromR4 VarBoolFromR8 VarBoolFromStr VarBoolFromUI1 VarBoolFromUI2 VarBoolFromUI4 VarBoolFromUI8 VarBstrCat VarBstrCmp VarBstrFromBool VarBstrFromCy VarBstrFromDate VarBstrFromDec VarBstrFromDisp VarBstrFromI1 VarBstrFromI2 VarBstrFromI4 VarBstrFromI8 VarBstrFromR4 VarBstrFromR8 VarBstrFromUI1 VarBstrFromUI2 VarBstrFromUI4 VarBstrFromUI8 VarCat VarCmp VarCyAbs VarCyAdd VarCyCmp VarCyCmpR8 VarCyFix VarCyFromBool VarCyFromDate VarCyFromDec VarCyFromDisp VarCyFromI1 VarCyFromI2 VarCyFromI4 VarCyFromI8 VarCyFromR4 VarCyFromR8 VarCyFromStr VarCyFromUI1 VarCyFromUI2 VarCyFromUI4 VarCyFromUI8 VarCyInt VarCyMul VarCyMulI4 VarCyMulI8 VarCyNeg VarCyRound VarCySub VarDateFromBool VarDateFromCy VarDateFromDec VarDateFromDisp VarDateFromI1 VarDateFromI2 VarDateFromI4 VarDateFromI8 VarDateFromR4 VarDateFromR8 VarDateFromStr VarDateFromUI1 VarDateFromUI2 VarDateFromUI4 VarDateFromUI8 VarDateFromUdate VarDateFromUdateEx VarDecAbs VarDecAdd VarDecCmp VarDecCmpR8 VarDecDiv VarDecFix VarDecFromBool VarDecFromCy VarDecFromDate VarDecFromDisp VarDecFromI1 VarDecFromI2 VarDecFromI4 VarDecFromI8 VarDecFromR4 VarDecFromR8 VarDecFromStr VarDecFromUI1 VarDecFromUI2 VarDecFromUI4 VarDecFromUI8 VarDecInt VarDecMul VarDecNeg VarDecRound VarDecSub VarDiv VarEqv VarFix VarFormat VarFormatCurrency VarFormatDateTime VarFormatFromTokens VarFormatNumber VarFormatPercent VarI1FromBool VarI1FromCy VarI1FromDate VarI1FromDec VarI1FromDisp VarI1FromI2 VarI1FromI4 VarI1FromI8 VarI1FromR4 VarI1FromR8 VarI1FromStr VarI1FromUI1 VarI1FromUI2 VarI1FromUI4 VarI1FromUI8 VarI2FromBool VarI2FromCy VarI2FromDate VarI2FromDec VarI2FromDisp VarI2FromI1 VarI2FromI4 VarI2FromI8 VarI2FromR4 VarI2FromR8 VarI2FromStr VarI2FromUI1 VarI2FromUI2 VarI2FromUI4 VarI2FromUI8 VarI4FromBool VarI4FromCy VarI4FromDate VarI4FromDec VarI4FromDisp VarI4FromI1 VarI4FromI2 VarI4FromI8 VarI4FromR4 VarI4FromR8 VarI4FromStr VarI4FromUI1 VarI4FromUI2 VarI4FromUI4 VarI4FromUI8 VarI8FromBool VarI8FromCy VarI8FromDate VarI8FromDec VarI8FromDisp VarI8FromI1 VarI8FromI2 VarI8FromR4 VarI8FromR8 VarI8FromStr VarI8FromUI1 VarI8FromUI2 VarI8FromUI4 VarI8FromUI8 VarIdiv VarImp VarInt VarMod VarMonthName VarMul VarNeg VarNot VarNumFromParseNum VarOr VarParseNumFromStr VarPow VarR4CmpR8 VarR4FromBool VarR4FromCy VarR4FromDate VarR4FromDec VarR4FromDisp VarR4FromI1 VarR4FromI2 VarR4FromI4 VarR4FromI8 VarR4FromR8 VarR4FromStr VarR4FromUI1 VarR4FromUI2 VarR4FromUI4 VarR4FromUI8 VarR8FromBool VarR8FromCy VarR8FromDate VarR8FromDec VarR8FromDisp VarR8FromI1 VarR8FromI2 VarR8FromI4 VarR8FromI8 VarR8FromR4 VarR8FromStr VarR8FromUI1 VarR8FromUI2 VarR8FromUI4 VarR8FromUI8 VarR8Pow VarR8Round VarRound VarSub VarTokenizeFormatString VarUI1FromBool VarUI1FromCy VarUI1FromDate VarUI1FromDec VarUI1FromDisp VarUI1FromI1 VarUI1FromI2 VarUI1FromI4 VarUI1FromI8 VarUI1FromR4 VarUI1FromR8 VarUI1FromStr VarUI1FromUI2 VarUI1FromUI4 VarUI1FromUI8 VarUI2FromBool VarUI2FromCy VarUI2FromDate VarUI2FromDec VarUI2FromDisp VarUI2FromI1 VarUI2FromI2 VarUI2FromI4 VarUI2FromI8 VarUI2FromR4 VarUI2FromR8 VarUI2FromStr VarUI2FromUI1 VarUI2FromUI4 VarUI2FromUI8 VarUI4FromBool VarUI4FromCy VarUI4FromDate VarUI4FromDec VarUI4FromDisp VarUI4FromI1 VarUI4FromI2 VarUI4FromI4 VarUI4FromI8 VarUI4FromR4 VarUI4FromR8 VarUI4FromStr VarUI4FromUI1 VarUI4FromUI2 VarUI4FromUI8 VarUI8FromBool VarUI8FromCy VarUI8FromDate VarUI8FromDec VarUI8FromDisp VarUI8FromI1 VarUI8FromI2 VarUI8FromI8 VarUI8FromR4 VarUI8FromR8 VarUI8FromStr VarUI8FromUI1 VarUI8FromUI2 VarUI8FromUI4 VarUdateFromDate VarWeekdayName VarXor VariantChangeType VariantChangeTypeEx VariantClear VariantCopy VariantCopyInd VariantInit VariantTimeToDosDateTime VariantTimeToSystemTime VectorFromBstr

Sharing

General

Malware Config

Signatures

File Explorer

a70d64178b5d81dd4b1980f3524f38012bee50213b87b3b1d7be1e88135a7dba

ole32

rpcrt4

user32

gdi32

advapi32

ucrtbase

kernel32

ntdll

generic