ecf24eb25849cfe8f56c346367a2b8aafa0eeae7234f98f38e74e2b796c8f785

Sharing

Copy URL Twitter E-mail

General

Target
ecf24eb25849cfe8f56c346367a2b8aafa0eeae7234f98f38e74e2b796c8f785
Size 1.2MB
Sample261102-x6ldrayy9m
SHA256 ecf24eb25849cfe8f56c346367a2b8aafa0eeae7234f98f38e74e2b796c8f785
MD5 d5e50ebdce526d7b335d4b5e05678276
SHA1 634f0f590b3094425ef6cfad86042fa977a66954
SHA512 e9994586523622e53d67d81044101d274e4b2ff7349048aceb8c455109491aa6bf896b776553ae9c502bd9cd48a875539f11af3c4c7f066a3b7e3fd00eae5a6c
SSDEEP 12288:4rwnJ0oc6RscaXAE+3V4VLLOL7rEpMuBwk+Y7P0Vu2JdQVwgr6wVMEVbbub5bYbK:4rwnJ44spp+lIuPrEpNwk+2Pwur
TLSH
T15D55E90163F91759F5F38FB86A7A6A164836BC6ADF11C6DF1251A40E0C32BD489B0B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ecf24eb25849cfe8f56c346367a2b8aafa0eeae7234f98f38e74e2b796c8f785

File Explorer

ecf24eb25849cfe8f56c346367a2b8aafa0eeae7234f98f38e74e2b796c8f785

.dll 1.2MB

ecf24eb25849cfe8f56c346367a2b8aafa0eeae7234f98f38e74e2b796c8f785

IMPHASH 650e0fa6148b774cfadb8f6621a6d67f
SHA256 ecf24eb25849cfe8f56c346367a2b8aafa0eeae7234f98f38e74e2b796c8f785
MD5 d5e50ebdce526d7b335d4b5e05678276
SHA1 634f0f590b3094425ef6cfad86042fa977a66954
SHA512 e9994586523622e53d67d81044101d274e4b2ff7349048aceb8c455109491aa6bf896b776553ae9c502bd9cd48a875539f11af3c4c7f066a3b7e3fd00eae5a6c
SSDEEP 12288:4rwnJ0oc6RscaXAE+3V4VLLOL7rEpMuBwk+Y7P0Vu2JdQVwgr6wVMEVbbub5bYbK:4rwnJ44spp+lIuPrEpNwk+2Pwur
TLSH
T15D55E90163F91759F5F38FB86A7A6A164836BC6ADF11C6DF1251A40E0C32BD489B0B37
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

410660

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\sally\sally\build\out\sally\Release_x64\plugins\webviewer\webviewer.pdb

comctl32

ord412 ord410 ord413

kernel32

GetLastError WideCharToMultiByte GetFileAttributesW CreateFileW OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree LoadLibraryExW FreeLibrary SetLastError InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent GetOEMCP WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection CreateEventW EnterCriticalSection CloseHandle GetExitCodeThread IsValidCodePage GetACP GetModuleFileNameW LeaveCriticalSection GlobalDeleteAtom GlobalAddAtomW GetProcAddress LoadLibraryW GetModuleHandleW GetEnvironmentVariableW ResumeThread CreateThread SetEvent Sleep GetTickCount TerminateThread WaitForSingleObject SleepConditionVariableSRW

user32

GetWindowLongPtrW IsWindow GetClassNameW MapWindowPoints GetClientRect RemovePropW GetPropW SetPropW DefWindowProcW PostQuitMessage CheckMenuRadioItem SetMenu AppendMenuW CreatePopupMenu CreateMenu UnregisterClassW RegisterClassW LoadCursorW GetMessageW UpdateWindow SetForegroundWindow ShowWindow LoadIconW MoveWindow SetWindowTextW CreateWindowExW DestroyWindow DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjectsEx GetKeyState PostMessageW GetDC MessageBoxW DrawTextW GetFocus EnumChildWindows GetSysColor SendMessageW InvalidateRect GetSystemMetrics SystemParametersInfoW FillRect IsWindowEnabled GetComboBoxInfo SetWindowPos EndPaint BeginPaint GetWindowLongW ReleaseDC OffsetRect GetWindowDC FrameRect GetWindowRect

gdi32

SelectObject GetStockObject SetDCBrushColor SetDCPenColor Polygon SaveDC ExcludeClipRect MoveToEx LineTo RestoreDC DeleteObject SetBkColor SetTextColor SetBkMode GetDeviceCaps CreateSolidBrush

shell32

SHGetKnownFolderPath

ole32

OleInitialize OleUninitialize CoTaskMemAlloc CoTaskMemFree

advapi32

RegGetValueW RegOpenKeyExW RegQueryValueExW EventUnregister EventWriteTransfer EventSetInformation EventRegister RegCloseKey

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?_Xlength_error@std@@YAXPEBD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

dwmapi

DwmSetWindowAttribute

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __current_exception __current_exception_context _CxxThrowException __std_type_info_destroy_list memset memchr __C_specific_handler strstr _purecall __std_exception_destroy __std_exception_copy strchr __std_terminate wcsrchr memmove memcpy

api-ms-win-crt-runtime-l1-1-0

_crt_at_quick_exit abort terminate _invoke_watson _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _initterm_e _execute_onexit_table _crt_atexit _register_onexit_function _cexit _initterm

api-ms-win-crt-string-l1-1-0

strcmp _strnicmp strncmp wcscmp wcslen _wcsicmp tolower

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __acrt_iob_func fread __stdio_common_vfprintf __stdio_common_vswprintf _wfopen fclose __stdio_common_vsnwprintf_s __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

malloc free realloc calloc _callnewh

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-utility-l1-1-0

bsearch qsort

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

Sharing

General

Malware Config

Signatures

File Explorer

ecf24eb25849cfe8f56c346367a2b8aafa0eeae7234f98f38e74e2b796c8f785

comctl32

kernel32

user32

gdi32

shell32

ole32

advapi32

msvcp140

dwmapi

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic