3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6

Sharing

Copy URL Twitter E-mail

General

Target
3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6
Size 1.9MB
Sample261104-2dgmbady4t
SHA256 3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6
MD5 90c90c86ed73f8ca244b0dcd8c1cba26
SHA1 6eb9df60f4593bc7c4990c43d0da3818efef5b54
SHA512 6d6725cd782eea9908dd50f981ddbe253c04ce55afeb6b0f1dbf330b2f8ccd989176c0e483b8065c7bd12c86c58b6e2d5b1e8711f3e1c23556e2dfc28f25214b
SSDEEP 49152:GmqeUa1gllIIWJ2QEZ8ypUfkptVxsCAp:GTRug7fpUu5sC
TLSH
T1D2957C12BAD99032F1B317319DB983199674B8A6873685DFB2CC524E5F709C18B36F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6

File Explorer

3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6

.exe 1.9MB

3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6

IMPHASH d864ba0d1494d04a5dbf75624d6a0ad8
SHA256 3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6
MD5 90c90c86ed73f8ca244b0dcd8c1cba26
SHA1 6eb9df60f4593bc7c4990c43d0da3818efef5b54
SHA512 6d6725cd782eea9908dd50f981ddbe253c04ce55afeb6b0f1dbf330b2f8ccd989176c0e483b8065c7bd12c86c58b6e2d5b1e8711f3e1c23556e2dfc28f25214b
SSDEEP 49152:GmqeUa1gllIIWJ2QEZ8ypUfkptVxsCAp:GTRug7fpUu5sC
TLSH
T1D2957C12BAD99032F1B317319DB983199674B8A6873685DFB2CC524E5F709C18B36F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

510356

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoGetClassObject CoCreateInstance CLSIDFromString CoCreateGuid IIDFromString CoInitialize CoUninitialize OleRun OleSetContainedObject OleLockRunning OleUninitialize OleInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CreateStreamOnHGlobal

shell32

FindExecutableA SHGetFolderPathW CommandLineToArgvW SHGetPathFromIDListA SHGetFolderLocation SHGetFolderPathA SHBrowseForFolderA

wininet

InternetErrorDlg InternetConnectA InternetCrackUrlA InternetOpenA InternetCloseHandle HttpSendRequestA InternetReadFile HttpOpenRequestA HttpQueryInfoA

user32

DrawTextW GetWindowThreadProcessId SetRect GetAncestor PostQuitMessage DispatchMessageA TranslateMessage GetMessageA SetWindowLongW GetWindowLongW AdjustWindowRectEx EnableMenuItem GetSystemMenu ShowWindow CreateWindowExW GetClassInfoExW RegisterClassExW DefWindowProcW GetTopWindow SetWindowTextW KillTimer SetTimer PostMessageA MapDialogRect PtInRect GetCursorPos SetCursor SetWindowContextHelpId GetWindowRect MapWindowPoints EnableWindow GetDlgCtrlID EndDialog IsWindowUnicode MessageBoxW GetMessageW DispatchMessageW PeekMessageA GetDC GetWindowTextW LoadCursorA GetWindow GetClassNameA GetParent GetDesktopWindow SetWindowLongA GetWindowLongA FillRect GetSysColor ScreenToClient ClientToScreen MessageBoxA GetClientRect GetWindowTextLengthA GetWindowTextA SetWindowTextA RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC DestroyAcceleratorTable CreateAcceleratorTableA ReleaseCapture SetForegroundWindow LoadStringA wsprintfA RegisterWindowMessageA SendMessageA DefWindowProcA CallWindowProcA UnregisterClassA RegisterClassExA GetClassInfoExA CreateWindowExA IsWindow IsChild DestroyWindow MoveWindow SetWindowPos DialogBoxIndirectParamA GetDlgItem CharNextA SetFocus GetActiveWindow GetFocus SetCapture MsgWaitForMultipleObjectsEx

urlmon

IsValidURL

comctl32

InitCommonControlsEx

wintrust

WinVerifyTrust

kernel32

RtlUnwind GetSystemTimeAsFileTime GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo TlsAlloc GetStringTypeW TlsSetValue SetStdHandle TlsFree GetSystemInfo VirtualProtect VirtualQuery LCMapStringEx TlsGetValue GetStdHandle GetFileType GetModuleFileNameW WriteConsoleW GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime GetConsoleOutputCP GetConsoleMode CreateThread ExitThread FreeLibraryAndExitThread VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetProcessHeap HeapFree HeapAlloc EncodePointer InitializeCriticalSection CreateFileW DeleteFileW HeapSize HeapReAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetFileSizeEx ReadConsoleW GetCurrentDirectoryW GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFullPathNameW CreateDirectoryW IsDebuggerPresent GetCurrentProcess GetCommandLineA GetCommandLineW DecodePointer RaiseException GetLastError SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentThreadId FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryExA LoadResource LockResource SizeofResource GlobalAlloc GlobalUnlock GlobalLock GlobalHandle GlobalFree MulDiv lstrcmpA lstrcmpiA lstrcpyA FindResourceA SetDllDirectoryA MultiByteToWideChar WideCharToMultiByte IsDBCSLeadByte FindResourceW LocalFree CreateFileA DeleteFileA ReadFile CloseHandle lstrcpynA lstrlenA lstrcatA CreateDirectoryA WriteFile GetSystemDirectoryA MoveFileA GetDiskFreeSpaceA GetDiskFreeSpaceExA LocalAlloc FormatMessageA Sleep ExitProcess GetUserDefaultLCID SetEvent CreateEventA FileTimeToSystemTime SystemTimeToFileTime GetCurrentProcessId GetLocalTime FormatMessageW FindClose FindFirstFileA FindNextFileA GetDriveTypeA GetFileAttributesA RemoveDirectoryA SetFileAttributesA InitializeCriticalSectionEx GetTickCount MoveFileExA GetLocaleInfoA GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage QueryPerformanceCounter QueryPerformanceFrequency FlushFileBuffers SetEndOfFile SetFilePointerEx GetEnvironmentVariableA GetTempPathA GetWindowsDirectoryA GetLogicalProcessorInformation GetNativeSystemInfo GetSystemWow64DirectoryA GetModuleHandleExW WaitForSingleObject LoadLibraryExW OpenMutexA GetSystemTime OpenThread GetExitCodeThread SetHandleInformation CreatePipe PeekNamedPipe TerminateProcess GetExitCodeProcess CreateProcessA GetProcessId MapViewOfFile FlushViewOfFile UnmapViewOfFile CreateFileMappingA OpenFileMappingA GetModuleHandleExA LoadLibraryW ReleaseMutex CreateMutexA OutputDebugStringW

advapi32

RegCloseKey RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegOpenKeyExA RegQueryInfoKeyW RegSetValueExA CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegEnumKeyA RegQueryValueExA RegEnumValueA OpenProcessToken CopySid GetTokenInformation ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyExA

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantInit VariantClear VarUI4FromStr LoadTypeLi LoadRegTypeLi OleCreateFontIndirect VariantCopy VariantChangeType SysStringByteLen SysAllocStringByteLen GetErrorInfo

shlwapi

SHDeleteKeyA PathIsDirectoryEmptyA PathAppendA ord12

gdi32

DeleteObject GetDeviceCaps DeleteDC SelectObject GetObjectA SetBkMode SetTextColor CreateFontIndirectA CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap BitBlt GetStockObject

iphlpapi

GetAdaptersAddresses

crypt32

CryptUnprotectData CryptProtectData CryptBinaryToStringA CryptStringToBinaryA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueW

msi

ord117 ord189 ord67 ord168 ord137 ord141 ord8 ord31 ord159 ord160 ord91 ord115 ord204 ord87 ord44

Name

.text

Size

724KB

Virtual Size

723KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

244KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

947KB

Virtual Size

946KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6

ole32

shell32

wininet

user32

urlmon

comctl32

wintrust

kernel32

advapi32

oleaut32

shlwapi

gdi32

iphlpapi

crypt32

version

msi

generic