11e2e00218d2af4e5f1b0ec0c3da459e862dfac5de11c379ad081585867b919a

Sharing

Copy URL Twitter E-mail

General

Target
11e2e00218d2af4e5f1b0ec0c3da459e862dfac5de11c379ad081585867b919a
Size 1.0MB
Sample261107-nmsjaacw9j
SHA256 11e2e00218d2af4e5f1b0ec0c3da459e862dfac5de11c379ad081585867b919a
MD5 e068ebd9e7fb33cb72346c6ddd98bae9
SHA1 44a52b5a6aa5827fba9154b3152d84953d99698c
SHA512 0d71721de82d2d890dfdb5eb10ef1d2541e6b5799d091d6fe7235133ba29e7fa7b72538f5977ddd64ac231cda74b903d37c582d93727a3a95dde1564f94ec983
SSDEEP 12288:SQjci8RgKFINTWR9SQm8K1O6pdA7/HmzGe3bkc+0ZBp0pKMvpdQU6o9k7tUZw8:fygN89SOSdA7vmZ5L0pT7k7yw8
TLSH
T162354A9BE3E951ECE86BD77186766231FD317CA94730D9CF03A097142E20AE08A7DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11e2e00218d2af4e5f1b0ec0c3da459e862dfac5de11c379ad081585867b919a

File Explorer

11e2e00218d2af4e5f1b0ec0c3da459e862dfac5de11c379ad081585867b919a

.exe 1.0MB

11e2e00218d2af4e5f1b0ec0c3da459e862dfac5de11c379ad081585867b919a

IMPHASH 5d5931ed1bc620997cc61263082d083f
SHA256 11e2e00218d2af4e5f1b0ec0c3da459e862dfac5de11c379ad081585867b919a
MD5 e068ebd9e7fb33cb72346c6ddd98bae9
SHA1 44a52b5a6aa5827fba9154b3152d84953d99698c
SHA512 0d71721de82d2d890dfdb5eb10ef1d2541e6b5799d091d6fe7235133ba29e7fa7b72538f5977ddd64ac231cda74b903d37c582d93727a3a95dde1564f94ec983
SSDEEP 12288:SQjci8RgKFINTWR9SQm8K1O6pdA7/HmzGe3bkc+0ZBp0pKMvpdQU6o9k7tUZw8:fygN89SOSdA7vmZ5L0pT7k7yw8
TLSH
T162354A9BE3E951ECE86BD77186766231FD317CA94730D9CF03A097142E20AE08A7DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

634704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership CreateWellKnownSid EnumDynamicTimeZoneInformation FreeSid GetUserNameW LookupAccountSidW LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegGetValueW RegLoadKeyW RegLoadMUIStringW RegOpenKeyExW RegQueryValueExW RegSaveKeyExW RegSetKeyValueW RegSetValueExW RegUnLoadKeyW

user32

AppendMenuW BeginDeferWindowPos BeginPaint ChangeDisplaySettingsExW CharLowerBuffW CharLowerW ClientToScreen CloseClipboard CreateIconIndirect CreatePopupMenu CreateWindowExW DefWindowProcW DeferWindowPos DestroyIcon DestroyMenu DestroyWindow DialogBoxIndirectParamW DispatchMessageW DrawFocusRect DrawIconEx DrawTextW EmptyClipboard EnableWindow EndDeferWindowPos EndDialog EndPaint EnumDisplayDevicesW EnumDisplaySettingsExW EnumWindows ExitWindowsEx FillRect FindWindowExW FindWindowW GetCaretBlinkTime GetClassInfoExW GetClientRect GetCursorPos GetDC GetDlgItem GetDlgItemTextW GetDoubleClickTime GetDpiForSystem GetDpiForWindow GetFocus GetKeyState GetMessageW GetMonitorInfoW GetPropW GetScrollInfo GetSysColor GetSystemMetrics GetSystemMetricsForDpi GetWindow GetWindowLongPtrW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InflateRect IntersectRect InvalidateRect IsDialogMessageW IsIconic IsRectEmpty IsZoomed KillTimer LoadCursorW LoadKeyboardLayoutW LoadStringW LockWorkStation MonitorFromWindow MoveWindow OffsetRect OpenClipboard PostMessageW PostQuitMessage PtInRect RedrawWindow RegisterClassExW RegisterClassW ReleaseDC ScreenToClient SendDlgItemMessageW SendMessageTimeoutW SendMessageW SetCaretBlinkTime SetClipboardData SetDlgItemTextW SetFocus SetForegroundWindow SetProcessDpiAwarenessContext SetRect SetRectEmpty SetScrollInfo SetSysColors SetTimer SetWindowLongPtrW SetWindowPos SetWindowRgn SetWindowTextW ShowWindow SwapMouseButton SystemParametersInfoW TrackMouseEvent TrackPopupMenuEx TranslateMessage UnloadKeyboardLayout UpdateWindow WindowFromDC

gdi32

AddFontResourceW BitBlt CreateBitmap CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreateFontW CreateRectRgn CreateRectRgnIndirect CreateSolidBrush DeleteDC DeleteObject EnumFontFamiliesExW GdiFlush GetClipBox GetCurrentObject GetObjectW GetTextExtentPoint32W GetTextMetricsW LPtoDP SelectClipRgn SelectObject SetBkColor SetBkMode SetTextColor

gdiplus

GdipAddPathArc GdipAddPathBezier GdipAddPathLine GdipAddPathRectangle GdipAlloc GdipBitmapLockBits GdipBitmapUnlockBits GdipClosePathFigure GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipCreatePath GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipDeleteGraphics GdipDeletePath GdipDeletePen GdipDisposeImage GdipDrawPath GdipFillEllipse GdipFillPath GdipFlush GdipFree GdipGetImageGraphicsContext GdipGraphicsClear GdipResetClip GdipRestoreGraphics GdipSaveGraphics GdipScaleWorldTransform GdipSetClipRectI GdipSetPixelOffsetMode GdipSetSmoothingMode GdipStartPathFigure GdipTranslateWorldTransform GdiplusShutdown GdiplusStartup

shell32

CommandLineToArgvW ExtractIconExW SHAddToRecentDocs SHAppBarMessage SHCreateDirectoryExW SHCreateItemFromParsingName SHEmptyRecycleBinW SHGetFolderPathW SHOpenWithDialog SHQueryRecycleBinW ShellExecuteW StrChrW StrCmpNIW StrStrIW

shlwapi

AssocQueryStringW PathFindExtensionW PathFindFileNameW PathParseIconLocationW PathRemoveBackslashW PathUnquoteSpacesW StrFormatByteSizeW StrTrimW

comctl32

ord413 ImageList_Create ImageList_Destroy ImageList_Draw ImageList_ReplaceIcon InitCommonControlsEx ord412 ord410 ord345

comdlg32

GetOpenFileNameW GetSaveFileNameW

uxtheme

IsAppThemed IsThemeActive ord65 SetWindowTheme

ole32

CLSIDFromString CoCreateGuid CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize PropVariantClear StringFromGUID2

secur32

GetUserNameExW

netapi32

NetApiBufferFree NetLocalGroupAddMembers NetLocalGroupDelMembers NetUserAdd NetUserChangePassword NetUserDel NetUserEnum NetUserGetInfo NetUserGetLocalGroups NetUserSetInfo

samlib

SamCloseHandle SamConnect SamFreeMemory SamLookupDomainInSamServer SamLookupNamesInDomain SamOpenDomain SamOpenUser SamQueryInformationUser SamSetInformationUser

powrprof

PowerEnumerate PowerGetActiveScheme PowerReadACValueIndex PowerReadDCValueIndex PowerReadFriendlyName PowerSetActiveScheme PowerWriteACValueIndex PowerWriteDCValueIndex

wlanapi

WlanCloseHandle WlanConnect WlanDeleteProfile WlanDisconnect WlanEnumInterfaces WlanFreeMemory WlanGetAvailableNetworkList WlanGetProfileList WlanOpenHandle WlanQueryInterface WlanRegisterNotification WlanScan WlanSetInterface WlanSetProfile

iphlpapi

CancelMibChangeNotify2 GetAdaptersAddresses NotifyIpInterfaceChange NotifyUnicastIpAddressChange

ws2_32

InetNtopW InetPtonW

wininet

InternetQueryOptionW InternetSetOptionW

bluetoothapis

BluetoothAuthenticateDeviceEx BluetoothEnableDiscovery BluetoothEnableIncomingConnections BluetoothFindDeviceClose BluetoothFindFirstDevice BluetoothFindFirstRadio BluetoothFindNextDevice BluetoothFindRadioClose BluetoothGetRadioInfo BluetoothIsConnectable BluetoothIsDiscoverable BluetoothRegisterForAuthenticationEx BluetoothRemoveDevice BluetoothSendAuthenticationResponseEx BluetoothUnregisterAuthentication

setupapi

CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Status CM_Locate_DevNodeW SetupDiCallClassInstaller SetupDiCreateDeviceInfoList SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDescriptionW SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiLoadClassIcon SetupDiOpenDevRegKey SetupDiOpenDeviceInfoW SetupDiSetClassInstallParamsW

cfgmgr32

CM_Register_Notification CM_Unregister_Notification

winspool.drv

ClosePrinter DeletePrinter EnumPrintersW GetDefaultPrinterW OpenPrinterW SetDefaultPrinterW

winmm

joyGetDevCapsW joyGetNumDevs joyGetPosEx

msvcrt

__C_specific_handler __iob_func __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _aligned_free _aligned_malloc _amsg_exit _cexit _fpreset _initterm _iob _lock _onexit _unlock _vsnwprintf _wassert _wcmdln _wtoi abort atof calloc exit fflush free fwrite getenv malloc memchr memcmp memcpy memmove memset realloc signal strcmp strlen strncmp strnlen strstr swscanf vfprintf wcscmp wcslen wcsnlen wcstoul

kernel32

AcquireSRWLockExclusive CloseHandle CopyFileW CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeviceIoControl EnterCriticalSection EnumDateFormatsExEx EnumSystemGeoID EnumTimeFormatsEx ExpandEnvironmentStringsW FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FindResourceW FormatMessageW FreeLibrary GetCommandLineW GetComputerNameExW GetComputerNameW GetCurrencyFormatW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatEx GetDiskFreeSpaceExW GetDriveTypeW GetDynamicTimeZoneInformation GetFileAttributesExW GetFileAttributesW GetGeoInfoW GetLastError GetLocalTime GetLocaleInfoEx GetLogicalDriveStringsW GetLogicalDrives GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetPhysicallyInstalledSystemMemory GetProcAddress GetProcessHeap GetStartupInfoW GetSystemDirectoryW GetSystemPowerStatus GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetTickCount GetTickCount64 GetTimeFormatEx GetUserDefaultUILanguage GetUserGeoID GetVolumeInformationW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection LCIDToLocaleName LeaveCriticalSection LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource MulDiv MultiByteToWideChar OpenProcess OutputDebugStringW Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive RemoveDirectoryW RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetComputerNameExW SetDynamicTimeZoneInformation SetFileAttributesW SetLocalTime SetLocaleInfoW SetUnhandledExceptionFilter SetUserGeoID SizeofResource Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte WriteFile lstrcmpW lstrcmpiW lstrlenW

ntdll

NtDeleteKey RtlNtStatusToDosError

dwmapi

DwmDefWindowProc DwmExtendFrameIntoClientArea DwmGetWindowAttribute DwmIsCompositionEnabled DwmSetWindowAttribute

ucrtbase

__stdio_common_vfprintf __stdio_common_vsprintf

Name

.text

Size

628KB

Virtual Size

627KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

242KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symz

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

11e2e00218d2af4e5f1b0ec0c3da459e862dfac5de11c379ad081585867b919a

advapi32

user32

gdi32

gdiplus

shell32

shlwapi

comctl32

comdlg32

uxtheme

ole32

secur32

netapi32

samlib

powrprof

wlanapi

iphlpapi

ws2_32

wininet

bluetoothapis

setupapi

cfgmgr32

winspool.drv

winmm

msvcrt

kernel32

ntdll

dwmapi

ucrtbase

generic