eef3a990f0216d07100b8378c5bcfdfb218b1f29aae9f343c30ebb78773daca4

Sharing

Copy URL Twitter E-mail

General

Target
eef3a990f0216d07100b8378c5bcfdfb218b1f29aae9f343c30ebb78773daca4
Size 210KB
Sample261107-ppyzhsfa22
SHA256 eef3a990f0216d07100b8378c5bcfdfb218b1f29aae9f343c30ebb78773daca4
MD5 f84dc7b5fe7b45fb9832f4e12a8a0441
SHA1 9792500ef590c4e30c33ea1f240f90404dec417e
SHA512 fcf9150dfff67541969cc5d8d5e4efdfda8c279239c54bcfab434b46a184ecf9fe4755196f0d9d1d8addecc3685e149443bf2be0e276034bdd35c9ef1e544dd8
SSDEEP 3072:ZJKJZ91iMUaSKV2arTx+vyjh0YTcEKoMUx/7mU4IMusLadlffJM7h:ZJKyySKVRrTswrEozNmUdO7h
TLSH
T13A247C19B3E118FAECA79239C9938606E7727C110760DBDF03A04666EF2B7E1523E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eef3a990f0216d07100b8378c5bcfdfb218b1f29aae9f343c30ebb78773daca4

File Explorer

eef3a990f0216d07100b8378c5bcfdfb218b1f29aae9f343c30ebb78773daca4

.dll 210KB

eef3a990f0216d07100b8378c5bcfdfb218b1f29aae9f343c30ebb78773daca4

IMPHASH 9141f9c4efc03350d17b08713152faff
SHA256 eef3a990f0216d07100b8378c5bcfdfb218b1f29aae9f343c30ebb78773daca4
MD5 f84dc7b5fe7b45fb9832f4e12a8a0441
SHA1 9792500ef590c4e30c33ea1f240f90404dec417e
SHA512 fcf9150dfff67541969cc5d8d5e4efdfda8c279239c54bcfab434b46a184ecf9fe4755196f0d9d1d8addecc3685e149443bf2be0e276034bdd35c9ef1e544dd8
SSDEEP 3072:ZJKJZ91iMUaSKV2arTx+vyjh0YTcEKoMUx/7mU4IMusLadlffJM7h:ZJKyySKVRrTswrEozNmUdO7h
TLSH
T13A247C19B3E118FAECA79239C9938606E7727C110760DBDF03A04666EF2B7E1523E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ole32

ReleaseStgMedium OleGetClipboard OleUninitialize CreateStreamOnHGlobal OleInitialize

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

gdi32

CreateDIBitmap

user32

DispatchMessageW wsprintfW DefWindowProcW PostQuitMessage GetMessageW CreateWindowExW DestroyWindow OpenClipboard CloseClipboard TranslateMessage RegisterClassExW GetClipboardSequenceNumber ReleaseDC GetDC KillTimer SetTimer RemoveClipboardFormatListener AddClipboardFormatListener IsClipboardFormatAvailable RegisterClipboardFormatW GetClipboardData

shell32

DragQueryFileW

gdiplus

GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdipDisposeImage GdiplusShutdown

iphlpapi

GetAdaptersInfo

kernel32

ReadConsoleW HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetStringTypeW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW SetEndOfFile GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW WriteConsoleW GetTimeZoneInformation SetFilePointerEx LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle HeapAlloc HeapFree GetModuleFileNameW GetModuleHandleExW ExitProcess RtlPcToFileHeader FindClose GetTempFileNameW CreateFileA WriteFile GetTempPathA OutputDebugStringA CloseHandle Sleep GetCurrentProcessId CreateThread DisableThreadLibraryCalls SearchPathW CreateFileW DeleteFileW GetFileAttributesW GetFileSizeEx GetFileTime GetFullPathNameW ReadFile GetTempPathW GetLastError GetTickCount GetTickCount64 GetModuleHandleW GlobalSize GlobalUnlock GlobalLock WideCharToMultiByte GetComputerNameExA MultiByteToWideChar RtlUnwind RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW LoadLibraryExW RtlUnwindEx InterlockedFlushSList SetLastError EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress

Name

.text

Size

144KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

eef3a990f0216d07100b8378c5bcfdfb218b1f29aae9f343c30ebb78773daca4

ole32

winhttp

gdi32

user32

shell32

gdiplus

iphlpapi

kernel32

generic