5139c42ac3b61d4e92854aa4ce10935d12fcb23f4cdb9df387c762b493593c58

Sharing

Copy URL Twitter E-mail

General

Target
5139c42ac3b61d4e92854aa4ce10935d12fcb23f4cdb9df387c762b493593c58
Size 331KB
Sample261107-qsdy7adv5k
SHA256 5139c42ac3b61d4e92854aa4ce10935d12fcb23f4cdb9df387c762b493593c58
MD5 751e2e0c4483949522e3969607c7ef2e
SHA1 d1ed11001bdeed89bb495d81c83afef50855dd6e
SHA512 a00b2fa634c141e87d45f71e04166a5e16b0b2b0ff68af1e6da5a981ca7dca7d9b9499ee07f6aabfb2ad9655d84348d177ea097e0e61ba348e087d7d00768bbf
SSDEEP 6144:vf6ynPV+pKAdRTHWCTkr/oMsKGGOUqMk1IVs:vyyndEBTWLo9KGGFk1V
TLSH
T15F741B17F3935CFCC127C17883BA9772B432B85803747E6F6A94DB322E64D505B6AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5139c42ac3b61d4e92854aa4ce10935d12fcb23f4cdb9df387c762b493593c58

File Explorer

5139c42ac3b61d4e92854aa4ce10935d12fcb23f4cdb9df387c762b493593c58

.exe 331KB

5139c42ac3b61d4e92854aa4ce10935d12fcb23f4cdb9df387c762b493593c58

IMPHASH fb81a30c26edac41d149b2242b122507
SHA256 5139c42ac3b61d4e92854aa4ce10935d12fcb23f4cdb9df387c762b493593c58
MD5 751e2e0c4483949522e3969607c7ef2e
SHA1 d1ed11001bdeed89bb495d81c83afef50855dd6e
SHA512 a00b2fa634c141e87d45f71e04166a5e16b0b2b0ff68af1e6da5a981ca7dca7d9b9499ee07f6aabfb2ad9655d84348d177ea097e0e61ba348e087d7d00768bbf
SSDEEP 6144:vf6ynPV+pKAdRTHWCTkr/oMsKGGOUqMk1IVs:vyyndEBTWLo9KGGFk1V
TLSH
T15F741B17F3935CFCC127C17883BA9772B432B85803747E6F6A94DB322E64D505B6AA24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid GetUserNameA RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegSetValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDeriveKeyPBKDF2 BCryptDestroyHash BCryptFinishHash BCryptGenRandom BCryptHashData BCryptOpenAlgorithmProvider

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection DeleteDC DeleteObject SelectObject

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipDeleteGraphics GdipDisposeImage GdipDrawImageRectI GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipGetImageGraphicsContext GdipSaveImageToStream GdipSetInterpolationMode GdiplusStartup

kernel32

CloseHandle CreateDirectoryW CreateEventA CreateFileA CreateFileW CreateMutexA CreatePipe CreateProcessW CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FormatMessageA FreeLibrary GetCommandLineW GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileSizeEx GetHandleInformation GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetVersionExW GlobalAlloc GlobalLock GlobalUnlock InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent K32GetProcessMemoryInfo LeaveCriticalSection LoadLibraryW LocalFree MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetHandleInformation SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile lstrcatA

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _exit _fmode _initterm _ismbblead _onexit _read _setjmp _strdup _vscprintf _vsnprintf _wtoi abort atoi calloc exit fprintf fputc fputs free fwrite getenv localeconv longjmp malloc memchr memcmp memcpy memmove memset printf rand realloc signal strchr strcmp strerror strlen strncmp strrchr strtoul towlower vfprintf wcscmp wcslen

ole32

CoInitializeEx CreateStreamOnHGlobal GetHGlobalFromStream

shell32

CommandLineToArgvW

user32

CallNextHookEx CloseClipboard CreateWindowExW DestroyWindow DispatchMessageW EmptyClipboard GetClipboardData GetDC GetForegroundWindow GetKeyboardState GetMessageW GetSystemMetrics GetWindowTextW MessageBoxW OpenClipboard ReleaseDC SendInput SendMessageW SetClipboardData SetWindowsHookExW ToUnicode TranslateMessage UnhookWindowsHookEx

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts WinHttpWebSocketCompleteUpgrade WinHttpWebSocketReceive WinHttpWebSocketSend

ws2_32

WSAStartup closesocket connect freeaddrinfo getaddrinfo gethostname htons inet_ntop inet_pton ioctlsocket recv select send socket

Name

.text

Size

255KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5139c42ac3b61d4e92854aa4ce10935d12fcb23f4cdb9df387c762b493593c58

advapi32

bcrypt

gdi32

gdiplus

kernel32

msvcrt

ole32

shell32

user32

winhttp

ws2_32

generic