a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0

Sharing

Copy URL Twitter E-mail

General

Target
a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0
Size 1.1MB
Sample261107-tyf8aads51
SHA256 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0
MD5 c9dc60dc03a86a75661648ce098749af
SHA1 4962ad518f10fd33d0705a5cc832222c304180cd
SHA512 55f86587e53689f23da1a610ba83c27bd0e36fc62a716456906f092cde278e014e0a65cacf9b552b6857a9f7b15f089358ce5fd32e18d2eb37ea9fc037df8472
SSDEEP 24576:VzlkVX0Sg8tOtL1tdHr0SqUpppp+wiVkPnvggY0c:Vz6VX0Sg8tOtJtdHVbs
TLSH
T158352B13E2E60198E1B7F6748AB566319537BC544934EA5E138CCA6A1F63F80CE39733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0

File Explorer

a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0

.exe 1.1MB

a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0

IMPHASH 9ee481c681541495f161d1434d3eb088
SHA256 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0
MD5 c9dc60dc03a86a75661648ce098749af
SHA1 4962ad518f10fd33d0705a5cc832222c304180cd
SHA512 55f86587e53689f23da1a610ba83c27bd0e36fc62a716456906f092cde278e014e0a65cacf9b552b6857a9f7b15f089358ce5fd32e18d2eb37ea9fc037df8472
SSDEEP 24576:VzlkVX0Sg8tOtL1tdHr0SqUpppp+wiVkPnvggY0c:Vz6VX0Sg8tOtJtdHVbs
TLSH
T158352B13E2E60198E1B7F6748AB566319537BC544934EA5E138CCA6A1F63F80CE39733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges InitiateSystemShutdownExW LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

DefSubclassProc InitCommonControlsEx SetWindowSubclass

comdlg32

GetOpenFileNameW

crypt32

CertCloseStore CertCreateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext CertGetCertificateContextProperty CertNameToStrW CryptQueryObject

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontW CreatePen CreateRectRgn CreateRoundRectRgn CreateSolidBrush DeleteDC DeleteObject Ellipse ExtCreateRegion GetDeviceCaps GetStockObject GetTextExtentPoint32W GetTextMetricsW LineTo MoveToEx SelectObject SetBkColor SetBkMode SetTextColor

gdiplus

GdipAddPathArc GdipAddPathRectangle GdipAlloc GdipCloneBrush GdipCloneImage GdipClosePathFigure GdipCreateBitmapFromScan0 GdipCreateFont GdipCreateFontFamilyFromName GdipCreateFromHDC GdipCreateLineBrushFromRect GdipCreatePath GdipCreatePen1 GdipCreateSolidFill GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipDeleteFontFamily GdipDeleteGraphics GdipDeletePath GdipDeletePen GdipDeleteStringFormat GdipDisposeImage GdipDrawLine GdipDrawString GdipFillEllipse GdipFillPath GdipFillRectangle GdipFlush GdipFree GdipGetImageGraphicsContext GdipResetClip GdipSetClipPath GdipSetPathFillMode GdipSetPenEndCap GdipSetPenStartCap GdipSetPixelOffsetMode GdipSetSmoothingMode GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetTextRenderingHint GdipStartPathFigure GdiplusShutdown GdiplusStartup

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateEventA CreateFileMappingW CreateFileW CreateMutexW CreatePipe CreateProcessW CreateSemaphoreA CreateToolhelp32Snapshot DefineDosDeviceW DeleteCriticalSection DeleteFileW DeleteVolumeMountPointW DeviceIoControl DuplicateHandle EnterCriticalSection FileTimeToSystemTime FindClose FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindResourceW FindVolumeClose FormatMessageA GetCPInfo GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileSize GetFileSizeEx GetFileTime GetFirmwareEnvironmentVariableW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GetVolumeInformationW GlobalAlloc GlobalLock GlobalUnlock InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile MulDiv MultiByteToWideChar OpenProcess OutputDebugStringA PeekNamedPipe Process32FirstW Process32NextW QueryDosDeviceW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseMutex ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetFileAttributesW SetHandleInformation SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetVolumeMountPointW SizeofResource Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW

msvcrt

fwprintf _assert __C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _initterm _setjmp _setmode _snwprintf _stricmp _vscprintf _vsnprintf _vsnwprintf _wcsicmp _wcsnicmp _wcstoi64 _wtoi abort atexit calloc exit fflush fprintf fputwc free getenv iswalnum iswalpha iswdigit iswspace localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc setvbuf signal strchr strcmp strerror strlen strncmp strtoul towlower towupper vfprintf wcscmp wcscpy wcslen wcsstr _strdup _read _fileno

ole32

CoInitializeEx CoUninitialize

shell32

CommandLineToArgvW SHChangeNotify ShellExecuteW

user32

AppendMenuW BeginPaint BringWindowToTop CloseClipboard CreatePopupMenu CreateWindowExW DefWindowProcW DestroyMenu DestroyWindow DispatchMessageW DrawTextW EmptyClipboard EnableWindow EndPaint EnumWindows ExitWindowsEx FillRect FindWindowW FrameRect GetClassNameW GetClientRect GetCursorPos GetDC GetDlgCtrlID GetDlgItem GetForegroundWindow GetMessageW GetPropW GetSystemMetrics GetWindowDC GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRect IsIconic IsWindow IsWindowVisible KillTimer LoadCursorW LoadIconW MessageBoxW OpenClipboard PeekMessageW PostMessageW PostQuitMessage PtInRect RedrawWindow RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SendMessageW SetClipboardData SetCursor SetFocus SetForegroundWindow SetPropW SetTimer SetWindowPos SetWindowRgn SetWindowTextW ShowWindow SystemParametersInfoW TrackMouseEvent TrackPopupMenu TranslateMessage UpdateLayeredWindow UpdateWindow

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

499KB

Virtual Size

499KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

525KB

Virtual Size

525KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0

advapi32

comctl32

comdlg32

crypt32

gdi32

gdiplus

kernel32

msvcrt

ole32

shell32

user32

version

generic