26097ba3ec5aea2c0752214b8cde80b065b7775624d5be7023560e8f1beea7b0

Sharing

Copy URL Twitter E-mail

General

Target
26097ba3ec5aea2c0752214b8cde80b065b7775624d5be7023560e8f1beea7b0
Size 380KB
Sample261110-endbbagt6s
SHA256 26097ba3ec5aea2c0752214b8cde80b065b7775624d5be7023560e8f1beea7b0
MD5 bafdf257538074e78d8ed999f30f2041
SHA1 1b84e2c9e7c5714119d50fa59d0e5c3e9f6705e1
SHA512 5932e06890e2dbcf87abe211fb97087e01660f3ffcbec3639c838eb63748b3c792239a84731198ba5ad31e6a1e85f9353855d6a3b3b8bc0b3a49e2560bcb1914
SSDEEP 6144:Jq+N1uNUQxkd8rJ9ZxI6K47YmJefq0pc5mK9bS5sxPuvkWaEu/92ropwSNAYqMeE:4W1wdZx1KcYmJefWmk3PuvkWg/sopwCg
TLSH
T114844A26BBB430F9D66ED0F8A5939407FAB278454335E5CB03E04AD51E23AD05E3AD1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26097ba3ec5aea2c0752214b8cde80b065b7775624d5be7023560e8f1beea7b0

File Explorer

26097ba3ec5aea2c0752214b8cde80b065b7775624d5be7023560e8f1beea7b0

.exe 380KB

26097ba3ec5aea2c0752214b8cde80b065b7775624d5be7023560e8f1beea7b0

IMPHASH 8fe5245e6c9e0f6bca3d5becad21cb5c
SHA256 26097ba3ec5aea2c0752214b8cde80b065b7775624d5be7023560e8f1beea7b0
MD5 bafdf257538074e78d8ed999f30f2041
SHA1 1b84e2c9e7c5714119d50fa59d0e5c3e9f6705e1
SHA512 5932e06890e2dbcf87abe211fb97087e01660f3ffcbec3639c838eb63748b3c792239a84731198ba5ad31e6a1e85f9353855d6a3b3b8bc0b3a49e2560bcb1914
SSDEEP 6144:Jq+N1uNUQxkd8rJ9ZxI6K47YmJefq0pc5mK9bS5sxPuvkWaEu/92ropwSNAYqMeE:4W1wdZx1KcYmJefWmk3PuvkWg/sopwCg
TLSH
T114844A26BBB430F9D66ED0F8A5939407FAB278454335E5CB03E04AD51E23AD05E3AD1E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

180000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d2d1

ord2 ord1

dwrite

DWriteCreateFactory

dwmapi

DwmSetWindowAttribute

shell32

ShellExecuteExW SHGetKnownFolderPath

ole32

CoUninitialize CoCreateGuid CoInitializeEx CoCreateInstance StringFromGUID2 CoTaskMemFree

user32

LoadCursorW LoadIconW TranslateMessage SetFocus SetCapture TrackMouseEvent SetCursor GetMonitorInfoW SetTimer DispatchMessageW GetClientRect GetForegroundWindow ShowWindow PeekMessageW RegisterClassExW GetWindowLongPtrW GetWindowTextW EndPaint BeginPaint IsIconic InvalidateRect GetDpiForSystem SetForegroundWindow ReleaseCapture UpdateWindow SendMessageW SystemParametersInfoW ScreenToClient CreateWindowExW SetWindowLongPtrW MonitorFromWindow GetDpiForWindow SetWindowPos DestroyIcon LoadImageW UnregisterHotKey MapVirtualKeyW IsZoomed RegisterHotKey GetKeyNameTextW GetWindowThreadProcessId IsWindowVisible GetWindowTextLengthW DestroyWindow PostQuitMessage EnumWindows GetClassNameW GetMessageW DefWindowProcW GetKeyState CallWindowProcW PostMessageW KillTimer

gdi32

DeleteObject CreateFontW

advapi32

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation RegCloseKey RegCreateKeyExW RegSetValueExW RegGetValueW OpenProcessToken

winhttp

WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpCrackUrl WinHttpConnect WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts

kernel32

GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetFileAttributesExW FindFirstFileW LCMapStringEx CreateDirectoryW EnterCriticalSection GetLocaleInfoEx FormatMessageA WaitForSingleObjectEx GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive RtlUnwindEx LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree SizeofResource LockResource WakeAllConditionVariable DecodePointer InitializeSListHead SetUnhandledExceptionFilter FindClose GetCurrentProcess LoadResource FindResourceW ConnectNamedPipe LoadLibraryExW VirtualFreeEx Module32NextW CreateRemoteThread FreeLibrary LocalFree VirtualAllocEx GetProcAddress GetOverlappedResult WaitForMultipleObjects CreateMutexW WaitForSingleObject CreateEventW GetTickCount64 GetLastError SetEvent QueryPerformanceFrequency CloseHandle GetCurrentProcessId GetModuleHandleW QueryPerformanceCounter MultiByteToWideChar WideCharToMultiByte GetSystemTimeAsFileTime SetLastError OpenProcess GetProcessTimes WriteFile CreateFileW GetLocalTime FlushFileBuffers ReadFile WriteProcessMemory GetStartupInfoW GetModuleHandleExW GetModuleFileNameW CreateNamedPipeW GetNamedPipeClientProcessId CreateToolhelp32Snapshot GetExitCodeThread CancelIoEx Module32FirstW

api-ms-win-crt-stdio-l1-1-0

fseek _wfsopen fflush fclose __p__commode fgetc __stdio_common_vswprintf_s fwrite fgetpos setvbuf ungetc fsetpos fread _fseeki64 _get_stream_buffer_pointers fputc _set_fmode

api-ms-win-crt-math-l1-1-0

fabs ceilf cosf _fdtest trunc sinf _dtest __setusermatherr lroundf expf

api-ms-win-crt-runtime-l1-1-0

_c_exit _get_wide_winmain_command_line _initialize_wide_environment _register_thread_local_exe_atexit_callback _exit _crt_atexit _configure_wide_argv _register_onexit_function exit abort _initialize_onexit_table _beginthreadex _set_app_type _initterm_e terminate _seh_filter_exe _cexit _initterm

api-ms-win-crt-convert-l1-1-0

wcstod

api-ms-win-crt-string-l1-1-0

_wcsdup isupper strcpy_s wcslen _wcsicmp wcscpy_s strlen __strncnt islower

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

calloc _callnewh malloc _set_new_mode free

cabinet

ord45 ord40 ord43

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptHash

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _lock_locales _unlock_locales _wsetlocale setlocale ___lc_locale_name_func __pctype_func _configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

26097ba3ec5aea2c0752214b8cde80b065b7775624d5be7023560e8f1beea7b0

d2d1

dwrite

dwmapi

shell32

ole32

user32

gdi32

advapi32

winhttp

kernel32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

cabinet

bcrypt

api-ms-win-crt-locale-l1-1-0

generic