04c2e0bb28aeb08b210e586f1480e1702a23a90f67c022e120b0e466e05cdefb

Sharing

Copy URL Twitter E-mail

General

Target
04c2e0bb28aeb08b210e586f1480e1702a23a90f67c022e120b0e466e05cdefb
Size 9.5MB
Sample261110-l3vbpswt9q
SHA256 04c2e0bb28aeb08b210e586f1480e1702a23a90f67c022e120b0e466e05cdefb
MD5 8e4721667030f09896dbb36cd6aede69
SHA1 80d8d04367515a1b8c82383a0c93b619855ecd1f
SHA512 aef29b9eff084ef8d8a5e32c4b5208eb64b95632945c9caebff8451ed2eadeb15032a2b964bb1aef47bb918af6be8300b98f91802b8aafd96e1ed2c815afccab
SSDEEP 98304:G0JplSXkeeedx5xIxnxBK9Oh8vB//Q+P44GCn9enRWHakD5kDfXXXn5GwAkHn++2:GISWK9O444of5dqfb9
TLSH
T154A65B637E5DD08EE91A41309C6B997412303C18BBA1B99B229FFE1FD8B139154EF607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04c2e0bb28aeb08b210e586f1480e1702a23a90f67c022e120b0e466e05cdefb

File Explorer

04c2e0bb28aeb08b210e586f1480e1702a23a90f67c022e120b0e466e05cdefb

.dll 9.5MB

04c2e0bb28aeb08b210e586f1480e1702a23a90f67c022e120b0e466e05cdefb

IMPHASH 547c4d8ea803f4242ce32a26494e6e11
SHA256 04c2e0bb28aeb08b210e586f1480e1702a23a90f67c022e120b0e466e05cdefb
MD5 8e4721667030f09896dbb36cd6aede69
SHA1 80d8d04367515a1b8c82383a0c93b619855ecd1f
SHA512 aef29b9eff084ef8d8a5e32c4b5208eb64b95632945c9caebff8451ed2eadeb15032a2b964bb1aef47bb918af6be8300b98f91802b8aafd96e1ed2c815afccab
SSDEEP 98304:G0JplSXkeeedx5xIxnxBK9Oh8vB//Q+P44GCn9enRWHakD5kDfXXXn5GwAkHn++2:GISWK9O444of5dqfb9
TLSH
T154A65B637E5DD08EE91A41309C6B997412303C18BBA1B99B229FFE1FD8B139154EF607
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

454544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

DelayLoadFailureHook ord2 PathAddBackslashA PathAddBackslashW PathAppendA PathAppendW PathBuildRootA PathBuildRootW PathCombineA PathCombineW PathCreateFromUrlW PathFileExistsA ord3 ord4 PathFileExistsW PathFindExtensionA PathFindExtensionW PathFindFileNameA PathFindFileNameW PathFindOnPathA ord5 ord6 PathFindOnPathW PathGetArgsA PathGetArgsW PathGetCharTypeA PathGetCharTypeW PathGetDriveNumberA PathGetDriveNumberW PathIsDirectoryA PathIsDirectoryW PathIsFileSpecA PathIsFileSpecW PathIsRelativeA PathIsRelativeW PathIsRootA PathIsRootW PathIsSameRootA PathIsSameRootW PathIsUNCA PathIsUNCW PathIsURLW PathMatchSpecA PathMatchSpecW PathParseIconLocationA PathParseIconLocationW PathQuoteSpacesA PathQuoteSpacesW PathRemoveArgsA PathRemoveArgsW PathRemoveBackslashW PathRemoveBlanksA PathRemoveBlanksW PathRemoveExtensionA PathRemoveExtensionW PathRemoveFileSpecA PathRemoveFileSpecW PathSetDlgItemPathA PathSetDlgItemPathW PathStripPathA PathStripPathW PathStripToRootA PathStripToRootW PathUnquoteSpacesA PathUnquoteSpacesW ord7 SHCreateStreamOnFileW SHDeleteKeyW ord10 SHGetValueW ord8 SHQueryValueExA SHQueryValueExW SHStrDupW ord24 ord9 StrChrW StrCmpIW StrCpyNW StrFormatByteSizeW StrFormatKBSizeA StrFormatKBSizeW StrPBrkW StrRChrW StrRetToBSTR StrRetToBufA StrRetToBufW StrRetToStrW UrlIsW

user32

BeginDeferWindowPos BeginPaint CallWindowProcW CharLowerW CheckMenuRadioItem CopyImage CreateIconIndirect CreateMenu CreatePopupMenu CreateWindowExW DdeClientTransaction DdeConnect DdeCreateDataHandle DdeCreateStringHandleW DdeDisconnect DdeFreeDataHandle DdeFreeStringHandle DdeGetData DdeGetLastError DdeInitializeA DdeInitializeW DdeNameService DdeQueryStringW DdeUninitialize DefWindowProcW DeferWindowPos DeleteMenu DestroyIcon DestroyMenu DestroyWindow DialogBoxIndirectParamW DialogBoxParamW DispatchMessageW DrawEdge DrawMenuBar DrawTextW EnableMenuItem EnableWindow EndDeferWindowPos EndDialog EndPaint ExitWindowsEx FindWindowExW FindWindowW GetActiveWindow GetAncestor GetCapture GetClassInfoW GetClientRect GetDC GetDCEx GetDlgItem GetDlgItemTextW GetIconInfo GetKeyState GetMenu GetMenuDefaultItem GetMenuInfo GetMenuItemCount GetMenuItemID GetMenuItemInfoW GetMenuItemRect GetMessageW GetParent GetPropW GetSubMenu GetSysColor GetSystemMetrics GetWindowLongA GetWindowLongW GetWindowRect GetWindowTextA GetWindowTextLengthW GetWindowTextW InsertMenuA InsertMenuItemW InsertMenuW InvertRect IsProcessDPIAware IsWindow IsWindowVisible LoadAcceleratorsW LoadCursorA LoadCursorW LoadIconW LoadImageA LoadImageW LoadMenuA LoadMenuW LoadStringA LoadStringW MapWindowPoints MessageBoxA MessageBoxIndirectW MessageBoxW MoveWindow PostQuitMessage PrivateExtractIconExW PrivateExtractIconsW RegisterClassExW RegisterClassW RegisterClipboardFormatA RegisterClipboardFormatW ReleaseCapture ReleaseDC RemoveMenu RemovePropW ScreenToClient SendDlgItemMessageW SendMessageA SendMessageTimeoutW SendMessageW SetCapture SetCursor SetDlgItemTextW SetFocus SetForegroundWindow SetMenu SetMenuDefaultItem SetMenuInfo SetPropW SetWindowLongA SetWindowLongW SetWindowPos SetWindowTextA SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu TrackPopupMenuEx TranslateMessage UpdateWindow WaitForInputIdle wsprintfA

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontIndirectW DeleteObject ExtTextOutW GetBitmapBits GetDeviceCaps GetObjectW GetStockObject GetTextExtentPoint32W GetTextMetricsW SelectObject SetBkColor SetBkMode SetTextColor

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CloseServiceHandle CommandLineFromMsiDescriptor ConvertSidToStringSidW CreateProcessAsUserW EqualSid FreeSid GetTokenInformation GetUserNameW LookupPrivilegeValueA OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegCreateKeyExA RegCreateKeyExW RegCreateKeyW RegDeleteKeyA RegEnumKeyA RegEnumKeyExW RegEnumKeyW RegEnumValueA RegEnumValueW RegGetValueW RegLoadMUIStringA RegLoadMUIStringW RegOpenKeyA RegOpenKeyExA RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueA RegQueryValueExA RegQueryValueExW RegQueryValueW RegSetValueExA RegSetValueExW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _assert _recalloc _strdup _wcsdup _wcsicmp _wcsnicmp _wgetenv atoi calloc free fwrite getenv isprint iswspace malloc memchr memcmp memcpy memmove memset qsort realloc strcat strchr strcmp strcpy strcspn strlen strncmp strrchr towlower towupper wcscat wcschr wcscmp wcscpy wcscpy_s wcslen wcsncmp wcspbrk wcsrchr wcsstr wcstol

kernel32

ActivateActCtx CloseHandle CompareFileTime CopyFileW CreateActCtxW CreateDirectoryW CreateFileMappingW CreateFileW CreateProcessW DeactivateActCtx DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DisableThreadLibraryCalls DosDateTimeToFileTime EnterCriticalSection EnumResourceNamesW ExpandEnvironmentStringsA ExpandEnvironmentStringsW FileTimeToDosDateTime FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FindResourceW FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetBinaryTypeW GetCurrentDirectoryA GetCurrentDirectoryW GetDateFormatA GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeA GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFullPathNameA GetFullPathNameW GetLocalTime GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetProfileStringW GetShortPathNameA GetShortPathNameW GetSystemDirectoryA GetSystemDirectoryW GetSystemWow64DirectoryW GetTickCount GetTimeFormatA GetTimeFormatW GetVersion GetVolumeInformationA GetVolumeInformationW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceExecuteOnce IsBadStringPtrA IsBadStringPtrW IsWow64Process LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFileTimeToFileTime LocalFree LockResource MapViewOfFile MoveFileExW MoveFileW MulDiv MultiByteToWideChar ProcessIdToSessionId RaiseException ReadFile ReleaseActCtx RemoveDirectoryW ResolveDelayLoadedAPI SearchPathW SetCurrentDirectoryA SetCurrentDirectoryW SetErrorMode SetFileAttributesW SetFilePointer SizeofResource Sleep SystemTimeToFileTime UnmapViewOfFile WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteFile WritePrivateProfileStringW lstrcmpA lstrcmpiA lstrcmpiW wine_get_dos_file_name wine_get_unix_file_name

ntdll

RtlDosPathNameToNtPathName_U RtlFreeUnicodeString RtlGUIDFromString RtlInitUnicodeString RtlRandom _chkstk _vsnprintf wine_get_host_version

AddCommasW CDefFolderMenu_Create2 CIDLData_CreateFromIDArray CheckEscapesA CheckEscapesW CommandLineToArgvW Control_FillCache_RunDLL Control_FillCache_RunDLLA Control_FillCache_RunDLLW Control_RunDLL Control_RunDLLA Control_RunDLLAsUserW Control_RunDLLW DAD_AutoScroll DAD_DragEnterEx DAD_DragLeave DAD_DragMove DAD_SetDragImage DAD_SetDragImageFromListView DAD_ShowDragImage Desktop_UpdateBriefcaseOnEvent DllCanUnloadNow DllGetClassObject DllGetVersion DllInstall DllRegisterServer DllUnregisterServer DoEnvironmentSubst DoEnvironmentSubstA DoEnvironmentSubstW DragAcceptFiles DragFinish DragQueryFile DragQueryFileA DragQueryFileAorW DragQueryFileW DragQueryInfo DragQueryPoint DriveType DuplicateIcon ExtractAssociatedIconA ExtractAssociatedIconExA ExtractAssociatedIconExW ExtractAssociatedIconW ExtractIconA ExtractIconEx ExtractIconExA ExtractIconExW ExtractIconResInfoA ExtractIconResInfoW ExtractIconW ExtractVersionResource16W FOOBAR1217 FindExeDlgProc FindExecutableA FindExecutableW FixupOptionalComponents FreeIconList GetCurrentProcessExplicitAppUserModelID GetFileNameFromBrowse ILAppendID ILClone ILCloneFirst ILCombine ILCreateFromPath ILCreateFromPathA ILCreateFromPathW ILFindChild ILFindLastID ILFree ILGetNext ILGetPseudoNameW ILGetSize ILIsEqual ILIsParent ILRemoveLastID ILSaveToStream InitNetworkAddressControl Int64ToString InternalExtractIconListA InternalExtractIconListW IsLFNDrive IsLFNDriveA IsLFNDriveW IsNetDrive IsUserAnAdmin LargeIntegerToString Link_AddExtraDataSection Link_ReadExtraDataSection Link_RemoveExtraDataSection LogoffWindowsDialog OCInstall OpenAs_RunDLL OpenAs_RunDLLA OpenAs_RunDLLW OpenRegStream PathCleanupSpec PathGetShortPath PathIsExe PathMakeUniqueName PathQualify PathResolve PathYetAnotherMakeUniqueName PickIconDlg PifMgr_CloseProperties PifMgr_GetProperties PifMgr_OpenProperties PifMgr_SetProperties Printer_LoadIconsW PrintersGetCommand_RunDLL PrintersGetCommand_RunDLLA PrintersGetCommand_RunDLLW Printers_AddPrinterPropPages Printers_GetPidl Printers_RegisterWindowW Printers_UnregisterWindow ReadCabinetState RealDriveType RealDriveTypeFlags RealShellExecuteA RealShellExecuteExA RealShellExecuteExW RealShellExecuteW ReceiveAddToRecentDocs RegenerateUserEnvironment RestartDialog SHAddFromPropSheetExtArray SHAddToRecentDocs SHAlloc SHAppBarMessage SHAssocEnumHandlers SHAssocEnumHandlersForProtocolByApplication SHBindToFolderIDListParent SHBindToObject SHBindToParent SHBrowseForFolder SHBrowseForFolderA SHBrowseForFolderW SHCLSIDFromString SHChangeNotification_Lock SHChangeNotification_Unlock SHChangeNotify SHChangeNotifyDeregister SHChangeNotifyReceive SHChangeNotifyRegister SHChangeNotifySuspendResume SHChangeRegistrationReceive SHCloneSpecialIDList SHCoCreateInstance SHCreateAssociationRegistration SHCreateDataObject SHCreateDefaultContextMenu SHCreateDirectory SHCreateDirectoryExA SHCreateDirectoryExW SHCreateFileExtractIconW SHCreateItemFromIDList SHCreateItemFromParsingName SHCreateItemFromRelativeName SHCreateItemInKnownFolder SHCreateItemWithParent SHCreateProcessAsUserW SHCreatePropSheetExtArray SHCreateQueryCancelAutoPlayMoniker SHCreateShellFolderView SHCreateShellFolderViewEx SHCreateShellItem SHCreateShellItemArray SHCreateShellItemArrayFromDataObject SHCreateShellItemArrayFromIDLists SHCreateShellItemArrayFromShellItem SHCreateStdEnumFmtEtc SHDefExtractIconA SHDefExtractIconW SHDestroyPropSheetExtArray SHDoDragDrop SHEmptyRecycleBinA SHEmptyRecycleBinW SHEnumerateUnreadMailAccountsW SHExtractIconsW SHFileOperation SHFileOperationA SHFileOperationW SHFindComputer SHFindFiles SHFind_InitMenuPopup SHFlushSFCache SHFormatDrive SHFree SHFreeNameMappings SHGetDataFromIDListA SHGetDataFromIDListW SHGetDesktopFolder SHGetDiskFreeSpaceA SHGetDiskFreeSpaceExA SHGetDiskFreeSpaceExW SHGetFileIcon SHGetFileInfo SHGetFileInfoA SHGetFileInfoW SHGetFolderLocation SHGetFolderPathA SHGetFolderPathAndSubDirA SHGetFolderPathAndSubDirW SHGetFolderPathEx SHGetFolderPathW SHGetFreeDiskSpace SHGetIDListFromObject SHGetIconOverlayIndexA SHGetIconOverlayIndexW SHGetImageList SHGetInstanceExplorer SHGetItemFromDataObject SHGetItemFromObject SHGetKnownFolderIDList SHGetKnownFolderItem SHGetKnownFolderPath SHGetLocalizedName SHGetMalloc SHGetNameFromIDList SHGetNewLinkInfo SHGetNewLinkInfoA SHGetNewLinkInfoW SHGetPathFromIDList SHGetPathFromIDListA SHGetPathFromIDListEx SHGetPathFromIDListW SHGetPropertyStoreForWindow SHGetPropertyStoreFromParsingName SHGetRealIDL SHGetSetFolderCustomSettings SHGetSetSettings SHGetSettings SHGetSpecialFolderLocation SHGetSpecialFolderPathA SHGetSpecialFolderPathW SHGetStockIconInfo SHGlobalDefect SHHandleDiskFull SHHandleUpdateImage SHHelpShortcuts_RunDLL SHHelpShortcuts_RunDLLA SHHelpShortcuts_RunDLLW SHILCreateFromPath SHInvokePrinterCommandA SHInvokePrinterCommandW SHIsBadInterfacePtr SHIsFileAvailableOffline SHLimitInputEdit SHLoadInProc SHLoadNonloadedIconOverlayIdentifiers SHLocalAlloc SHLocalFree SHLocalReAlloc SHMapPIDLToSystemImageListIndex SHMultiFileProperties SHNetConnectionDialog SHObjectProperties SHOpenFolderAndSelectItems SHOpenWithDialog SHParseDisplayName SHPathPrepareForWriteA SHPathPrepareForWriteW SHPropStgCreate SHPropStgReadMultiple SHPropStgWriteMultiple SHQueryRecycleBinA SHQueryRecycleBinW SHQueryUserNotificationState SHRegCloseKey SHRegDeleteKeyW SHRegOpenKeyA SHRegOpenKeyW SHRegQueryValueA SHRegQueryValueExA SHRegQueryValueExW SHRegQueryValueW SHRemoveLocalizedName SHReplaceFromPropSheetExtArray SHRestricted SHSetInstanceExplorer SHSetLocalizedName SHSetTemporaryPropertyForItem SHSetUnreadMailCountW SHShellFolderView_Message SHSimpleIDListFromPath SHUpdateImageA SHUpdateImageW SHUpdateRecycleBinIcon SHValidateUNC SHWaitOp_Operate SetCurrentProcessExplicitAppUserModelID SheChangeDirA SheChangeDirExA SheChangeDirExW SheChangeDirW SheConvertPathW SheFullPathA SheFullPathW SheGetCurDrive SheGetDirA SheGetDirExW SheGetDirW SheGetPathOffsetW SheRemoveQuotesA SheRemoveQuotesW SheSetCurDrive SheShortenPathA SheShortenPathW ShellAboutA ShellAboutW ShellExec_RunDLL ShellExec_RunDLLA ShellExec_RunDLLW ShellExecuteA ShellExecuteEx ShellExecuteExA ShellExecuteExW ShellExecuteW ShellHookProc ShellMessageBoxA ShellMessageBoxW Shell_GetCachedImageIndex Shell_GetCachedImageIndexA Shell_GetCachedImageIndexW Shell_GetImageLists Shell_MergeMenus Shell_NotifyIcon Shell_NotifyIconA Shell_NotifyIconGetRect Shell_NotifyIconW ShortSizeFormatW SignalFileOpen StrChrA StrChrIA StrChrIW StrChrW StrCmpNA StrCmpNIA StrCmpNIW StrCmpNW StrCpyNA StrCpyNW StrNCmpA StrNCmpIA StrNCmpIW StrNCmpW StrNCpyA StrNCpyW StrRChrA StrRChrIA StrRChrIW StrRChrW StrRStrA StrRStrIA StrRStrIW StrRStrW StrStrA StrStrIA StrStrIW StrStrW WOWShellExecute Win32DeleteFile

Name

.text

Size

448KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

188KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8.4MB

Virtual Size

8.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

04c2e0bb28aeb08b210e586f1480e1702a23a90f67c022e120b0e466e05cdefb

shlwapi

user32

gdi32

advapi32

ucrtbase

kernel32

ntdll

generic