26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2

Sharing

Copy URL Twitter E-mail

General

Target
26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2
Size 2.7MB
Sample261110-m4breshv7r
SHA256 26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2
MD5 7f9e3b68a0328b0bb096bb820ca50283
SHA1 5d7da6694fc223cf6eb1680090d1ec917c87ce3e
SHA512 fdc3098f62cc329c1f16d1bf52d9770e0a4a4c143833ec4147b613802d8a0eb0f5e0d8eff1428116f858ecd2c5b18389cb0b62f8f4801fad90d684124fa7d80c
SSDEEP 49152:rUe0UqdHM6HTYSloWb0Tg0OMLY+5lhbzLsMFRIbiJeezSeA:ge0m6/oI8L/RezaSeA
TLSH
T11BD56C27B38C613ED8EA193B453FA754A93B666166028C7757E0088CCF357817A3EB47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2

File Explorer

26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2

.exe 2.7MB

26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2

IMPHASH 1475e0f41fa73b9f63a0083d90aaa287
SHA256 26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2
MD5 7f9e3b68a0328b0bb096bb820ca50283
SHA1 5d7da6694fc223cf6eb1680090d1ec917c87ce3e
SHA512 fdc3098f62cc329c1f16d1bf52d9770e0a4a4c143833ec4147b613802d8a0eb0f5e0d8eff1428116f858ecd2c5b18389cb0b62f8f4801fad90d684124fa7d80c
SSDEEP 49152:rUe0UqdHM6HTYSloWb0Tg0OMLY+5lhbzLsMFRIbiJeezSeA:ge0m6/oI8L/RezaSeA
TLSH
T11BD56C27B38C613ED8EA193B453FA754A93B666166028C7757E0088CCF357817A3EB47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1766764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

comctl32

FlatSB_SetScrollInfo ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add ImageList_GetDragImage FlatSB_SetScrollProp ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB FlatSB_GetScrollInfo ImageList_Write ImageList_GetBkColor ImageList_SetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_Draw ImageList_Remove

shell32

IsUserAnAdmin Shell_NotifyIconW ShellExecuteExW

user32

CopyImage CreateWindowExW GetMenuItemInfoW SetMenuItemInfoW DefFrameProcW GetDCEx PeekMessageW MonitorFromWindow GetDlgCtrlID SetTimer WindowFromPoint BeginPaint RegisterClipboardFormatW FrameRect MapVirtualKeyW IsWindowUnicode RegisterWindowMessageW FillRect GetMenuStringW DispatchMessageW SendMessageA DefMDIChildProcW EnumWindows GetClassInfoW ShowOwnedPopups GetSystemMenu GetScrollRange SetScrollPos GetScrollPos GetActiveWindow SetActiveWindow DrawEdge GetKeyboardLayoutList LoadBitmapW DrawFocusRect EnumChildWindows ReleaseCapture UnhookWindowsHookEx LoadCursorW GetCapture SetCapture CreatePopupMenu ScrollWindow ShowCaret GetMenuItemID GetLastActivePopup CharLowerBuffW GetSystemMetrics SetWindowLongW PostMessageW DrawMenuBar SetParent IsZoomed CharUpperBuffW GetClientRect IsChild ClientToScreen SetWindowPlacement IsIconic CallNextHookEx GetMonitorInfoW ShowWindow CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow SetForegroundWindow GetWindowTextW EnableWindow DestroyWindow IsDialogMessageW EndMenu RegisterClassW CharNextW GetWindowThreadProcessId RedrawWindow GetDC GetFocus SetFocus EndPaint ReleaseDC MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW GetClassLongW ActivateKeyboardLayout GetParent DrawTextW SetScrollRange InsertMenuItemW PeekMessageA GetPropW SetClassLongW MessageBoxW MessageBeep SetPropW RemovePropW UpdateWindow GetSubMenu MsgWaitForMultipleObjects DestroyMenu DestroyIcon SetWindowsHookExW IsWindowVisible DispatchMessageA UnregisterClassW GetTopWindow SendMessageW AdjustWindowRectEx DrawIcon IsWindow EnumThreadWindows InvalidateRect GetKeyboardState DrawFrameControl ScreenToClient SetCursor CreateIcon CreateMenu LoadStringW CharLowerW SetWindowRgn SetWindowPos GetMenuItemCount RemoveMenu GetSysColorBrush GetKeyboardLayoutNameW GetWindowDC TranslateMessage DrawTextExW MapWindowPoints EnumDisplayMonitors CallWindowProcW DestroyCursor GetScrollInfo SetWindowTextW GetMessageExtraInfo EnableScrollBar GetSysColor TrackPopupMenu DrawIconEx PostQuitMessage GetClassNameW ShowScrollBar EnableMenuItem GetIconInfo GetMessagePos SetScrollInfo GetKeyNameTextW GetDesktopWindow GetCursorPos SetCursorPos HideCaret GetMenu GetMenuState SetMenu SetRect GetKeyState FindWindowExW MonitorFromPoint SystemParametersInfoW LoadIconW GetCursor GetWindow GetWindowLongW GetWindowRect InsertMenuW KillTimer WaitMessage IsWindowEnabled IsDialogMessageA TranslateMDISysAccel GetWindowPlacement FindWindowW DeleteMenu GetKeyboardLayout

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

GetErrorInfo SysFreeString VariantClear VariantInit SysReAllocStringLen SafeArrayCreate SafeArrayGetElement SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound VariantCopy VariantChangeType

advapi32

RegSetValueExW SetEntriesInAclW RegEnumKeyExW SetKernelObjectSecurity RegDeleteKeyW OpenProcessToken RegOpenKeyExW RegQueryInfoKeyW RegDeleteValueW RegFlushKey RegQueryValueExW RegEnumValueW GetKernelObjectSecurity GetTokenInformation SetSecurityDescriptorOwner InitializeSecurityDescriptor RegCloseKey RegCreateKeyExW GetSecurityDescriptorDacl SetSecurityDescriptorDacl

netapi32

NetWkstaGetInfo NetApiBufferFree

kernel32

SetFileAttributesW QueryDosDeviceW GetACP GetExitCodeProcess LocalFree CloseHandle GetCurrentProcessId SizeofResource VirtualProtect QueryPerformanceFrequency FindNextFileW VirtualFree GetFullPathNameW ExitProcess HeapAlloc GetCPInfoExW RtlUnwind GetCPInfo GetStdHandle FileTimeToLocalFileTime GetModuleHandleW FreeLibrary HeapDestroy FileTimeToDosDateTime ReadFile GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW MapViewOfFile LoadLibraryA ResetEvent GetVolumeInformationW MulDiv FreeResource GetDriveTypeW GetVersion RaiseException GlobalAddAtomW FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery GlobalFindAtomW VirtualQueryEx Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetFileSize GetStartupInfoW GlobalDeleteAtom GetFileAttributesW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc GetSystemInfo GetCommandLineW LeaveCriticalSection GetProcAddress ResumeThread VirtualAllocEx GetLogicalDriveStringsW GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage UnmapViewOfFile lstrlenW QueryPerformanceCounter SetEndOfFile lstrcpyW HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW DeleteFileW GetLocalTime WaitForSingleObject WriteFile CreateFileMappingW ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode IsValidLocale TlsSetValue VirtualFreeEx GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetUserDefaultLangID RemoveDirectoryW CreateEventW WaitForMultipleObjectsEx SetThreadLocale GetThreadLocale

ole32

OleInitialize CLSIDFromProgID OleUninitialize CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree CoTaskMemAlloc

gdi32

Arc Pie SetBkMode SelectPalette CreateCompatibleBitmap ExcludeClipRect RectVisible SetWindowOrgEx MaskBlt AngleArc Chord SetTextColor StretchBlt SetDIBits SetViewportOrgEx CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable RoundRect RestoreDC SetRectRgn GetTextMetricsW GetWindowOrgEx CreatePalette CreateBrushIndirect PatBlt PolyBezierTo GetStockObject CreateSolidBrush Polygon Rectangle MoveToEx DeleteDC SaveDC BitBlt Ellipse FrameRgn GetDeviceCaps GetBitmapBits GetTextExtentPoint32W GetClipBox Polyline IntersectClipRect GetSystemPaletteEntries CreateBitmap CreateDIBitmap GetStretchBltMode CreateDIBSection CreatePenIndirect SetStretchBltMode GetDIBits CreateFontIndirectW PolyBezier LineTo GetRgnBox CreateHalftonePalette DeleteObject SelectObject ExtFloodFill UnrealizeObject SetBkColor CreateCompatibleDC GetObjectW GetBrushOrgEx GetCurrentPositionEx SetROP2 GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel ArcTo GdiFlush SetPixel EnumFontFamiliesExW GetPaletteEntries

ntdll

RtlAdjustPrivilege

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

26KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

68B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

798KB

Virtual Size

797KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2

comctl32

shell32

user32

version

oleaut32

advapi32

netapi32

kernel32

ole32

gdi32

ntdll

generic