04127380c344543d3fd2799fcfdb65ce88051e66bf6e3ae6356fb2788e079e3e

Sharing

Copy URL Twitter E-mail

General

Target
04127380c344543d3fd2799fcfdb65ce88051e66bf6e3ae6356fb2788e079e3e
Size 342KB
Sample261110-m7yelastgy
SHA256 04127380c344543d3fd2799fcfdb65ce88051e66bf6e3ae6356fb2788e079e3e
MD5 d82ecb3e85b0d4526db705b11919cb33
SHA1 bdda50f15fe80e2d0fe281d7879c6a4665958305
SHA512 2efde8968ad6ba71cf2604b8cd1b995de8452ab944a9de4c6c5aa78d4dcc773dfaf6f8ba6e8fd350aa22d5a30552d08e0ac6c2a59208f68e671498f1d948d4ee
SSDEEP 3072:V8LZYjo2Cg/W11sjjmzoShkBBuEoGSBxc7PLEqnk5dHYElT080Z388G7Od37YipL:V8LZYU2CcXSofBBtKBxm7yrVGMFg
TLSH
T19374B3A123D49645F5B29B3C8AFA17312B39FD829A71C70F9600B55F0C32BD0AE95727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04127380c344543d3fd2799fcfdb65ce88051e66bf6e3ae6356fb2788e079e3e

File Explorer

04127380c344543d3fd2799fcfdb65ce88051e66bf6e3ae6356fb2788e079e3e

.dll 342KB

04127380c344543d3fd2799fcfdb65ce88051e66bf6e3ae6356fb2788e079e3e

IMPHASH 42bab5719d4c9b0d913b86365afe77f9
SHA256 04127380c344543d3fd2799fcfdb65ce88051e66bf6e3ae6356fb2788e079e3e
MD5 d82ecb3e85b0d4526db705b11919cb33
SHA1 bdda50f15fe80e2d0fe281d7879c6a4665958305
SHA512 2efde8968ad6ba71cf2604b8cd1b995de8452ab944a9de4c6c5aa78d4dcc773dfaf6f8ba6e8fd350aa22d5a30552d08e0ac6c2a59208f68e671498f1d948d4ee
SSDEEP 3072:V8LZYjo2Cg/W11sjjmzoShkBBuEoGSBxc7PLEqnk5dHYElT080Z388G7Od37YipL:V8LZYU2CcXSofBBtKBxm7yrVGMFg
TLSH
T19374B3A123D49645F5B29B3C8AFA17312B39FD829A71C70F9600B55F0C32BD0AE95727
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumValueW RegGetValueW RegQueryInfoKeyW RegSetValueExW

combase

RoGetActivationFactory RoInitialize RoUninitialize WindowsCreateString WindowsDeleteString WindowsGetStringRawBuffer

comctl32

InitCommonControlsEx PropertySheetW

dinput8

DirectInput8Create

gdi32

CreateFontIndirectW DeleteObject Ellipse GetStockObject LineTo MoveToEx Polygon Rectangle RoundRect SelectObject SetBkMode SetDCBrushColor SetDCPenColor SetTextColor

kernel32

ActivateActCtx CloseHandle CreateActCtxW CreateEventW CreateThread DeactivateActCtx DisableThreadLibraryCalls EnterCriticalSection GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapReAlloc LeaveCriticalSection MulDiv ReleaseActCtx SetEvent WaitForMultipleObjects WaitForSingleObject

ntdll

_vsnprintf

ole32

OleInitialize OleUninitialize

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup calloc free fwrite getenv memcmp memmove round strchr strcmp strcspn strlen wcscmp wcslen wcsrchr wcsstr

user32

BeginPaint CreateWindowExW DefWindowProcW DispatchMessageW DrawTextW EnableWindow EndPaint FillRect FindWindowExW GetAncestor GetClientRect GetDlgItem GetSysColor GetWindowLongPtrW GetWindowLongW InvalidateRect MsgWaitForMultipleObjects PeekMessageW RegisterClassW RegisterDeviceNotificationW SendDlgItemMessageW SendMessageW SetWindowLongW ShowWindow TranslateMessage UnregisterClassW UnregisterDeviceNotification

xinput1_3

XInputSetState XInputGetCapabilities XInputGetStateEx

Name

.text

Size

36KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

28KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

948B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

140KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

796B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

04127380c344543d3fd2799fcfdb65ce88051e66bf6e3ae6356fb2788e079e3e

advapi32

combase

comctl32

dinput8

gdi32

kernel32

ntdll

ole32

ucrtbase

user32

xinput1_3

generic