ad626d97ec24802f990b176d77cc7930c2e7d7e30298189e7a0732ea6b42ed5f

Sharing

Copy URL Twitter E-mail

General

Target
ad626d97ec24802f990b176d77cc7930c2e7d7e30298189e7a0732ea6b42ed5f
Size 1.8MB
Sample261113-11fg4ahs71
SHA256 ad626d97ec24802f990b176d77cc7930c2e7d7e30298189e7a0732ea6b42ed5f
MD5 9cda72b7d90f7edeebd093f96863ac40
SHA1 a59a2a911fdbaa950a6068990ab12b2912789f76
SHA512 3dc340d499ab5fba8ae1e4e9bd0fb02eef38f4d2ee1ea3886c64faaf620b51a98df2b912d12c9e6e8bb1b8bc7554211ca73b4322254593abba1cca264f3b0143
SSDEEP 12288:Ow5XzEu8VtWrkFaD0rrql5rbbbbmx66Vno11oZNNN2fffffuC1+cUBYYBL0rrqlw:OY7kF
TLSH
T109951B097240E07BDC7952748E97D2AE652C7C48EF1B7587B2D07B0F2A31FA75929223
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad626d97ec24802f990b176d77cc7930c2e7d7e30298189e7a0732ea6b42ed5f

File Explorer

ad626d97ec24802f990b176d77cc7930c2e7d7e30298189e7a0732ea6b42ed5f

.dll 1.8MB

ad626d97ec24802f990b176d77cc7930c2e7d7e30298189e7a0732ea6b42ed5f

IMPHASH df583a4e69e6d364a256d6e624366dfa
SHA256 ad626d97ec24802f990b176d77cc7930c2e7d7e30298189e7a0732ea6b42ed5f
MD5 9cda72b7d90f7edeebd093f96863ac40
SHA1 a59a2a911fdbaa950a6068990ab12b2912789f76
SHA512 3dc340d499ab5fba8ae1e4e9bd0fb02eef38f4d2ee1ea3886c64faaf620b51a98df2b912d12c9e6e8bb1b8bc7554211ca73b4322254593abba1cca264f3b0143
SSDEEP 12288:Ow5XzEu8VtWrkFaD0rrql5rbbbbmx66Vno11oZNNN2fffffuC1+cUBYYBL0rrqlw:OY7kF
TLSH
T109951B097240E07BDC7952748E97D2AE652C7C48EF1B7587B2D07B0F2A31FA75929223
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

235632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

setupapi

CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Status CM_Request_Device_Eject_ExW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

winmm

mixerClose mixerGetControlDetailsW mixerGetDevCapsW mixerGetID mixerGetLineControlsW mixerGetLineInfoW mixerOpen waveOutGetNumDevs waveOutMessage

ole32

CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize StringFromGUID2

oleaut32

LoadTypeLib RegisterTypeLib SysAllocString SysFreeString UnRegisterTypeLib

powrprof

EnumPwrSchemes GetActivePwrScheme SetActivePwrScheme

shlwapi

PathAppendW StrCpyW

shell32

ShellExecuteW Shell_NotifyIconW

uxtheme

CloseThemeData GetThemeBool GetThemeColor IsThemeActive OpenThemeData

msvcrt

__iob_func _aligned_free _aligned_malloc _amsg_exit _beginthreadex _fpreset _initterm _iob _lock _memicmp _onexit _snprintf _swprintf _unlock _vscwprintf _vsnprintf _vsnwprintf _vswprintf _wassert abort bsearch calloc fflush fprintf free getenv iswspace malloc memchr memcmp memcpy memmove memset realloc signal sprintf strchr strcmp strcpy strcspn strlen strncmp strrchr vfprintf vsprintf wcscat wcschr wcscpy wcslen wcstol wcstoul

gdi32

GetDeviceCaps

user32

AppendMenuW CallWindowProcW CheckMenuRadioItem CreatePopupMenu CreateWindowExW DefWindowProcW DeregisterShellHookWindow DestroyIcon DestroyMenu DestroyWindow DispatchMessageW FindWindowW GetCursorPos GetDC GetDoubleClickTime GetMessageW GetSysColor GetWindowLongPtrW KillTimer LoadCursorW LoadImageW LoadStringW MessageBoxW PostMessageW PostQuitMessage RegisterClassExW RegisterShellHookWindow RegisterWindowMessageW ReleaseDC SendMessageW SetForegroundWindow SetMenuDefaultItem SetTimer SetWindowLongPtrW SystemParametersInfoW TrackPopupMenuEx TranslateMessage wsprintfW

kernel32

AcquireSRWLockExclusive CloseHandle CreateThread DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection FindResourceW FlsAlloc FlsGetValue FlsSetValue FlushInstructionCache FreeLibrary FreeLibraryAndExitThread GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetProcessHeap GetSystemDirectoryW GetSystemPowerStatus GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetThreadId GetTickCount HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryExW LoadLibraryW LoadResource LockResource MulDiv MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetLastError SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable lstrcmpiW lstrlenW

ntdll

RtlAllocateHeap RtlFreeHeap RtlReAllocateHeap vDbgPrintExWithPrefix

ucrtbase

__stdio_common_vfprintf __stdio_common_vsprintf

Name

.text

Size

236KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ATL

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symz

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ad626d97ec24802f990b176d77cc7930c2e7d7e30298189e7a0732ea6b42ed5f

setupapi

advapi32

winmm

ole32

oleaut32

powrprof

shlwapi

shell32

uxtheme

msvcrt

gdi32

user32

kernel32

ntdll

ucrtbase

generic