2dee7680ebd4eafeab93ff21aef46a2f59ee77f81ccb76b0be6dfcc469c433be

Sharing

Copy URL Twitter E-mail

General

Target
2dee7680ebd4eafeab93ff21aef46a2f59ee77f81ccb76b0be6dfcc469c433be
Size 818KB
Sample261113-151ntsht4x
SHA256 2dee7680ebd4eafeab93ff21aef46a2f59ee77f81ccb76b0be6dfcc469c433be
MD5 0d24c3e1839f99cbef91eef9f0c163ee
SHA1 53c76aa589615e81ca036084cf532e88503539b4
SHA512 2226be9ae1db9611911f9da51485eda88cfa0565f93c5ef1c4cd422224e7f66d431209e465b539325558ace6c324dd6488ed9e995d7d65e7b48346e208eee900
SSDEEP 6144:KFNe/f4EG1Vj6NgC1V81Vp1VW1Vb1V41Vv9c1V/1Vf6f6g4aM81:KFNe/wfVsgGVEVrV6VpVAVlkVdVw1
TLSH
T14B05A40757A67275FDB39630993283B20E33BEC9E534856B264063AE383055EB52E737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2dee7680ebd4eafeab93ff21aef46a2f59ee77f81ccb76b0be6dfcc469c433be

File Explorer

2dee7680ebd4eafeab93ff21aef46a2f59ee77f81ccb76b0be6dfcc469c433be

.dll 818KB

2dee7680ebd4eafeab93ff21aef46a2f59ee77f81ccb76b0be6dfcc469c433be

IMPHASH 6506afe67abc8821b8f1adbdc455bb8d
SHA256 2dee7680ebd4eafeab93ff21aef46a2f59ee77f81ccb76b0be6dfcc469c433be
MD5 0d24c3e1839f99cbef91eef9f0c163ee
SHA1 53c76aa589615e81ca036084cf532e88503539b4
SHA512 2226be9ae1db9611911f9da51485eda88cfa0565f93c5ef1c4cd422224e7f66d431209e465b539325558ace6c324dd6488ed9e995d7d65e7b48346e208eee900
SSDEEP 6144:KFNe/f4EG1Vj6NgC1V81Vp1VW1Vb1V41Vv9c1V/1Vf6f6g4aM81:KFNe/wfVsgGVEVrV6VpVAVlkVdVw1
TLSH
T14B05A40757A67275FDB39630993283B20E33BEC9E534856B264063AE383055EB52E737
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegDeleteValueW RegEnumValueW RegOpenCurrentUser RegOpenKeyExW RegQueryValueExW RegSetValueExW

user32

CopyRect DestroyCursor DestroyIcon DialogBoxParamW DrawFocusRect DrawIcon DrawTextW EnableWindow EndDialog FillRect GetCaretBlinkTime GetDC GetDlgItem GetDlgItemInt GetDoubleClickTime GetParent GetSysColor GetSysColorBrush GetSystemMetrics GetWindowLongPtrW GetWindowRect InflateRect InvalidateRect IsDlgButtonChecked KillTimer LoadIconW LoadImageW LoadStringW MessageBoxW PostMessageW ReleaseDC ScreenToClient SendDlgItemMessageW SendMessageW SetCaretBlinkTime SetDlgItemInt SetDoubleClickTime SetTimer SetWindowLongPtrW SystemParametersInfoW wsprintfW

comctl32

CreatePropertySheetPageW InitCommonControlsEx PropertySheetW

devmgr

DeviceCreateHardwarePageEx

comdlg32

GetOpenFileNameW

shell32

SHAddFromPropSheetExtArray SHCreatePropSheetExtArray SHDestroyPropSheetExtArray SHReplaceFromPropSheetExtArray

gdi32

SetBkColor SetTextColor

msvcrt

_amsg_exit _fpreset _initterm _iob _lock _onexit _swprintf _unlock _wcsdup _wtoi abort calloc fprintf free memmove memset realloc signal strlen strncmp vfprintf wcscat wcschr wcscmp wcscpy wcslen wcsncat wcsncmp wcsncpy wcsstr

kernel32

DeleteCriticalSection EnterCriticalSection ExpandEnvironmentStringsW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetLastError GetModuleHandleA GetProcessHeap GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

Name

.text

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

888B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

737KB

Virtual Size

737KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symz

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2dee7680ebd4eafeab93ff21aef46a2f59ee77f81ccb76b0be6dfcc469c433be

advapi32

user32

comctl32

devmgr

comdlg32

shell32

gdi32

msvcrt

kernel32

generic