610cd7aae5ad88766014caa6f313b7564e6d2736e851f25fcc239d6491c4dbbe

Sharing

Copy URL Twitter E-mail

General

Target
610cd7aae5ad88766014caa6f313b7564e6d2736e851f25fcc239d6491c4dbbe
Size 984KB
Sample261113-1814rssw2n
SHA256 610cd7aae5ad88766014caa6f313b7564e6d2736e851f25fcc239d6491c4dbbe
MD5 27be68a7e85c6f15813554f44dda8b62
SHA1 fa4c07cbba35187642a1c9af90a5845d075d5eb8
SHA512 bfbe04d7bceb9f5fda74be90dac0706033f27264ae51de778c19d79435958791e033396ad95db54f86c2ef71d6dd7615a1b4791c83c9219954f7f5d1dd9d840c
SSDEEP 24576:PF245PWaXAL1QONYGaoHW+uRxJbBTQbKu9qX:2TmQbKH
TLSH
T10D25B622E3FB91D8E1F7D6B046726223BE31BC5C8638E76F8B5097551A60F20D978325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
610cd7aae5ad88766014caa6f313b7564e6d2736e851f25fcc239d6491c4dbbe

File Explorer

610cd7aae5ad88766014caa6f313b7564e6d2736e851f25fcc239d6491c4dbbe

.dll 984KB

610cd7aae5ad88766014caa6f313b7564e6d2736e851f25fcc239d6491c4dbbe

IMPHASH c90a784502189e09b550005bbc520ec9
SHA256 610cd7aae5ad88766014caa6f313b7564e6d2736e851f25fcc239d6491c4dbbe
MD5 27be68a7e85c6f15813554f44dda8b62
SHA1 fa4c07cbba35187642a1c9af90a5845d075d5eb8
SHA512 bfbe04d7bceb9f5fda74be90dac0706033f27264ae51de778c19d79435958791e033396ad95db54f86c2ef71d6dd7615a1b4791c83c9219954f7f5d1dd9d840c
SSDEEP 24576:PF245PWaXAL1QONYGaoHW+uRxJbBTQbKu9qX:2TmQbKH
TLSH
T10D25B622E3FB91D8E1F7D6B046726223BE31BC5C8638E76F8B5097551A60F20D978325
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

607344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

msvcrt

__C_specific_handler _amsg_exit _assert _fpreset _initterm _iob _lock _onexit _snprintf _strnicmp _unlock _vsnprintf _vsnwprintf _wcsnicmp abort bsearch calloc fprintf free isdigit isspace iswctype malloc memchr memcmp memcpy memmove memset qsort realloc signal sprintf sscanf strchr strcmp strcpy strcspn _stricmp strlen strncmp strstr strtol towlower vfprintf wcschr wcscmp wcscpy _wcsicmp wcslen _wcslwr wcsncmp _wcsnicmp wcsrchr wcsstr wcstoul

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptDestroyKey BCryptFinishHash BCryptGenRandom BCryptGetProperty BCryptHash BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptVerifySignature

ncrypt

NCryptExportKey

user32

CharNextA LoadStringW wsprintfW

advapi32

CryptAcquireContextA CryptAcquireContextW CryptContextAddRef CryptCreateHash CryptDecrypt CryptDeriveKey CryptDestroyHash CryptDestroyKey CryptEncrypt CryptEnumProvidersW CryptExportKey CryptGenKey CryptGenRandom CryptGetHashParam CryptGetKeyParam CryptGetProvParam CryptGetUserKey CryptHashData CryptImportKey CryptReleaseContext CryptSetHashParam CryptSetKeyParam CryptSetProvParam CryptSignHashW CryptVerifySignatureW GetUserNameA RegCloseKey RegCreateKeyA RegCreateKeyExA RegCreateKeyExW RegCreateKeyW RegDeleteKeyA RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyA RegEnumKeyExW RegEnumKeyW RegNotifyChangeKeyValue RegOpenKeyA RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegRenameKey RegSetValueExA RegSetValueExW SystemFunction040 SystemFunction041

kernel32_vista

InitializeCriticalSectionEx

kernel32

CloseHandle CompareFileTime CreateEventW CreateFileA CreateFileW CreateMutexW DeleteCriticalSection DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection FileTimeToSystemTime FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatA GetEnvironmentVariableA GetFileSize GetLastError GetLocaleInfoA GetModuleHandleA GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetTickCount HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MultiByteToWideChar QueryPerformanceCounter RaiseException ReadFile RegisterWaitForSingleObject ReleaseMutex RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlRaiseException RtlVirtualUnwind SetEvent SetFilePointer SetFilePointerEx SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnregisterWaitEx VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile lstrcatW lstrcmpA lstrcmpiW lstrcpyA lstrcpyW lstrlenA lstrlenW

ntdll

DbgPrint RtlAllocateHeap RtlFreeHeap RtlNtStatusToDosError RtlReAllocateHeap vDbgPrintExWithPrefix

CertAddCRLContextToStore CertAddCTLContextToStore CertAddCertificateContextToStore CertAddCertificateLinkToStore CertAddEncodedCRLToStore CertAddEncodedCTLToStore CertAddEncodedCertificateToStore CertAddEncodedCertificateToSystemStoreA CertAddEncodedCertificateToSystemStoreW CertAddEnhancedKeyUsageIdentifier CertAddSerializedElementToStore CertAddStoreToCollection CertAlgIdToOID CertCloseStore CertCompareCertificate CertCompareCertificateName CertCompareIntegerBlob CertComparePublicKeyInfo CertControlStore CertCreateCRLContext CertCreateCTLContext CertCreateCertificateChainEngine CertCreateCertificateContext CertCreateContext CertCreateSelfSignCertificate CertDeleteCRLFromStore CertDeleteCTLFromStore CertDeleteCertificateFromStore CertDuplicateCRLContext CertDuplicateCTLContext CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCRLContextProperties CertEnumCRLsInStore CertEnumCTLContextProperties CertEnumCTLsInStore CertEnumCertificateContextProperties CertEnumCertificatesInStore CertEnumPhysicalStore CertEnumSystemStore CertEnumSystemStoreLocation CertFindAttribute CertFindCRLInStore CertFindCTLInStore CertFindCertificateInCRL CertFindCertificateInStore CertFindChainInStore CertFindExtension CertFindRDNAttr CertFindSubjectInCTL CertFreeCRLContext CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCRLContextProperty CertGetCRLFromStore CertGetCTLContextProperty CertGetCertificateChain CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertGetIssuerCertificateFromStore CertGetNameStringA CertGetNameStringW CertGetPublicKeyLength CertGetStoreProperty CertGetSubjectCertificateFromStore CertGetValidUsages CertIsRDNAttrsInCertificateName CertIsValidCRLForCertificate CertNameToStrA CertNameToStrW CertOIDToAlgId CertOpenStore CertOpenSystemStoreA CertOpenSystemStoreW CertRDNValueToStrA CertRDNValueToStrW CertRegisterPhysicalStore CertRegisterSystemStore CertRemoveEnhancedKeyUsageIdentifier CertRemoveStoreFromCollection CertSaveStore CertSerializeCRLStoreElement CertSerializeCTLStoreElement CertSerializeCertificateStoreElement CertSetCRLContextProperty CertSetCTLContextProperty CertSetCertificateContextProperty CertSetEnhancedKeyUsage CertSetStoreProperty CertStrToNameA CertStrToNameW CertUnregisterPhysicalStore CertUnregisterSystemStore CertVerifyCRLRevocation CertVerifyCRLTimeValidity CertVerifyCTLUsage CertVerifyCertificateChainPolicy CertVerifyRevocation CertVerifySubjectCertificateContext CertVerifyTimeValidity CertVerifyValidityNesting CreateFileU CryptAcquireCertificatePrivateKey CryptAcquireContextU CryptBinaryToStringA CryptBinaryToStringW CryptCloseAsyncHandle CryptCreateAsyncHandle CryptDecodeMessage CryptDecodeObject CryptDecodeObjectEx CryptDecryptAndVerifyMessageSignature CryptDecryptMessage CryptEncodeObject CryptEncodeObjectEx CryptEncryptMessage CryptEnumOIDFunction CryptEnumOIDInfo CryptEnumProvidersU CryptExportPKCS8 CryptExportPublicKeyInfo CryptExportPublicKeyInfoEx CryptExportPublicKeyInfoFromBCryptKeyHandle CryptFindCertificateKeyProvInfo CryptFindLocalizedName CryptFindOIDInfo CryptFormatObject CryptFreeOIDFunctionAddress CryptGetAsyncParam CryptGetDefaultOIDDllList CryptGetDefaultOIDFunctionAddress CryptGetMessageCertificates CryptGetMessageSignerCount CryptGetOIDFunctionAddress CryptGetOIDFunctionValue CryptHashCertificate CryptHashCertificate2 CryptHashMessage CryptHashPublicKeyInfo CryptHashToBeSigned CryptImportPKCS8 CryptImportPublicKeyInfo CryptImportPublicKeyInfoEx CryptImportPublicKeyInfoEx2 CryptInitOIDFunctionSet CryptInstallOIDFunctionAddress CryptLoadSip CryptMemAlloc CryptMemFree CryptMemRealloc CryptMsgCalculateEncodedLength CryptMsgClose CryptMsgControl CryptMsgCountersign CryptMsgCountersignEncoded CryptMsgDuplicate CryptMsgEncodeAndSignCTL CryptMsgGetAndVerifySigner CryptMsgGetParam CryptMsgOpenToDecode CryptMsgOpenToEncode CryptMsgSignCTL CryptMsgUpdate CryptMsgVerifyCountersignatureEncoded CryptMsgVerifyCountersignatureEncodedEx CryptProtectData CryptProtectMemory CryptQueryObject CryptRegisterDefaultOIDFunction CryptRegisterOIDFunction CryptRegisterOIDInfo CryptRetrieveTimeStamp CryptSIPAddProvider CryptSIPCreateIndirectData CryptSIPGetCaps CryptSIPGetSignedDataMsg CryptSIPLoad CryptSIPPutSignedDataMsg CryptSIPRemoveProvider CryptSIPRemoveSignedDataMsg CryptSIPRetrieveSubjectGuid CryptSIPRetrieveSubjectGuidForCatalogFile CryptSIPVerifyIndirectData CryptSetAsyncParam CryptSetKeyIdentifierProperty CryptSetOIDFunctionValue CryptSetProviderU CryptSignAndEncodeCertificate CryptSignAndEncryptMessage CryptSignCertificate CryptSignHashU CryptSignMessage CryptSignMessageWithKey CryptStringToBinaryA CryptStringToBinaryW CryptUnprotectData CryptUnprotectMemory CryptUnregisterDefaultOIDFunction CryptUnregisterOIDFunction CryptUnregisterOIDInfo CryptVerifyCertificateSignature CryptVerifyCertificateSignatureEx CryptVerifyDetachedMessageHash CryptVerifyDetachedMessageSignature CryptVerifyMessageHash CryptVerifyMessageSignature CryptVerifyMessageSignatureWithKey CryptVerifySignatureU CryptVerifyTimeStampSignature I_CertUpdateStore I_CryptAllocTls I_CryptCreateLruCache I_CryptCreateLruEntry I_CryptDetachTls I_CryptFindLruEntry I_CryptFindLruEntryData I_CryptFlushLruCache I_CryptFreeLruCache I_CryptFreeTls I_CryptGetAsn1Decoder I_CryptGetAsn1Encoder I_CryptGetDefaultCryptProv I_CryptGetDefaultCryptProvForEncrypt I_CryptGetOssGlobal I_CryptGetTls I_CryptInsertLruEntry I_CryptInstallAsn1Module I_CryptInstallOssGlobal I_CryptReadTrustedPublisherDWORDValueFromRegistry I_CryptReleaseLruEntry I_CryptSetTls I_CryptUninstallAsn1Module I_CryptUninstallOssGlobal PFXExportCertStore PFXExportCertStoreEx PFXImportCertStore PFXIsPFXBlob PFXVerifyPassword RegCreateHKCUKeyExU RegCreateKeyExU RegDeleteValueU RegEnumValueU RegOpenHKCUKeyExU RegOpenKeyExU RegQueryInfoKeyU RegQueryValueExU RegSetValueExU

Name

.text

Size

602KB

Virtual Size

602KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.stubtxt

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

186KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symz

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

610cd7aae5ad88766014caa6f313b7564e6d2736e851f25fcc239d6491c4dbbe

msvcrt

bcrypt

ncrypt

user32

advapi32

kernel32_vista

kernel32

ntdll

generic