1bbcb10d8a32f2fe402b0b024face1de9ed1111360d8fefb23bc15ce33b97339

Sharing

Copy URL Twitter E-mail

General

Target
1bbcb10d8a32f2fe402b0b024face1de9ed1111360d8fefb23bc15ce33b97339
Size 390KB
Sample261113-19mmrssw4j
SHA256 1bbcb10d8a32f2fe402b0b024face1de9ed1111360d8fefb23bc15ce33b97339
MD5 9ba5c5d8bd672c5855886bbba18819b0
SHA1 00e20eed7cd3101acd268767ac7ae427bba9cf3d
SHA512 212b93720404d6f0bef5c2b1373786a97da175273738cc52f7885e2be79b87f414da9df9b9378d1caf2e18d79fd7b19a9b8ee83511a5b419d6198a161c14e35b
SSDEEP 6144:DfGq3+0RFl0zY23stDTsEl6msjVx63vhtmT8fn5DgGQXk65y:Du0+zY28BTsEl6msjJB
TLSH
T10D841907A2985466F4B7E33D85679325BBB2BC504735D2CF2311520A2E72BF09E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bbcb10d8a32f2fe402b0b024face1de9ed1111360d8fefb23bc15ce33b97339

File Explorer

1bbcb10d8a32f2fe402b0b024face1de9ed1111360d8fefb23bc15ce33b97339

.dll 390KB

1bbcb10d8a32f2fe402b0b024face1de9ed1111360d8fefb23bc15ce33b97339

IMPHASH a6fd65058fe22be646252903f4ea1437
SHA256 1bbcb10d8a32f2fe402b0b024face1de9ed1111360d8fefb23bc15ce33b97339
MD5 9ba5c5d8bd672c5855886bbba18819b0
SHA1 00e20eed7cd3101acd268767ac7ae427bba9cf3d
SHA512 212b93720404d6f0bef5c2b1373786a97da175273738cc52f7885e2be79b87f414da9df9b9378d1caf2e18d79fd7b19a9b8ee83511a5b419d6198a161c14e35b
SSDEEP 6144:DfGq3+0RFl0zY23stDTsEl6msjVx63vhtmT8fn5DgGQXk65y:Du0+zY28BTsEl6msjJB
TLSH
T10D841907A2985466F4B7E33D85679325BBB2BC504735D2CF2311520A2E72BF09E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

215968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

shell32

DragQueryFileW SHChangeNotify ShellExecuteW

user32

CharLowerBuffW CheckDlgButton DialogBoxParamW EnableWindow EndDialog GetDlgItem GetMonitorInfoW GetParent GetWindowLongW GetWindowRect IsDlgButtonChecked LoadStringW MonitorFromWindow MoveWindow SendMessageW SetDlgItemTextW SetFocus SetWindowLongPtrW ShowWindow

advapi32

RegCloseKey RegCreateKeyW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

msvcrt

__iob_func _aligned_free _aligned_malloc _amsg_exit _beginthreadex _fpreset _initterm _iob _lock _memicmp _onexit _unlock _vsnwprintf _wassert _wcsicmp abort calloc fflush fprintf free getenv iswspace malloc memchr memcmp memcpy memmove memset realloc signal sprintf strcmp strlen strncmp strrchr vfprintf vsprintf wcscat wcschr wcscmp wcscpy wcslen wcstok wcstol wcstoul

kernel32

AcquireSRWLockExclusive CloseHandle DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection ExpandEnvironmentStringsW FindResourceW FlsAlloc FlsGetValue FlsSetValue FlushInstructionCache FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetThreadId GetTickCount GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LockResource MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable lstrcmpiW lstrlenW

ucrtbase

__stdio_common_vfprintf __stdio_common_vsprintf

Name

.text

Size

218KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ATL

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symz

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1bbcb10d8a32f2fe402b0b024face1de9ed1111360d8fefb23bc15ce33b97339

shell32

user32

advapi32

msvcrt

kernel32

ucrtbase

generic