3a01e7244a9612bd2778a1c8c61ddad49a1fe4338a13294c39798091a72289cc

Sharing

Copy URL Twitter E-mail

General

Target
3a01e7244a9612bd2778a1c8c61ddad49a1fe4338a13294c39798091a72289cc
Size 334KB
Sample261113-1w3rtshs21
SHA256 3a01e7244a9612bd2778a1c8c61ddad49a1fe4338a13294c39798091a72289cc
MD5 5b49c621124fca35e70923a593cc6612
SHA1 379f64f7bf6ea0f35ec7cda9881f97a4a92f153f
SHA512 a2bc75072e686c9ded0fb14ed079eba52f7e3e01432a5bd3ec931444fe620a7bae6cdb71da52fd4382261462ba0a0ae52579cbc9c495042fac3470065d1455ed
SSDEEP 6144:/6cCJwRGGdOTVtfgDEcOjGpd0EPVy3aAubo3zsR7TKP13yP/meKFWgM/DA9ijCrc:NCJwRGGdGVtfgDpKt2OekWgvGsM/
TLSH
T101748529E37BB8ECD6AF9171415657337A30798882287F77DBB1D7301E20A60A939734
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a01e7244a9612bd2778a1c8c61ddad49a1fe4338a13294c39798091a72289cc

File Explorer

3a01e7244a9612bd2778a1c8c61ddad49a1fe4338a13294c39798091a72289cc

.dll 334KB

3a01e7244a9612bd2778a1c8c61ddad49a1fe4338a13294c39798091a72289cc

IMPHASH e4ac0e40320efb92547ade6ee61a885c
SHA256 3a01e7244a9612bd2778a1c8c61ddad49a1fe4338a13294c39798091a72289cc
MD5 5b49c621124fca35e70923a593cc6612
SHA1 379f64f7bf6ea0f35ec7cda9881f97a4a92f153f
SHA512 a2bc75072e686c9ded0fb14ed079eba52f7e3e01432a5bd3ec931444fe620a7bae6cdb71da52fd4382261462ba0a0ae52579cbc9c495042fac3470065d1455ed
SSDEEP 6144:/6cCJwRGGdOTVtfgDEcOjGpd0EPVy3aAubo3zsR7TKP13yP/meKFWgM/DA9ijCrc:NCJwRGGdGVtfgDpKt2OekWgvGsM/
TLSH
T101748529E37BB8ECD6AF9171415657337A30798882287F77DBB1D7301E20A60A939734
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

109712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid RegCloseKey RegCreateKeyW RegDeleteKeyW RegEnumKeyW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

user32

BeginPaint CharNextA CharNextW ClientToScreen CreateWindowExW DefWindowProcW DestroyWindow DrawEdge DrawTextW EndPaint GetCapture GetClassInfoExW GetClassInfoW GetClientRect GetCursorPos GetDC GetDesktopWindow GetFocus GetForegroundWindow GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetMonitorInfoW GetParent GetProcessWindowStation GetSystemMetrics GetUserObjectInformationW GetWindow GetWindowLongPtrW GetWindowRect GetWindowThreadProcessId InvalidateRect IsWindow IsWindowUnicode LoadBitmapW LoadCursorW LoadIconW LoadKeyboardLayoutW MapVirtualKeyW MapWindowPoints MessageBeep MonitorFromWindow PostMessageA PostMessageW RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SendMessageA SendMessageTimeoutW SendMessageW SetCapture SetCursor SetRect SetWindowLongPtrW SetWindowPos ShowWindow SystemParametersInfoW ToAsciiEx ToUnicode UnloadKeyboardLayout UpdateWindow User32InitializeImmEntryTable keybd_event

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBitmap CreateFontIndirectW DeleteDC DeleteObject ExtTextOutW GetDIBits GetObjectW GetStockObject GetTextExtentPoint32W GetTextFaceW GetTextMetricsW PatBlt Rectangle SelectObject SetBkColor TranslateCharsetInfo

kernel32

BaseCheckAppcompatCache CloseHandle CreateFileMappingW CreateThread FreeLibrary GetACP GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetFullPathNameW GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleW GetProcAddress GetProfileIntW GetSystemDefaultLCID GetSystemDirectoryW GetThreadLocale GlobalAlloc GlobalFree GlobalHandle GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree IsBadWritePtr IsDBCSLeadByte IsDBCSLeadByteEx LoadLibraryExW LoadLibraryW LocalAlloc LocalFlags LocalFree LocalLock LocalReAlloc LocalSize LocalUnlock MapViewOfFile MultiByteToWideChar OpenFile OpenFileMappingW SetLastError Sleep TlsAlloc TlsGetValue TlsSetValue UnmapViewOfFile WideCharToMultiByte _lclose lstrcmpW lstrcmpiW lstrlenA lstrlenW

ntdll

NtQuerySystemInformation RtlAllocateHeap RtlAssert RtlDeleteCriticalSection RtlDllShutdownInProgress RtlEnterCriticalSection RtlFreeHeap RtlInitUnicodeString RtlInitializeCriticalSection RtlIntegerToUnicodeString RtlIsThreadWithinLoaderCallout RtlLeaveCriticalSection RtlReAllocateHeap RtlUnicodeStringToInteger RtlUnicodeToMultiByteSize _snprintf _vsnprintf _vsnwprintf _wcsicmp bsearch memcmp memcpy memmove memset sprintf strchr strcmp strcpy strcspn strlen vDbgPrintExWithPrefix wcscspn wcslen wcstol

CtfAImmActivate CtfAImmDeactivate CtfAImmIsIME CtfImmCoUninitialize CtfImmDispatchDefImeMessage CtfImmEnterCoInitCountSkipMode CtfImmGenerateMessage CtfImmGetGuidAtom CtfImmHideToolbarWnd CtfImmIsCiceroEnabled CtfImmIsCiceroStartedInThread CtfImmIsGuidMapEnable CtfImmIsTextFrameServiceDisabled CtfImmLastEnabledWndDestroy CtfImmLeaveCoInitCountSkipMode CtfImmRestoreToolbarWnd CtfImmSetAppCompatFlags CtfImmSetCiceroStartInThread CtfImmTIMActivate GetKeyboardLayoutCP ImmActivateLayout ImmAssociateContext ImmAssociateContextEx ImmCallImeConsoleIME ImmConfigureIMEA ImmConfigureIMEW ImmCreateContext ImmCreateIMCC ImmCreateSoftKeyboard ImmDestroyContext ImmDestroyIMCC ImmDestroySoftKeyboard ImmDisableIME ImmDisableIme ImmDisableTextFrameService ImmEnumInputContext ImmEnumRegisterWordA ImmEnumRegisterWordW ImmEscapeA ImmEscapeW ImmFreeLayout ImmGenerateMessage ImmGetAppCompatFlags ImmGetCandidateListA ImmGetCandidateListCountA ImmGetCandidateListCountW ImmGetCandidateListW ImmGetCandidateWindow ImmGetCompositionFontA ImmGetCompositionFontW ImmGetCompositionString ImmGetCompositionStringA ImmGetCompositionStringW ImmGetCompositionWindow ImmGetContext ImmGetConversionListA ImmGetConversionListW ImmGetConversionStatus ImmGetDefaultIMEWnd ImmGetDescriptionA ImmGetDescriptionW ImmGetGuideLineA ImmGetGuideLineW ImmGetHotKey ImmGetIMCCLockCount ImmGetIMCCSize ImmGetIMCLockCount ImmGetIMEFileNameA ImmGetIMEFileNameW ImmGetImeInfoEx ImmGetImeMenuItemsA ImmGetImeMenuItemsW ImmGetOpenStatus ImmGetProperty ImmGetRegisterWordStyleA ImmGetRegisterWordStyleW ImmGetStatusWindowPos ImmGetVirtualKey ImmIMPGetIMEA ImmIMPGetIMEW ImmIMPQueryIMEA ImmIMPQueryIMEW ImmIMPSetIMEA ImmIMPSetIMEW ImmInstallIMEA ImmInstallIMEW ImmIsIME ImmIsUIMessageA ImmIsUIMessageW ImmLoadIME ImmLoadLayout ImmLockClientImc ImmLockIMC ImmLockIMCC ImmLockImeDpi ImmNotifyIME ImmProcessKey ImmPutImeMenuItemsIntoMappedFile ImmReSizeIMCC ImmRegisterClient ImmRegisterWordA ImmRegisterWordW ImmReleaseContext ImmRequestMessageA ImmRequestMessageW ImmSendIMEMessageExA ImmSendIMEMessageExW ImmSetActiveContext ImmSetActiveContextConsoleIME ImmSetCandidateWindow ImmSetCompositionFontA ImmSetCompositionFontW ImmSetCompositionStringA ImmSetCompositionStringW ImmSetCompositionWindow ImmSetConversionStatus ImmSetHotKey ImmSetOpenStatus ImmSetStatusWindowPos ImmShowSoftKeyboard ImmSimulateHotKey ImmSystemHandler ImmTranslateMessage ImmUnlockClientImc ImmUnlockIMC ImmUnlockIMCC ImmUnlockImeDpi ImmUnregisterWordA ImmUnregisterWordW ImmWINNLSEnableIME ImmWINNLSGetEnableStatus ImmWINNLSGetIMEHotkey

Name

.text

Size

249KB

Virtual Size

252KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

34KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.buildid

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symz

Size

23KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3a01e7244a9612bd2778a1c8c61ddad49a1fe4338a13294c39798091a72289cc

advapi32

user32

gdi32

kernel32

ntdll

generic