3dc96e2c4e12931562dd70a58302e789e9a7640a2c88a579e0f18c6fe7b7776e

Sharing

Copy URL Twitter E-mail

General

Target
3dc96e2c4e12931562dd70a58302e789e9a7640a2c88a579e0f18c6fe7b7776e
Size 1.3MB
Sample261113-2edbaasw5p
SHA256 3dc96e2c4e12931562dd70a58302e789e9a7640a2c88a579e0f18c6fe7b7776e
MD5 7e049c398315bea549c69d0cf5404fe6
SHA1 836d229fc0e16ebd1cf9045986240b5ab94dfae4
SHA512 d651e8a36acf3db9871e9ce49ae7a12f36687e65f1637c40d943ee2423c744087c2c4c5c95ce315346a04f647043cbe678f09698aed20274001a7b7240df5c60
SSDEEP 12288:w0fqdvDERH48wGWtTAlnTWfx1riXyYLyO9FpmBVf:w0SdMtCIPFpmB
TLSH
T186651A3B1542EAECF8011537914C4D6D439C2C8F72D37AB3928C6611A83BDD7B9A5AE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3dc96e2c4e12931562dd70a58302e789e9a7640a2c88a579e0f18c6fe7b7776e

File Explorer

3dc96e2c4e12931562dd70a58302e789e9a7640a2c88a579e0f18c6fe7b7776e

.dll 1.3MB

3dc96e2c4e12931562dd70a58302e789e9a7640a2c88a579e0f18c6fe7b7776e

IMPHASH e5b076558180134fae5b3748ef19b821
SHA256 3dc96e2c4e12931562dd70a58302e789e9a7640a2c88a579e0f18c6fe7b7776e
MD5 7e049c398315bea549c69d0cf5404fe6
SHA1 836d229fc0e16ebd1cf9045986240b5ab94dfae4
SHA512 d651e8a36acf3db9871e9ce49ae7a12f36687e65f1637c40d943ee2423c744087c2c4c5c95ce315346a04f647043cbe678f09698aed20274001a7b7240df5c60
SSDEEP 12288:w0fqdvDERH48wGWtTAlnTWfx1riXyYLyO9FpmBVf:w0SdMtCIPFpmB
TLSH
T186651A3B1542EAECF8011537914C4D6D439C2C8F72D37AB3928C6611A83BDD7B9A5AE3
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

246768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegCreateKeyW RegDeleteKeyW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromGUID2

oleaut32

LoadTypeLib RegisterTypeLib SysAllocString SysFreeString UnRegisterTypeLib

shlwapi

AssocCreate PathAppendW StrCatW StrChrW StrCmpNW StrRetToBufW

shell32

CDefFolderMenu_Create2 ord83 ILClone ILCloneFirst ILCombine ILFree ILGetNext ILRemoveLastID SHBindToParent SHCreateShellFolderView SHDefExtractIconW SHGetDesktopFolder

msvcrt

__iob_func _aligned_free _aligned_malloc _amsg_exit _beginthreadex _initterm _iob _lock _memicmp _onexit _snprintf _unlock _vsnprintf _vsnwprintf _wassert abort bsearch calloc fflush fprintf free getenv iswalpha iswspace malloc memchr memcmp memcpy memmove memset realloc sprintf strchr strcmp strcpy strcspn strlen strncmp strrchr vfprintf vsprintf wcscat wcschr wcscpy wcslen wcstol wcstoul

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CloseHandle DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection FindResourceW FlsAlloc FlsGetValue FlsSetValue FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetProcessHeap GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetThreadId GetTickCount HeapAlloc HeapFree HeapReAlloc InitOnceExecuteOnce InitializeCriticalSection K32EnumProcessModules LeaveCriticalSection LoadLibraryExW LoadLibraryW LoadResource MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive ReleaseSRWLockShared SetLastError SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable lstrcmpW lstrcmpiW lstrlenW

ntdll

DbgPrint NtClose NtOpenDirectoryObject NtOpenEvent NtOpenEventPair NtOpenFile NtOpenIoCompletion NtOpenKey NtOpenMutant NtOpenSection NtOpenSemaphore NtOpenSymbolicLinkObject NtOpenTimer NtQueryDirectoryObject NtQuerySymbolicLinkObject RtlAllocateHeap RtlCompareUnicodeString RtlFreeHeap RtlInitUnicodeString RtlReAllocateHeap vDbgPrintExWithPrefix

ucrtbase

__stdio_common_vfprintf __stdio_common_vsprintf

Name

.text

Size

243KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gcc_exc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ATL

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

974KB

Virtual Size

973KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symz

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3dc96e2c4e12931562dd70a58302e789e9a7640a2c88a579e0f18c6fe7b7776e

advapi32

ole32

oleaut32

shlwapi

shell32

msvcrt

kernel32

ntdll

ucrtbase

generic