Taflisha_Pro[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Taflisha_Pro.zip
Size 3.2MB
Sample261113-cpkexaey21
SHA256 e8cc4770d0e3be04f14e63b386260b38448ecc524066cc1a3db01d7646ad1c8b
MD5 16d95ba40ccd09f7d54094147689ada2
SHA1 6d953cd8ed40b4444c34c8bf7d34b00d7194a901
SHA512 1d45d959b0a5b4d5b27a23d731f25ace7e8c3505a3f579b9b0cee45855343e3b60d6485f6971689a614a0ed6424df92e342de8e982a2a49e398218e44cc0ccf2
SSDEEP 98304:sqdz/9ydC8BD1ThY9lom+ZTk7ROLwvtJrdCr:suyd51O0m+ZeROLwvtld6
TLSH
T184F5337A05E6202F36D3C7F9B4519F82B028154DE98E107C0BABE271E9CEDF59978247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Taflisha_Pro.exe

File Explorer

Taflisha_Pro.zip

.zip 3.2MB
Taflisha_Pro.exe

.exe 7.1MB

Taflisha_Pro.zip

SHA256 e8cc4770d0e3be04f14e63b386260b38448ecc524066cc1a3db01d7646ad1c8b
MD5 16d95ba40ccd09f7d54094147689ada2
SHA1 6d953cd8ed40b4444c34c8bf7d34b00d7194a901
SHA512 1d45d959b0a5b4d5b27a23d731f25ace7e8c3505a3f579b9b0cee45855343e3b60d6485f6971689a614a0ed6424df92e342de8e982a2a49e398218e44cc0ccf2
SSDEEP 98304:sqdz/9ydC8BD1ThY9lom+ZTk7ROLwvtJrdCr:suyd51O0m+ZeROLwvtld6
TLSH
T184F5337A05E6202F36D3C7F9B4519F82B028154DE98E107C0BABE271E9CEDF59978247
MD5 SHA1 SHA512 SSDEEP TLSH

Taflisha_Pro.exe

IMPHASH 0b06465460b8091311025a3aa33c21f7
SHA256 fb80f4e579884c60efa57bd8a3726cb256e6367c1db2c960411185cacf022417
MD5 1b10d7aa4b9108e220ef6acb82dc4c77
SHA1 5d15d6ba73dc467ce98f6b73e1326452829be843
SHA512 40e702223b02efeca7bf2645cccfcf61ba0e4a93c695460a62cf4a578d1ca93f12970eb4996de11c30c89685f7df7348801f7f23d83dc8b5032553fcbc974a39
SSDEEP 49152:BvSEs1ti2V4CCp6roWBGshvI8py/Du8JQ6Txe/HJW+Tu7jH7iycW5e2lIbF79qSh:OPrTGsexYHkvH7WEJiTS1EzgwPPxn+B
TLSH
T103764A53F66280ECC169C174931A6632FB32BC89072476EB6BD487213E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5728848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

taflisha_pro.pdb

ntdll

NtWriteFile RtlNtStatusToDosError RtlGetVersion NtCreateFile NtCreateNamedPipeFile NtOpenFile NtReadFile NtDeviceIoControlFile NtCancelIoFileEx

kernel32

CloseHandle HeapReAlloc GetSystemInfo GetCurrentThreadId ResetEvent GetSystemTimeAsFileTime GetModuleHandleA GetWindowsDirectoryW WideCharToMultiByte IsProcessorFeaturePresent HeapFree LoadLibraryW GetProcessHeap UnregisterWaitEx CheckRemoteDebuggerPresent WaitForSingleObject GetCurrentProcessId GetSystemDirectoryW GetModuleHandleW CompareStringOrdinal lstrlenW GetProcAddress IsDebuggerPresent OutputDebugStringA OutputDebugStringW LoadLibraryExW TerminateProcess Sleep SetWaitableTimer FreeLibrary FormatMessageW GetLastError GetExitCodeProcess GetCurrentThread ExitProcess SwitchToThread WaitForMultipleObjects ReleaseMutex SetEvent GetSystemTimePreciseAsFileTime RegisterWaitForSingleObject SetThreadStackGuarantee LoadLibraryA SetLastError WaitForSingleObjectEx GetUserDefaultUILanguage SetHandleInformation SleepEx LCIDToLocaleName FindClose GetCurrentProcess IsThreadAFiber HeapAlloc FlsSetValue FlsFree DuplicateHandle GetModuleHandleExW GetModuleFileNameW PostQueuedCompletionStatus GetFileType GetTempPathW GetFileAttributesW CreateProcessW ReadFile GetOverlappedResult CancelIo CreateThread FindFirstFileExW FindNextFileW CreateEventW CreateDirectoryW FlsAlloc LoadLibraryExA MultiByteToWideChar GetFileInformationByHandleEx GetFileInformationByHandle GetStdHandle GetConsoleMode SetConsoleMode GetConsoleScreenBufferInfo SetConsoleTextAttribute CreateWaitableTimerExW RtlLookupFunctionEntry SetFileInformationByHandle GetQueuedCompletionStatusEx SetFileTime CreateFileW GetFinalPathNameByHandleW GetFullPathNameW WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP CreateMutexA CreateIoCompletionPort SetFileCompletionNotificationModes FreeEnvironmentStringsW GetEnvironmentStringsW GetThreadContext GetEnvironmentVariableW RtlVirtualUnwind RtlCaptureContext EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitializeSListHead UnhandledExceptionFilter QueryPerformanceFrequency SetUnhandledExceptionFilter QueryPerformanceCounter AddVectoredExceptionHandler GetCurrentDirectoryW

user32

DestroyWindow DispatchMessageA GetMessageA SetWindowPos ShowCursor IsProcessDPIAware MonitorFromPoint RegisterRawInputDevices CreateWindowExW RegisterClassExW InvalidateRgn ClipCursor GetClipCursor AdjustWindowRectEx SystemParametersInfoW SetCursor LoadCursorW GetActiveWindow DestroyIcon SetWindowLongW EnableMenuItem GetKeyboardLayout CloseTouchInputHandle GetTouchInputInfo ToUnicodeEx GetMenu TrackMouseEvent SetCapture ReleaseCapture PostMessageW SetFocus GetMonitorInfoW MonitorFromRect MonitorFromWindow FillRect ClientToScreen GetClientRect GetWindowLongW ScreenToClient GetSystemMenu GetWindow DispatchMessageW GetUpdateRect MapVirtualKeyW ValidateRect GetRawInputData GetKeyState GetAsyncKeyState GetKeyboardState SetWindowDisplayAffinity SetWindowLongPtrW TranslateMessage EnumChildWindows RegisterTouchWindow DefWindowProcW RedrawWindow GetMessageW ShowWindow GetWindowLongPtrW SetWindowPlacement ChangeDisplaySettingsExW SendMessageW ReleaseDC RegisterWindowMessageA SystemParametersInfoA SetPropW MapVirtualKeyExW GetDC GetSystemMetrics MsgWaitForMultipleObjectsEx PeekMessageW PostThreadMessageW GetCursorPos GetWindowPlacement GetWindowRect

oleaut32

SetErrorInfo SysFreeString GetErrorInfo SysStringLen

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass

gdi32

GetDeviceCaps CreateSolidBrush CreateRectRgn GetDIBits DeleteObject DeleteDC BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

ole32

RegisterDragDrop RevokeDragDrop OleInitialize CoCreateInstance CoUninitialize CoInitializeEx

imm32

ImmReleaseContext ImmGetCompositionStringW ImmGetContext

shell32

DragQueryFileW SHAppBarMessage DragFinish

shlwapi

SHCreateMemStream

advapi32

RegOpenKeyExW SystemFunction036 RegQueryValueExW RegCloseKey RegGetValueW EventSetInformation EventWriteTransfer EventUnregister EventRegister

combase

CoTaskMemAlloc CoTaskMemFree CoCreateFreeThreadedMarshaler

bcryptprimitives

ProcessPrng

secur32

QueryContextAttributesW FreeCredentialsHandle InitializeSecurityContextW DecryptMessage EncryptMessage FreeContextBuffer AcceptSecurityContext DeleteSecurityContext AcquireCredentialsHandleA

crypt32

CertAddCertificateContextToStore CertDuplicateStore CertOpenStore CertEnumCertificatesInStore CertDuplicateCertificateContext CertDuplicateCertificateChain CertFreeCertificateChain CertFreeCertificateContext CertCloseStore CertVerifyCertificateChainPolicy CertGetCertificateChain

ws2_32

sendto recvfrom WSAIoctl ioctlsocket closesocket WSACleanup shutdown send recv setsockopt freeaddrinfo getaddrinfo accept WSAGetLastError WSAStartup bind listen getsockname connect getsockopt WSASocketW

bcrypt

BCryptGenRandom

cfgmgr32

CM_Get_Device_ID_List_SizeW CM_Get_Device_ID_ListW

iphlpapi

GetAdaptersAddresses

vcruntime140

__C_specific_handler _CxxThrowException __std_exception_destroy __std_exception_copy __current_exception_context __current_exception __CxxFrameHandler3 memcpy memmove memcmp memset _purecall wcsrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

round __setusermatherr floor trunc ceil roundf pow floorf

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen wcscmp

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-runtime-l1-1-0

_exit _seh_filter_exe __p___argc __p___argv _cexit _initterm_e _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initialize_narrow_environment _configure_narrow_argv _set_app_type _c_exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode free