f5834d41d2e2bfe6dc62c9ab3432f2a128e9192cb458592206f20446d8af9bbf

Sharing

Copy URL Twitter E-mail

General

Target
f5834d41d2e2bfe6dc62c9ab3432f2a128e9192cb458592206f20446d8af9bbf
Size 1.1MB
Sample261113-dkfftsfw3r
SHA256 f5834d41d2e2bfe6dc62c9ab3432f2a128e9192cb458592206f20446d8af9bbf
MD5 636409366bb4e1e6d5876b8c61270959
SHA1 444939f00feca644f05e2ef028039538320e6fb2
SHA512 0557f0ca6c55a145a877f6fc504df8867c052401f207ce13e3e22df1b0ee2275cc43d6d1805dcaeff4759ce13b7a045d24ea9a81494fd8ebbacdbde8316d866e
SSDEEP 24576:5I8299Pw2j2xzUm07pgFPzUJIeHSfgbCnvE:S99PwCpgFPzUJIe+nvE
TLSH
T106356B1BABE521F5D477C17CCD6A4406E7B3786507718BCF12A14A9B1F232E09E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5834d41d2e2bfe6dc62c9ab3432f2a128e9192cb458592206f20446d8af9bbf

File Explorer

f5834d41d2e2bfe6dc62c9ab3432f2a128e9192cb458592206f20446d8af9bbf

.exe 1.1MB

f5834d41d2e2bfe6dc62c9ab3432f2a128e9192cb458592206f20446d8af9bbf

IMPHASH 41e8a18f192d72691ee97c5df9a8e277
SHA256 f5834d41d2e2bfe6dc62c9ab3432f2a128e9192cb458592206f20446d8af9bbf
MD5 636409366bb4e1e6d5876b8c61270959
SHA1 444939f00feca644f05e2ef028039538320e6fb2
SHA512 0557f0ca6c55a145a877f6fc504df8867c052401f207ce13e3e22df1b0ee2275cc43d6d1805dcaeff4759ce13b7a045d24ea9a81494fd8ebbacdbde8316d866e
SSDEEP 24576:5I8299Pw2j2xzUm07pgFPzUJIeHSfgbCnvE:S99PwCpgFPzUJIe+nvE
TLSH
T106356B1BABE521F5D477C17CCD6A4406E7B3786507718BCF12A14A9B1F232E09E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

519296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\o_installer\Build\x64\UnicodeRelease\SamanUninstaller\SamanUninstaller.pdb

kernel32

GetUserDefaultUILanguage WaitForMultipleObjects WaitForSingleObject CreateEventW GetExitCodeProcess LoadLibraryExA VirtualQuery GetSystemInfo WriteConsoleW SetEndOfFile HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW GetFileSizeEx GetConsoleOutputCP FlushFileBuffers SetFilePointerEx ReadConsoleW GetConsoleMode HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc VerifyVersionInfoW GetFileType SetStdHandle GetTimeZoneInformation GetCommandLineW GetCommandLineA FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RaiseException OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo GetStringTypeW LCMapStringEx EncodePointer LeaveCriticalSection EnterCriticalSection VerSetConditionMask Process32FirstW Process32NextW CreateToolhelp32Snapshot SetFileAttributesW GetVersionExW FindClose GetEnvironmentVariableW K32GetModuleFileNameExW GetFinalPathNameByHandleW TerminateProcess GetStdHandle GetCurrentProcess FindNextFileW FindFirstFileW GetProcessHeap HeapAlloc GetCurrentThreadId HeapFree lstrcmpiW lstrcpyW lstrcpynW GetLocalTime GetLastError GlobalAlloc LockResource SizeofResource FreeResource LoadResource FindResourceW SystemTimeToFileTime LocalFileTimeToFileTime GetFileAttributesW SetFilePointer WriteFile LocalFree FormatMessageW InitializeCriticalSectionAndSpinCount ExitProcess GetACP GlobalUnlock GlobalLock CloseHandle ReadFile GetFileSize CreateFileW lstrlenW GetTickCount WideCharToMultiByte GetCurrentDirectoryW GetModuleFileNameW OpenProcess MulDiv GetProcAddress LoadLibraryW LoadLibraryExW MultiByteToWideChar MoveFileW CopyFileW DeleteCriticalSection SetCurrentDirectoryW DecodePointer Sleep InitializeCriticalSectionEx RemoveDirectoryW GetModuleHandleW GetCurrentProcessId MoveFileExW DeleteFileW GetModuleHandleExW RtlUnwind

user32

MapVirtualKeyExW GetKeyboardLayout GetKeyNameTextW SetFocus SetWindowTextW GetWindowRect MonitorFromWindow GetDC ReleaseDC RegisterWindowMessageW SendMessageW ScreenToClient PostQuitMessage MessageBoxW EnableMenuItem AppendMenuW CreatePopupMenu GetCaretBlinkTime SetForegroundWindow TrackPopupMenu DestroyMenu IsWindowEnabled UpdateWindow EqualRect GetWindowTextLengthW GetWindowTextW InvalidateRgn CreateAcceleratorTableW GetGUIThreadInfo DrawTextA ClientToScreen SetCaretPos GetCaretPos HideCaret ShowCaret CreateCaret CharPrevW SetRect DrawTextW FillRect GetWindowRgn UpdateLayeredWindow GetMenu AdjustWindowRectEx GetPropW SetPropW CallWindowProcW GetWindowLongPtrW RegisterClassExW GetClassInfoExW RegisterClassW EnableWindow ShowWindow SetWindowLongPtrW DefWindowProcW SetWindowRgn MoveWindow LoadCursorW SetCursor InflateRect LoadImageW GetParent PostMessageW SetCapture KillTimer SetTimer GetFocus IsZoomed DispatchMessageW TranslateMessage GetMessageW InvalidateRect GetSysColor ReleaseCapture PtInRect GetCursorPos CreateWindowExW OffsetRect GetMonitorInfoW MapWindowPoints IntersectRect IsWindowVisible IsWindow UnionRect IsRectEmpty GetUpdateRect EndPaint BeginPaint GetWindow GetActiveWindow IsIconic SetWindowLongW GetWindowLongW SetWindowPos GetClientRect DestroyWindow CharNextW GetKeyState

gdi32

CombineRgn ExtSelectClipRgn CreateRectRgnIndirect GetClipBox SelectClipRgn PtInRegion CreateRectRgn CreateDIBSection CreateRoundRectRgn PlayEnhMetaFile CreateCompatibleBitmap GetEnhMetaFileHeader CreateDIBitmap AddFontMemResourceEx GetTextMetricsW StretchBlt CreateEnhMetaFileW SetWindowOrgEx Rectangle RestoreDC BitBlt SaveDC SelectObject CreateCompatibleDC DeleteDC DeleteObject CreatePen CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps GetCurrentObject SetStretchBltMode CreateSolidBrush CreatePenIndirect MoveToEx LineTo GetObjectA SetBkMode SetTextColor SetBkColor GetCharABCWidthsW GetTextExtentPoint32W TextOutW GdiFlush EnumFontFamiliesExW CreatePatternBrush GetTextExtentPointA GetBitmapBits CloseEnhMetaFile RemoveFontMemResourceEx SetBitmapBits

advapi32

FreeSid RegEnumValueW RegDeleteValueW RegOpenKeyExW AllocateAndInitializeSid RegSetValueExW RegQueryValueExW CheckTokenMembership RegCloseKey RegDeleteKeyExW RegQueryInfoKeyW RegDeleteTreeW

shell32

SHGetSpecialFolderLocation SHCreateDirectoryExW DragQueryFileW SHChangeNotify ShellExecuteW SHGetSpecialFolderPathW

ole32

CoInitializeSecurity CoTaskMemFree CLSIDFromProgID CLSIDFromString OleLockRunning CreateStreamOnHGlobal ReleaseStgMedium RegisterDragDrop DoDragDrop CoCreateInstance OleDuplicateData CoUninitialize CoInitialize StringFromGUID2

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

comctl32

_TrackMouseEvent InitCommonControlsEx ord17

shlwapi

PathIsDirectoryW StrStrIW PathFindFileNameW SHDeleteKeyW PathFindExtensionW SHDeleteValueW SHGetValueW PathFileExistsW

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

711KB

Virtual Size

710KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

250KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f5834d41d2e2bfe6dc62c9ab3432f2a128e9192cb458592206f20446d8af9bbf

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

generic