a760ae3c9b6fb9bc4cb25c5431592ae9c30c4072247a01860a441ecc03e0d39e

Sharing

Copy URL Twitter E-mail

General

Target
a760ae3c9b6fb9bc4cb25c5431592ae9c30c4072247a01860a441ecc03e0d39e
Size 2.6MB
Sample261113-sdlrlacy8y
SHA256 a760ae3c9b6fb9bc4cb25c5431592ae9c30c4072247a01860a441ecc03e0d39e
MD5 aadbc99d3fcc8c65343ed049977822e4
SHA1 6cc46ac669010d833ea934ad6e10821b46083f73
SHA512 995807a278355b2f34dbd6956184197924977651d2040ae66525a55afdfc0e9db2000a7e2c56c1e38d1395be4f3804908ce5ad1026dd6452a9c83be94fee9652
SSDEEP 49152:eR4R8Bva4Cw2BYzauuvBES1Kj1VjddWMJ5HFQITNXihnTTF2E5V+umuI:egiYtPJKjbrWO51XY/5V+umuI
TLSH
T1A1C5BF03F3E701F9C46DC678971A5B33EE7074461E34B9EF07A40A642E66F61A62DB09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a760ae3c9b6fb9bc4cb25c5431592ae9c30c4072247a01860a441ecc03e0d39e

File Explorer

a760ae3c9b6fb9bc4cb25c5431592ae9c30c4072247a01860a441ecc03e0d39e

.exe 2.6MB

a760ae3c9b6fb9bc4cb25c5431592ae9c30c4072247a01860a441ecc03e0d39e

IMPHASH cbd4ced66eea85f5d35ada83f4408be0
SHA256 a760ae3c9b6fb9bc4cb25c5431592ae9c30c4072247a01860a441ecc03e0d39e
MD5 aadbc99d3fcc8c65343ed049977822e4
SHA1 6cc46ac669010d833ea934ad6e10821b46083f73
SHA512 995807a278355b2f34dbd6956184197924977651d2040ae66525a55afdfc0e9db2000a7e2c56c1e38d1395be4f3804908ce5ad1026dd6452a9c83be94fee9652
SSDEEP 49152:eR4R8Bva4Cw2BYzauuvBES1Kj1VjddWMJ5HFQITNXihnTTF2E5V+umuI:egiYtPJKjbrWO51XY/5V+umuI
TLSH
T1A1C5BF03F3E701F9C46DC678971A5B33EE7074461E34B9EF07A40A642E66F61A62DB09
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1714816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

moe_map.pdb

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenRandom BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

ws2_32

WSAGetLastError WSAPoll WSASetLastError WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt htonl htons inet_addr ioctlsocket listen ntohs recv recvfrom send sendto setsockopt shutdown socket

dinput8

DirectInput8Create

user32

BringWindowToTop CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW EndDialog GetClassNameA GetClassNameW GetClientRect GetClipboardData GetDlgItem GetDlgItemTextW GetDpiForSystem GetDpiForWindow GetForegroundWindow GetKeyState GetLastInputInfo GetMessageW GetMonitorInfoW GetPropW GetWindowLongPtrW GetWindowRect GetWindowThreadProcessId IsChild IsClipboardFormatAvailable IsIconic IsWindow IsWindowVisible KillTimer LoadCursorW LoadIconW LoadStringW MapVirtualKeyExA MessageBoxTimeoutW MonitorFromWindow OpenClipboard PeekMessageW PostMessageW PostQuitMessage RegisterClassExW RegisterWindowMessageW RemovePropW SendMessageW SetDlgItemTextW SetFocus SetForegroundWindow SetLayeredWindowAttributes SetPropW SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow TranslateMessage UpdateWindow

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantClear VariantInit

shell32

CommandLineToArgvW ShellExecuteA ShellExecuteExA ShellExecuteW Shell_NotifyIconW

advapi32

AddAccessAllowedAceEx AdjustTokenPrivileges CloseServiceHandle CloseTrace ControlService ControlTraceA ConvertSecurityDescriptorToStringSecurityDescriptorA ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorA ConvertStringSidToSidW CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext DeleteService EnableTraceEx2 EventRegister EventSetInformation EventUnregister EventWriteTransfer GetLengthSid GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetUserNameW InitializeAcl InitializeSecurityDescriptor LookupPrivilegeValueA OpenProcessToken OpenSCManagerA OpenServiceA OpenTraceA ProcessTrace QueryServiceStatus RegCloseKey RegCreateKeyExA RegFlushKey RegGetKeySecurity RegGetValueW RegOpenKeyA RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetKeySecurity RegSetValueExA SetSecurityDescriptorControl SetSecurityDescriptorDacl StartTraceA SystemFunction036

comctl32

InitCommonControlsEx

winsqlite3

sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_text sqlite3_busy_timeout sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_column_bytes sqlite3_column_int sqlite3_column_int64 sqlite3_column_text sqlite3_column_type sqlite3_exec sqlite3_finalize sqlite3_free sqlite3_malloc64 sqlite3_open_v2 sqlite3_prepare_v2 sqlite3_reset sqlite3_step

ntdll

NtQueryInformationProcess NtQueryVirtualMemory NtReadVirtualMemory NtTerminateProcess RtlCaptureContext RtlCaptureStackBackTrace RtlCrc64 RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind

secur32

AcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextA QueryContextAttributesA

ole32

CoAllowSetForegroundWindow CoCreateInstance CoInitializeEx CoInitializeSecurity CoTaskMemAlloc CoTaskMemFree CoUninitialize CreateStreamOnHGlobal

iphlpapi

GetAdaptersAddresses GetTcpTable2 SetTcpEntry

version

VerQueryValueW

dbghelp

SymGetSymFromAddr64 SymInitialize

wininet

HttpAddRequestHeadersA HttpAddRequestHeadersW HttpOpenRequestA HttpOpenRequestW HttpQueryInfoA HttpQueryInfoW HttpSendRequestA HttpSendRequestW InternetCloseHandle InternetConnectA InternetConnectW InternetOpenA InternetOpenUrlA InternetOpenW InternetReadFile InternetSetOptionA InternetSetOptionW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CancelWaitableTimer CheckRemoteDebuggerPresent CloseHandle CompareFileTime CompareStringW CopyFileA CreateDirectoryA CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateMutexA CreateMutexW CreatePipe CreateProcessA CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot CreateWaitableTimerA DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FindResourceA FindResourceExW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FlushViewOfFile FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoA GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemWindowsDirectoryW GetTempFileNameA GetTempFileNameW GetTempPathW GetThreadContext GetThreadId GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultUILanguage GetWindowsDirectoryW GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock InterlockedFlushSList IsBadReadPtr IsBadStringPtrA IsBadStringPtrW IsBadWritePtr IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsWow64Process2 K32EnumProcessModulesEx K32EnumProcesses K32GetModuleFileNameExA K32GetModuleInformation LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LockFileEx LockResource MapViewOfFile MoveFileA MoveFileExA MoveFileExW MulDiv MultiByteToWideChar OpenEventW OpenFileMappingW OpenProcess OpenThread OutputDebugStringA OutputDebugStringW PeekNamedPipe Process32First Process32FirstW Process32Next Process32NextW QueryFullProcessImageNameA QueryPerformanceCounter QueryPerformanceFrequency QueueUserAPC RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryA ResetEvent ResumeThread SetEndOfFile SetEnvironmentVariableW SetErrorMode SetEvent SetFileAttributesA SetFilePointerEx SetLastError SetStdHandle SetThreadContext SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer SizeofResource Sleep SleepConditionVariableSRW SuspendThread SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

291KB

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

273KB

Virtual Size

14.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.burn

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mmtab

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

133KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a760ae3c9b6fb9bc4cb25c5431592ae9c30c4072247a01860a441ecc03e0d39e

bcrypt

ws2_32

dinput8

user32

oleaut32

shell32

advapi32

comctl32

winsqlite3

ntdll

secur32

ole32

iphlpapi

version

dbghelp

wininet

kernel32

generic