syncbackupshell[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

syncbackupshell.exe
Size

3.8MB
MD5

1634be73de99e1dd06e7a8499b5c770b
SHA1

ee2e5befc1c3b33424841c857c284b7a9a92ebb7
SHA256

d8ad5a0c2afa065383e238f6d4d3b2c44cc6f3d6776200546d1ed91e3cd8a6b8
SHA512

b47566bd6041b68de5f5cf64984752a1de27d231b3b4db2eeabed65bb9ef9542fcb449e83480602dc7cd7a3562acd3cf50c313a5f6c5c2792259c848f7b0cd8f
SSDEEP

98304:1WweLYMlXCweXe4lXQvpo4ay/XQScwpIzT:1iHeX9epo4ay/O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
syncbackupshell.exe

Files

syncbackupshell.exe
.exe windows x86

dedde2b5fa10760f19f8da43b9b05b04

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
VerInstallFileA

kernel32

GetModuleHandleA
GetModuleHandleW
GetPriorityClass
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeExA
GetStringTypeExW
GetSystemDirectoryA
GetSystemTime
GetTempFileNameA
GetTempPathA
GetThreadContext
GetThreadLocale
GetThreadPriority
GetUserDefaultLCID
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
GlobalAddAtomA
GlobalAlloc
GlobalFindAtomA
GlobalFree
GlobalHandle
GlobalLock
GlobalMemoryStatus
GlobalReAlloc
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadReadPtr
IsValidLocale
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadResource
LocalFileTimeToFileTime
LocalSize
LockResource
lstrcmpA
lstrcpyA
lstrcpynA
lstrlenA
lstrlenW
MapViewOfFile
MoveFileA
MoveFileW
MulDiv
MultiByteToWideChar
GetModuleFileNameW
OpenMutexW
OpenProcess
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReadProcessMemory
ReleaseMutex
RemoveDirectoryA
RemoveDirectoryW
ResetEvent
ResumeThread
SetEndOfFile
SetErrorMode
SetEvent
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
SetThreadLocale
SetThreadPriority
SetUnhandledExceptionFilter
SetVolumeLabelA
SizeofResource
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
IsValidCodePage
EnterCriticalSection
GetConsoleCP
GetModuleFileNameA
GetLocalTime
GetLastError
GetFullPathNameW
GetFullPathNameA
GetFileType
GetFileTime
RtlUnwind
GetVersion
GetFileSize
GetFileAttributesW
GetFileAttributesA
GetDriveTypeA
GetDiskFreeSpaceA
GetCurrentProcess
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
HeapDestroy
HeapCreate
GetDateFormatA
GetCurrentDirectoryW
GetCurrentDirectoryA
GetCPInfo
GetComputerNameA
GetCommandLineW
GetCommandLineA
GetACP
FreeResource
FreeLibrary
FormatMessageW
FormatMessageA
FlushInstructionCache
FlushFileBuffers
FindResourceA
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GlobalDeleteAtom
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
LocalAlloc
LocalFree
ExitProcess
WriteFile
GetOEMCP
HeapReAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
OpenFileMappingA
CloseHandle

user32

MapWindowPoints
MessageBeep
MessageBoxA
OemToCharA
OemToCharBuffA
OffsetRect
OpenClipboard
PeekMessageA
PeekMessageW
PostMessageA
PostQuitMessage
PostThreadMessageA
PtInRect
RedrawWindow
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemoveMenu
RemovePropA
ScreenToClient
ScrollWindow
SendMessageA
SendMessageTimeoutA
SendMessageW
SetActiveWindow
SetCapture
SetClassLongA
SetClipboardData
SetCursor
SetFocus
SetForegroundWindow
SetMenuItemInfoA
SetParent
SetPropA
SetRect
SetScrollInfo
SetScrollPos
SetScrollRange
SetTimer
SetWindowLongA
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowsHookExA
SetWindowTextA
ShowOwnedPopups
ShowScrollBar
ShowWindow
SystemParametersInfoA
TrackPopupMenu
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UpdateWindow
WaitMessage
WindowFromPoint
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadImageA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetMessageW
GetMessageTime
GetMessagePos
GetMessageA
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetLastActivePopup
GetKeyState
GetKeyNameTextA
GetKeyboardType
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutList
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetCursorPos
GetClipboardData
GetClientRect
GetClassNameA
GetClassLongA
GetCapture
GetActiveWindow
FrameRect
FindWindowW
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextA
DrawMenuBar
DrawIconEx
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
GetClassInfoA

gdi32

GetTextMetricsA
GetWindowOrgEx
GetWinMetaFileBits
IntersectClipRect
LineTo
LPtoDP
MaskBlt
MoveToEx
PatBlt
PlayEnhMetaFile
RealizePalette
Rectangle
RectVisible
RestoreDC
SaveDC
SelectClipRgn
GetTextFaceA
SelectPalette
SetBkColor
SetBkMode
SetBrushOrgEx
SetMapMode
SetPixel
SetROP2
SetStretchBltMode
SetTextColor
SetViewportOrgEx
SetWindowOrgEx
SetWinMetaFileBits
StretchBlt
TextOutA
GetRgnBox
UnrealizeObject
GetTextExtentPointA
GetTextExtentPoint32A
GetSystemPaletteEntries
SelectObject
GetDIBits
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionA
GetEnhMetaFileBits
GetStockObject

winspool.drv

StartDocPrinterW
StartPagePrinter
WritePrinter
WaitForPrinterChange
XcvDataW
StartDocPrinterA
SetPrinterW

advapi32

RegSetValueExA
InitializeSecurityDescriptor
RegFlushKey
SetSecurityDescriptorDacl

ole32

StringFromCLSID
ProgIDFromCLSID

oleaut32

SysAllocStringLen
SysFreeString
SysReAllocStringLen
VariantChangeType
VariantClear
VariantCopy
VariantInit

Sections

.text
Size: 428KB - Virtual size: 424KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 537B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.los531
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dedde2b5fa10760f19f8da43b9b05b04

Headers

File Characteristics

Imports

version

kernel32

user32

gdi32

winspool.drv

advapi32

ole32

oleaut32

Sections

.text Size: 428KB - Virtual size: 424KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 12.1MB

.data1 Size: 4KB - Virtual size: 537B

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.los531 Size: 1.8MB - Virtual size: 1.8MB

.text
Size: 428KB - Virtual size: 424KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 12.1MB

.data1
Size: 4KB - Virtual size: 537B

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.los531
Size: 1.8MB - Virtual size: 1.8MB