acronis[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

acronis.exe
Size

15.0MB
MD5

6e8e54e35b60e455cbe1da96dc0a5de9
SHA1

0864369177b5832af99a22de58c4044c72b65ca1
SHA256

244d0bd25760b9cf6fabed6654b0c6f064fd097b2ffd7e2a2f4eb3d80c7be6a2
SHA512

6cd5e3ca2b037f97c292ae25ab68d0f37e33c43467e5d413386afd3003babbc0325e04bacba008309eccc281367fe25b49d2ea2790062d4a1e0852c376313473
SSDEEP

196608:2XVJkfnqq9MNxlyV93hEE9FqIcKVvfyiFCU/it+khiCJ5pMO8U9pIuAlH3:2Snqq9MNx0l15CyDkhiCJ5WUjIplX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
acronis.exe

Files

acronis.exe
.exe windows x86

9344c3252b7471cd44646e07ad413527

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipCreateFontFamilyFromName
GdipFillRectangleI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipDisposeImage
GdipCloneImage
GdipFree
GdipCreatePen1
GdipDeletePen
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipDrawRectangleI
GdipDrawImagePointRectI
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatAlign
GdipGetStringFormatAlign
GdipSetStringFormatLineAlign
GdipGetStringFormatLineAlign
GdipGetEmHeight
GdipGetCellDescent
GdipGetFamily
GdipGetFontStyle
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipGetFontSize
GdipCreateStringFormat
GdipSetImageAttributesRemapTable
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipSetWorldTransform
GdipResetWorldTransform
GdipSetClipRect
GdipResetClip
GdipLoadImageFromStream
GdipDrawLineI
GdipDeleteFontFamily
GdipFillRegion
GdipDeleteRegion
GdipCreateRegionHrgn
GdipDrawImageRectRectI
GdipGetImageHeight
GdipGetImageWidth
GdiplusShutdown
GdiplusStartup
GdipDeleteFont
GdipAlloc

advapi32

StartServiceW
QueryServiceStatusEx
QueryServiceConfig2W
QueryServiceConfigW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
AllocateAndInitializeSid
FreeSid
LogonUserW
CheckTokenMembership
RegOpenKeyExA
InitiateSystemShutdownW
OpenProcessToken
OpenThreadToken
GetTokenInformation
AdjustTokenPrivileges
IsValidSid
EqualSid
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountSidW
LookupAccountNameW
LookupPrivilegeValueA
GetUserNameA
GetUserNameW
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegEnumValueW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegQueryInfoKeyA
RegSetKeySecurity
SetSecurityInfo
GetFileSecurityW
CloseServiceHandle
CreateProcessAsUserW
CreateProcessWithLogonW
DuplicateTokenEx
RevertToSelf
ImpersonateLoggedOnUser
EncryptFileW
DecryptFileW
GetSecurityDescriptorOwner
SetFileSecurityW
OpenEncryptedFileRawW
ReadEncryptedFileRaw
WriteEncryptedFileRaw
CloseEncryptedFileRaw
SetThreadToken
ChangeServiceConfigW
ChangeServiceConfig2W
ControlService
CreateServiceW
DeleteService
EnumDependentServicesW
OpenSCManagerW
OpenServiceW
ConvertSecurityDescriptorToStringSecurityDescriptorW

kernel32

FlushInstructionCache
GetCurrentProcess
SetLastError
GetEnvironmentVariableW
SetErrorMode
LoadLibraryExA
GetVersion
GetShortPathNameA
CloseHandle
GetSystemInfo
CreateProcessA
GetWindowsDirectoryA
RemoveDirectoryA
RemoveDirectoryW
DeleteFileA
DeleteFileW
MoveFileA
MoveFileW
MoveFileExW
GetComputerNameExW
GetVersionExA
LocalAlloc
GetCurrentThread
GetShortPathNameW
FormatMessageA
GetLogicalDriveStringsA
GetLogicalDriveStringsW
LoadLibraryW
GetModuleFileNameA
CreateProcessW
GetStartupInfoA
GetStartupInfoW
GetEnvironmentVariableA
SetEnvironmentVariableA
SetEnvironmentVariableW
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
OutputDebugStringA
OutputDebugStringW
GetDriveTypeA
GetDriveTypeW
GetSystemDirectoryA
GetSystemDirectoryW
GetTempPathA
GetTempPathW
GetTempFileNameA
GetTempFileNameW
GetWindowsDirectoryW
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
CreateDirectoryA
CreateDirectoryW
GetFullPathNameA
GetFullPathNameW
CreateFileA
CreateFileW
SetFileAttributesA
SetFileAttributesW
GetFileAttributesA
GetFileAttributesW
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
CopyFileA
CopyFileW
GetComputerNameA
GetComputerNameW
SetComputerNameA
SetComputerNameW
WideCharToMultiByte
GetLocaleInfoA
GetLocaleInfoW
FormatMessageW
GetTimeFormatW
GetDateFormatA
GetDateFormatW
GetNumberFormatA
GetNumberFormatW
WriteConsoleA
WriteConsoleW
GetConsoleOutputCP
GetVersionExW
SuspendThread
ResumeThread
DuplicateHandle
GetLogicalDrives
GetDiskFreeSpaceExW
GlobalLock
GlobalUnlock
TerminateProcess
GetExitCodeProcess
GetEnvironmentStringsW
FreeEnvironmentStringsW
WaitForSingleObject
GetFileType
GetStdHandle
SetHandleInformation
CreatePipe
WriteFile
ReadFile
IsDebuggerPresent
DebugBreak
SetEvent
ResetEvent
WaitForMultipleObjects
CreateEventA
GetCurrentProcessId
SetThreadPriority
GetThreadPriority
TerminateThread
Sleep
InitializeCriticalSection
GetTickCount
LCMapStringA
LCMapStringW
GetFileInformationByHandle
DeviceIoControl
GetProcessWorkingSetSize
SetProcessWorkingSetSize
LockFileEx
UnlockFileEx
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileTime
GetDiskFreeSpaceW
CreateHardLinkW
GetVolumeInformationW
FindFirstChangeNotificationW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
CompareStringW
FindNextChangeNotification
FindCloseChangeNotification
GetFileTime
BackupRead
BackupSeek
BackupWrite
GetFileAttributesExW
LockResource
ExitThread
FindResourceExW
EnumResourceNamesW
EnumResourceLanguagesW
QueryDosDeviceA
GetSystemDefaultLangID
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
CreateThread
CancelIo
GetLocalTime
SystemTimeToFileTime
FindClose
FileTimeToLocalFileTime
GetUserDefaultUILanguage
AreFileApisANSI
GetSystemTime
GetDiskFreeSpaceA
CreateFileMappingW
CreateFileMappingA
HeapValidate
HeapCreate
WaitForSingleObjectEx
LockFile
FlushViewOfFile
UnlockFile
InterlockedCompareExchange
QueryPerformanceCounter
UnmapViewOfFile
MapViewOfFile
HeapCompact
CreateMutexW
GetFileSize
TryEnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
MulDiv
GlobalAlloc
GlobalFree
LocalFree
MultiByteToWideChar
FindResourceW
GetModuleHandleA
GetModuleFileNameW
LoadLibraryExW
LoadLibraryA
lstrcmpiW
SizeofResource
LoadResource
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
VerifyVersionInfoW
GetModuleHandleW
GetCommandLineW
EncodePointer
RtlUnwind
IsProcessorFeaturePresent
GetCPInfo
ExitProcess
GetModuleHandleExW
SetFilePointerEx
SetStdHandle
PeekNamedPipe
FileTimeToSystemTime
GetConsoleMode
ReadConsoleW
GetACP
GetConsoleCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateEventW
CreateSemaphoreW
IsValidCodePage
GetOEMCP
GetProcAddress
VerSetConditionMask
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
GetStringTypeW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
VirtualAlloc
VirtualFree
ReleaseSemaphore
CreateSemaphoreA
GetThreadLocale
SleepEx
QueryPerformanceFrequency
CompareFileTime
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
DecodePointer
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
VirtualProtect
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
GetTimeFormatA
lstrlenA

user32

IsCharAlphaNumericW
wvsprintfW
VkKeyScanW
VkKeyScanA
GetClipboardFormatNameW
GetClipboardFormatNameA
RegisterClipboardFormatW
RegisterClipboardFormatA
CreateDialogIndirectParamW
CreateDialogIndirectParamA
RegisterClassExA
DefWindowProcA
PostMessageA
SendNotifyMessageW
SendNotifyMessageA
SendMessageA
PeekMessageW
PeekMessageA
DispatchMessageW
DispatchMessageA
wsprintfW
GetUserObjectInformationA
GetProcessWindowStation
GetWindowLongA
SetWindowLongA
WinHelpA
WinHelpW
SystemParametersInfoA
SystemParametersInfoW
SetWindowTextA
CharUpperBuffW
GetMessageA
TranslateMessage
CreateWindowExA
IsWindowEnabled
SetWindowRgn
GetDesktopWindow
SetWindowTextW
SwitchToThisWindow
GetActiveWindow
GetDlgCtrlID
IsWindowVisible
IsWindow
EnableWindow
ReleaseDC
GetDC
SetForegroundWindow
GetSystemMetrics
DialogBoxParamW
CharNextW
DestroyWindow
LoadImageW
LoadIconW
LoadCursorW
GetScrollInfo
UpdateLayeredWindow
GetClassInfoExW
GetWindowTextW
GetWindowTextLengthW
RedrawWindow
IntersectRect
CallWindowProcW
SetCursor
ModifyMenuW
ModifyMenuA
AppendMenuW
AppendMenuA
VkKeyScanExW
MessageBoxA
VkKeyScanExA
GetClassNameA
SetParent
SetWindowLongW
GetWindowLongW
GetWindowRect
InvalidateRect
EndPaint
BeginPaint
UpdateWindow
ReleaseCapture
SetCapture
GetFocus
SetFocus
GetDlgItem
EndDialog
SetWindowPos
ShowWindow
CreateWindowExW
RegisterClassExW
PostMessageW
MessageBoxExW
SendMessageW
KillTimer
SetTimer
DefWindowProcW
UnregisterClassW
FillRect
ScreenToClient
GetCursorPos

gdi32

TextOutW
GetObjectW
DPtoLP
SetTextColor
GetStockObject
GetTextExtentPoint32W
CreateRectRgn
GetDeviceCaps
GetTextMetricsW
GetTextMetricsA
EnumFontFamiliesExW
EnumFontFamiliesExA
CreateFontIndirectW
CreateFontIndirectA
CreateRoundRectRgn
CreateSolidBrush
SetViewportOrgEx
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SetBkColor
BitBlt

comctl32

InitCommonControlsEx

ws2_32

WSARecv
WSACleanup
bind
closesocket
ioctlsocket
htonl
htons
inet_addr
recv
sendto
socket
WSAGetLastError
WSAGetOverlappedResult
gethostname
WSAIoctl
WSASetLastError
WSAEventSelect
WSAEnumNetworkEvents
getpeername
getsockname
ntohs
setsockopt
getaddrinfo
freeaddrinfo
getnameinfo
__WSAFDIsSet
connect
select
shutdown
WSASend
WSACloseEvent
WSACreateEvent
WSAResetEvent
WSASetEvent
WSAWaitForMultipleEvents
ntohl
accept
getsockopt
listen
recvfrom
send
gethostbyname
WSAStartup

shell32

SHGetPathFromIDListW
SHGetFolderPathW
SHGetFolderPathA
SHBrowseForFolderW
ShellExecuteA
ShellExecuteW
ShellExecuteExA
ShellExecuteExW
SHGetFileInfoA
SHGetPathFromIDListA
SHGetSpecialFolderPathW
SHGetMalloc
SHGetDesktopFolder
Shell_NotifyIconA

comdlg32

GetOpenFileNameA
GetOpenFileNameW
GetSaveFileNameA
GetSaveFileNameW

ole32

CoInitializeSecurity
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
CoInitializeEx
OleRun
ReleaseStgMedium
CreateStreamOnHGlobal
CoSetProxyBlanket

oleaut32

SafeArrayGetDim
SysStringLen
VariantChangeType
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocStringLen
VarUI4FromStr
VariantClear
VariantInit
SysAllocString
SysFreeString
SafeArrayGetLBound
SafeArrayGetElement
VarBstrCat
SafeArrayGetUBound
SysAllocStringByteLen
SysStringByteLen

shlwapi

PathIsDirectoryW
PathGetDriveNumberW
PathGetCharTypeW
PathCanonicalizeW
PathAppendW
PathSearchAndQualifyW

Sections

.text
Size: 7.6MB - Virtual size: 7.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 353KB - Virtual size: 561KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 537KB - Virtual size: 537KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 486KB - Virtual size: 486KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9344c3252b7471cd44646e07ad413527

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

advapi32

kernel32

user32

gdi32

comctl32

ws2_32

shell32

comdlg32

ole32

oleaut32

shlwapi

Sections

.text Size: 7.6MB - Virtual size: 7.6MB

.rdata Size: 2.4MB - Virtual size: 2.4MB

.data Size: 353KB - Virtual size: 561KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 537KB - Virtual size: 537KB

.reloc Size: 486KB - Virtual size: 486KB

.text
Size: 7.6MB - Virtual size: 7.6MB

.rdata
Size: 2.4MB - Virtual size: 2.4MB

.data
Size: 353KB - Virtual size: 561KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 537KB - Virtual size: 537KB

.reloc
Size: 486KB - Virtual size: 486KB