WinX[.] SignSight[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

WinX. SignSight.zip
Size

57.2MB
MD5

56a49cd8423289dbcf0b4c84c46eef7f
SHA1

42c4fb7c30e0d8efeeccae08fb28956d6f3ca42b
SHA256

39a921b42c964e3a381bc613f3bde5b324b070e629a415e35f9f84c6818f2eca
SHA512

8fbf2bfea5e8f0718d439b4d9d1ece6a7aaadf58ea1c322fd4cb5855a2a01171f01271f2fe40bac450cd0956bc192de7943fde19524a1005c146f0453889d885
SSDEEP

1572864:tblU0wcnbsDQZIv4GnV7NzDevZhAyPf2BvnGPRSOH1v:bUjQZg4GnV7YZyyn2pGPQwv

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack002/97a5fe1d2174e9d34cee8c1d6751bf01f99d8f40b1ae0bce205b8f2f0483225c.exe
unpack002/c42000f2f6526c782757aa43246b4c1a12d366610721df6b6112305064d48a32
unpack002/f659b269fbe4128588f7a2fa4d6022cc74e508d28eee05c5aff26cc23b7bd1a5

Files

WinX. SignSight.zip
.zip

Password: infected
WinX. SignSight
.zip

Password: infected
6be34df727fcb79123e4e8f472ad24b698d83395fb17d4db019e9976f485cd83
.msi
97a5fe1d2174e9d34cee8c1d6751bf01f99d8f40b1ae0bce205b8f2f0483225c.exe
.exe windows:4 windows x86 arch:x86

Password: infected

764a9a179d3d138855baf5a597db57ee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord4998
ord2514
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord3262
ord3081
ord4627
ord4425
ord3597
ord324
ord641
ord4234
ord4710
ord800
ord2818
ord540
ord2915
ord860
ord1158
ord4673
ord4853
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3738
ord561
ord815
ord5500
ord6354
ord5716
ord5717
ord2621
ord1134
ord1199
ord1205
ord1816
ord1146
ord6215
ord2086
ord2864
ord4160
ord2863
ord2379
ord6453
ord755
ord470
ord4224
ord4376
ord5265
ord743
ord446
ord4003
ord2486
ord4226
ord4622
ord1223
ord825
ord290
ord2623
ord1206
ord1168
ord614
ord4424
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord2985
ord3136
ord4465
ord3259
ord3147
ord2982
ord1799
ord4274
ord823
ord1576

msvcrt

__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_setmbcp
_itoa
__CxxFrameHandler
atoi
strchr
_CxxThrowException
_controlfp
sscanf
strstr
_except_handler3
exit
sprintf

kernel32

WaitForSingleObject
Sleep
GetTickCount
SetFilePointer
ExpandEnvironmentStringsA
GetTempPathA
GetFileAttributesA
GetStartupInfoA
WriteFile
CloseHandle
GetModuleHandleA
GetProcAddress
ReadFile
GetFileSize
CreateFileA
GetLastError
GetShortPathNameA
LoadLibraryA
GetPrivateProfileStringA

user32

GetSystemMenu
GetSystemMetrics
SendMessageA
GetDesktopWindow
AppendMenuA
GetClientRect
EnableWindow
LoadIconA
DrawIcon

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

SHGetFolderPathA

dbghelp

MakeSureDirectoryPathExists

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
b0fd1ff7f5d45be89fffc04937f352754c6055e1f4ca26a9257169ce168569ef
.msi
c42000f2f6526c782757aa43246b4c1a12d366610721df6b6112305064d48a32
.exe windows:5 windows x86 arch:x86

Password: infected

1a5450866c561929c5b6a23359ed8388

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
OutputDebugStringW
CloseHandle
ConnectNamedPipe
PeekNamedPipe
CreateNamedPipeW
Sleep
CreateDirectoryW
CreateFileW
GetFileAttributesExW
GetTempFileNameW
WriteFile
GetTempPathW
OutputDebugStringA
SetHandleInformation
GetLastError
CreatePipe
WaitForSingleObject
CreateProcessW
GetSystemInfo
GetComputerNameExW
WideCharToMultiByte
Wow64RevertWow64FsRedirection
GetProcAddress
LoadLibraryW
CopyFileW
SetEnvironmentVariableW
SetEndOfFile
ReadConsoleW
SetFilePointerEx
SetStdHandle
VirtualQuery
FlushFileBuffers
FreeLibrary
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetProcessHeap
HeapAlloc
GetModuleFileNameA
HeapQueryInformation
Wow64DisableWow64FsRedirection
MultiByteToWideChar
HeapSize
HeapReAlloc
HeapFree
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleFileNameW
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
RaiseException
RtlUnwind
DuplicateHandle
GetCurrentProcess
CreateProcessA
HeapValidate
GetSystemTimeAsFileTime
GetCommandLineA
FatalAppExitA
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
GetModuleHandleW
CreateSemaphoreW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
AreFileApisANSI
SetConsoleCtrlHandler
WaitForSingleObjectEx
CreateThread
LoadLibraryExW
GetCurrentThread
GetCurrentThreadId
GetConsoleCP
GetConsoleMode
GetExitCodeProcess
SetEnvironmentVariableA

ws2_32

gethostname
InetNtopW
InetPtonW
WSAGetLastError
WSAStartup
setsockopt
sendto
send
recvfrom
recv
ntohs
ntohl
htons
connect
closesocket
socket

iphlpapi

GetNetworkParams

netapi32

NetApiBufferFree
NetShareDel
NetShareSetInfo
NetShareGetInfo
NetShareAdd

Exports

Exports

DeletePluginObject
GetPluginInfomation
GetPluginObject
GetRegisterCode
Run

Sections

.textbss
Size: - Virtual size: 605KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 806B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
f659b269fbe4128588f7a2fa4d6022cc74e508d28eee05c5aff26cc23b7bd1a5
.dll windows:5 windows x86 arch:x86

Password: infected

75aa793316c22a17e59b5a1371b5f558

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlUnwind

ws2_32

inet_addr
WSAStartup
connect
getaddrinfo
freeaddrinfo
htons
ntohl
htonl
recv
gethostname
inet_ntoa
socket
send
WSASend
ntohs
WSAGetLastError
shutdown
setsockopt
WSACleanup
closesocket
gethostbyname

kernel32

Sleep
CloseHandle
ExpandEnvironmentStringsW
OutputDebugStringA
SetErrorMode
OutputDebugStringW
FreeConsole
ExitProcess
CreateProcessW
SetUnhandledExceptionFilter
VirtualProtect
HeapFree
HeapAlloc
GetProcessHeap
FreeLibrary
IsBadReadPtr
EnterCriticalSection
LeaveCriticalSection
CreateThread
SetLastError
SetEvent
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateFileW
WideCharToMultiByte
GlobalFree
GetACP
VirtualAlloc
VirtualFree
WaitForSingleObject
GetCurrentProcessId
WTSGetActiveConsoleSessionId
LocalFree
FileTimeToLocalFileTime
MultiByteToWideChar
GetSystemDefaultLangID
GetComputerNameExW
GetVersionExW
LocalAlloc
WriteFile
GetTickCount
DeleteCriticalSection
GetProcAddress
DecodePointer
RaiseException
LoadLibraryA
GetLastError
InitializeCriticalSectionAndSpinCount
GetStringTypeW
HeapReAlloc
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineA
GetCommandLineW
HeapSize
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
LCMapStringW
GetFileType
GetStdHandle
GetModuleHandleExW
LoadLibraryExW
TlsFree
GetCurrentProcess
EncodePointer
InterlockedFlushSList
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
InitializeCriticalSection

advapi32

GetUserNameW
CryptImportKey
SystemFunction036
SetServiceStatus
RegisterServiceCtrlHandlerW
CredEnumerateA
CredFree
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
CryptDestroyKey
CryptAcquireContextA
CryptEncrypt
CryptReleaseContext

ole32

CoInitialize
CoCreateGuid
CoUninitialize
CoTaskMemFree

oleaut32

VariantClear
GetErrorInfo

shlwapi

StrStrIA
PathFileExistsW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

winmm

timeGetTime

secur32

FreeCredentialsHandle
InitializeSecurityContextA
DeleteSecurityContext
FreeContextBuffer
AcquireCredentialsHandleA
QuerySecurityPackageInfoA
CompleteAuthToken

winhttp

WinHttpCloseHandle
WinHttpGetProxyForUrl

dnsapi

DnsQuery_A
DnsFree

Exports

Exports

Entery
ServiceMain

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Password: infected

764a9a179d3d138855baf5a597db57ee

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

shell32

dbghelp

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 96KB - Virtual size: 96KB

.rsrc Size: 72KB - Virtual size: 69KB

Password: infected

1a5450866c561929c5b6a23359ed8388

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

iphlpapi

netapi32

Exports

Exports

Sections

.textbss Size: - Virtual size: 605KB

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 201KB - Virtual size: 200KB

.data Size: 2.7MB - Virtual size: 2.7MB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 806B

.reloc Size: 53KB - Virtual size: 53KB

Password: infected

75aa793316c22a17e59b5a1371b5f558

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

ws2_32

kernel32

advapi32

ole32

oleaut32

shlwapi

wtsapi32

winmm

secur32

winhttp

dnsapi

Exports

Exports

Sections

.text Size: 123KB - Virtual size: 123KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 4KB - Virtual size: 17KB

.rsrc Size: 1024B - Virtual size: 720B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 96KB - Virtual size: 96KB

.rsrc
Size: 72KB - Virtual size: 69KB

.textbss
Size: - Virtual size: 605KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 201KB - Virtual size: 200KB

.data
Size: 2.7MB - Virtual size: 2.7MB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 806B

.reloc
Size: 53KB - Virtual size: 53KB

.text
Size: 123KB - Virtual size: 123KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 4KB - Virtual size: 17KB

.rsrc
Size: 1024B - Virtual size: 720B

.reloc
Size: 6KB - Virtual size: 6KB