win5898[.]tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

win5898.tmp
Size

2.4MB
MD5

b19a3c37938ad34ac6b923fe3a460e16
SHA1

53354de7a4b8a7e814df0fde54d93bf38bb75e95
SHA256

cb13a9a6a88054a26e940a945d8e82f1ceba5858f73a57636226a09b7ce5b4c4
SHA512

70661176e4bba593ff87b678b8317ee3172173352e3a5d652a093c3dc69820a0d336304c473baeb4744725674cff2305961536be20be9301a591942bc94b3464
SSDEEP

49152:nrj/0zcGdktQlqufyMzS9+qyZumInnCa7g+CV4:rRQADd+qng+CV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
win5898.tmp

Files

win5898.tmp
.dll windows:5 windows x64 arch:x64

75a68876e882bde2808fce9c881c6dc0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetTempPathW
CreateDirectoryW
GetModuleHandleW
FreeLibrary
GetSystemTimeAsFileTime
GetSystemDirectoryW
LoadLibraryW
GetStdHandle
WriteFile
GetCurrentThreadId
MultiByteToWideChar
GetFileType
GlobalMemoryStatus
QueryPerformanceCounter
GetTickCount
FlushConsoleInputBuffer
LoadLibraryA
SetErrorMode
GetCurrentProcess
GetCPInfo
TerminateProcess
GetEnvironmentVariableW
GetVersionExW
IsValidCodePage
FindResourceW
IsDebuggerPresent
MulDiv
GetCurrentProcessId
GetCommandLineW
ExitProcess
SetLastError
GetConsoleScreenBufferInfo
WriteConsoleA
ReadConsoleOutputCharacterA
AttachConsole
FillConsoleOutputCharacterW
FreeConsole
WriteConsoleW
SetConsoleCursorPosition
GetLocaleInfoW
GetACP
GetUserDefaultLCID
IsValidLocale
FindFirstFileW
GetLongPathNameW
FindClose
CreateFileW
GetFileAttributesW
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
OutputDebugStringW
WaitForMultipleObjects
CreateThread
SetCurrentDirectoryW
FindNextFileW
GetStringTypeW
RtlPcToFileHeader
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
CompareStringW
LCMapStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
InterlockedFlushSList
RtlUnwindEx
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
QueryPerformanceFrequency
SetConsoleCtrlHandler
ReadFile
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
SetStdHandle
GetDriveTypeW
GetFullPathNameW
SetFilePointerEx
ReadConsoleW
FlushFileBuffers
GetConsoleCP
HeapAlloc
HeapReAlloc
HeapFree
GetModuleFileNameA
EnumSystemLocalesW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEndOfFile
GetCurrentDirectoryW
GetProcessHeap
FindFirstFileExA
FindNextFileA
GetCommandLineA
HeapSize
EnumResourceNamesW
RaiseException
Sleep
ResumeThread
LoadResource
LockResource
FindResourceA
GetModuleFileNameW
SizeofResource
FormatMessageA
LocalFree
OutputDebugStringA
CloseHandle
SetEvent
GetLastError
CreateEventW
WaitForSingleObject
GetProcAddress
GetModuleHandleA
GetThreadLocale
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
VerifyVersionInfoW
WideCharToMultiByte
VerSetConditionMask

user32

RedrawWindow
DispatchMessageW
GetCapture
GetAsyncKeyState
BeginDeferWindowPos
IsWindow
GetActiveWindow
TrackPopupMenu
WindowFromPoint
GetScrollInfo
ChildWindowFromPointEx
CallNextHookEx
ScreenToClient
FillRect
GetMenuItemCount
InflateRect
GetFocus
MapVirtualKeyW
CallWindowProcW
GetMessagePos
GetUpdateRgn
GetKeyState
GetMenuItemInfoW
DeferWindowPos
SetScrollInfo
GetWindowLongW
GetDlgItem
CreateDialogParamW
GetProcessDefaultLayout
LoadCursorW
InvalidateRect
DrawFrameControl
DrawIconEx
DrawTextW
DrawFocusRect
CreateIconIndirect
SystemParametersInfoW
GetDoubleClickTime
FindWindowExW
DestroyIcon
GetWindowTextW
IsDialogMessageW
GetWindowTextLengthW
SetActiveWindow
SetRectEmpty
DrawStateW
CopyRect
OffsetRect
SetWindowRgn
PostThreadMessageW
EndPaint
BeginPaint
GetWindowDC
DestroyCursor
CreateMenu
AppendMenuW
RemoveMenu
SetCapture
DestroyMenu
SetMenuInfo
SetMenuItemInfoW
GetSubMenu
ClientToScreen
InsertMenuItemW
ModifyMenuW
GetMenuState
ValidateRect
GetMessageW
EnumDisplaySettingsW
GetMonitorInfoW
EnumDisplayMonitors
MonitorFromWindow
MonitorFromPoint
ChangeDisplaySettingsExW
MsgWaitForMultipleObjects
KillTimer
SetTimer
CheckMenuItem
GetMenuItemID
CheckMenuRadioItem
SetMenu
GetClassNameW
VkKeyScanW
GetWindowLongPtrW
GetWindowPlacement
ShowWindow
MoveWindow
GetDialogBaseUnits
SetLayeredWindowAttributes
DrawMenuBar
FlashWindowEx
SetWindowLongW
IsZoomed
GetDesktopWindow
CreateDialogIndirectParamW
EnableMenuItem
SetForegroundWindow
GetIconInfo
LoadBitmapW
LoadIconW
PostMessageW
CreateWindowExW
RegisterClassW
BringWindowToTop
GetDC
ReleaseDC
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
AnimateWindow
EndDeferWindowPos
SetWindowsHookExW
SetCursor
EnableScrollBar
GetClientRect
PostQuitMessage
ScrollWindow
GetParent
PtInRect
UpdateWindow
ReleaseCapture
PeekMessageW
MapWindowPoints
GetSysColor
IsWindowEnabled
SetCursorPos
GetCursorPos
EnableWindow
DefWindowProcW
GetSystemMenu
DestroyWindow
SetWindowPos
UnhookWindowsHookEx
GetMessageTime
SetFocus
TranslateMessage
CreatePopupMenu
SetParent
IsIconic
LoadImageW
EnumWindows
GetSystemMetrics
MonitorFromRect
IsWindowVisible
GetWindowRect
GetWindow
GetWindowThreadProcessId
SetWindowLongPtrW
SendMessageW
UnregisterClassW
InsertMenuW
SetWindowTextW

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetReadFileExW
HttpQueryInfoA
InternetQueryOptionA
InternetSetStatusCallbackW
InternetCrackUrlA
InternetCloseHandle
InternetOpenW
InternetOpenUrlA

advapi32

RegCloseKey
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegQueryValueExW
RegDeleteValueA
RegOpenKeyExA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegCreateKeyExA
RegSetValueExW

shell32

ExtractIconW
SHFileOperationW
ExtractIconExW
CommandLineToArgvW
DragQueryFileW
DragQueryPoint
DragFinish
SHGetFolderPathW
ShellExecuteExW

ole32

OleRun
OleSetContainedObject
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree
OleLockRunning

oleaut32

SafeArrayAccessData
SafeArrayCreateVector
SafeArrayUnaccessData
SysAllocString
SysFreeString
SafeArrayDestroy
SafeArrayCreate
SysStringLen
VarBstrFromCy
SafeArrayGetVartype
VariantInit
SafeArrayLock
SafeArrayUnlock

uxtheme

GetThemePartSize
IsThemePartDefined
IsThemeActive
IsAppThemed
GetThemeMargins
DrawThemeParentBackground
IsThemeBackgroundPartiallyTransparent
CloseThemeData
GetThemeColor
DrawThemeBackground
OpenThemeData
GetThemeBackgroundContentRect

crypt32

CryptStringToBinaryA

msimg32

AlphaBlend
GradientFill

comctl32

ord17
ImageList_Replace
ImageList_Create
ImageList_SetBkColor
ImageList_Add
ImageList_GetIconSize
ImageList_GetImageInfo
ImageList_Draw
ImageList_Destroy

gdi32

Rectangle
ExtCreatePen
GetTextExtentExPointW
GetTextExtentPoint32W
GetCharABCWidthsW
CreateDIBSection
GetDIBColorTable
CreateDIBitmap
EqualRgn
RectInRegion
PtInRegion
CombineRgn
GetRgnBox
CreateHatchBrush
CreatePatternBrush
ExtCreateRegion
SetViewportOrgEx
GetRegionData
CreatePen
SelectClipRgn
Polygon
SetBkColor
Ellipse
SetStretchBltMode
CreateSolidBrush
SetMapMode
ExtSelectClipRgn
SetBkMode
CreateFontIndirectW
GetObjectType
RoundRect
ExtTextOutW
LineTo
MoveToEx
GetOutlineTextMetricsW
CreateBitmap
GetBkColor
BitBlt
Pie
Arc
CreateCompatibleDC
SetPixel
GetLayout
StretchBlt
StretchDIBits
SetLayout
SetWindowOrgEx
GetStockObject
GetClipBox
SetWindowExtEx
ExtFloodFill
Polyline
MaskBlt
SetViewportExtEx
SetPolyFillMode
GetPixel
SetROP2
GetObjectW
DeleteDC
SetTextColor
PolyPolygon
SetBrushOrgEx
SelectObject
GdiFlush
GetTextMetricsW
CreateRectRgn
ExcludeClipRect
CreateCompatibleBitmap
GetDIBits
GetDeviceCaps
OffsetRgn
DeleteObject

Exports

Exports

win_sparkle_check_update_with_ui
win_sparkle_check_update_with_ui_and_install
win_sparkle_check_update_without_ui
win_sparkle_cleanup
win_sparkle_get_automatic_check_for_updates
win_sparkle_get_last_check_time
win_sparkle_get_update_check_interval
win_sparkle_init
win_sparkle_set_app_build_version
win_sparkle_set_app_details
win_sparkle_set_appcast_url
win_sparkle_set_automatic_check_for_updates
win_sparkle_set_can_shutdown_callback
win_sparkle_set_did_find_update_callback
win_sparkle_set_did_not_find_update_callback
win_sparkle_set_dsa_pub_pem
win_sparkle_set_error_callback
win_sparkle_set_lang
win_sparkle_set_langid
win_sparkle_set_registry_path
win_sparkle_set_shutdown_request_callback
win_sparkle_set_update_cancelled_callback
win_sparkle_set_update_check_interval

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 750KB - Virtual size: 749KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75a68876e882bde2808fce9c881c6dc0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

rpcrt4

version

wininet

advapi32

shell32

ole32

oleaut32

uxtheme

crypt32

msimg32

comctl32

gdi32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 750KB - Virtual size: 749KB

.data Size: 41KB - Virtual size: 84KB

.pdata Size: 69KB - Virtual size: 69KB

.gfids Size: 1024B - Virtual size: 644B

.rsrc Size: 162KB - Virtual size: 161KB

.reloc Size: 41KB - Virtual size: 40KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 750KB - Virtual size: 749KB

.data
Size: 41KB - Virtual size: 84KB

.pdata
Size: 69KB - Virtual size: 69KB

.gfids
Size: 1024B - Virtual size: 644B

.rsrc
Size: 162KB - Virtual size: 161KB

.reloc
Size: 41KB - Virtual size: 40KB