SecuriteInfo[.]com[.]PUA[.]Tenorshare[.]7715[.]20678[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.PUA.Tenorshare.7715.20678.exe
Size

32KB
MD5

d1a89a6c6bac55ac9517c1c780aa675a
SHA1

c094b3bc50ae5ea09bcbeeb365ca93aeb6b22dac
SHA256

f0f6499c7cb4a3820b79c6b25086c71f3142d068cecbf1f4b00ed26c2f6c0bc8
SHA512

991d0a5542e7ec022f4f49c51f86e7383a3d6a4d3c20d20e0929bff433bc018445b14dbc457471949bd35f6576773237f9cd42638d450b880d4347c55df9d66d
SSDEEP

768:ByYesWxvEqjp2S0KEdQ05zBXzNmLdhwpRfD:Byzx8w2S0K0/5zBXhmRURfD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.PUA.Tenorshare.7715.20678.exe

Files

SecuriteInfo.com.PUA.Tenorshare.7715.20678.exe
.exe windows:5 windows x86 arch:x86

46f1f12091f0cdc521b406a79fabc61b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

GetUserProfileDirectoryW
DestroyEnvironmentBlock
CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

wininet

HttpQueryInfoW
InternetSetOptionW
InternetCloseHandle
InternetOpenUrlA
InternetGetConnectedState
InternetOpenA
InternetReadFile

shell32

ShellExecuteExW

winmm

timeGetTime

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
GetPrivateProfileStringA
lstrlenA
GetLastError
WaitForSingleObject
Sleep
GetModuleFileNameW
CloseHandle
SetUnhandledExceptionFilter
WTSGetActiveConsoleSessionId
GetEnvironmentVariableW
WideCharToMultiByte
TerminateProcess
MultiByteToWideChar
CreateThread
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
UnhandledExceptionFilter
GetCurrentProcess
InterlockedCompareExchange
InterlockedExchange

user32

wsprintfW

advapi32

StartServiceCtrlDispatcherW
DuplicateTokenEx
CreateProcessAsUserW
ControlService
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
RegisterServiceCtrlHandlerW
SetServiceStatus

msvcp90

?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z

msvcr90

_unlock
__dllonexit
_lock
memset
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_stricmp
__CxxFrameHandler3
?terminate@@YAXXZ
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
_wfopen
_wremove
fwrite
fclose
free
malloc
fgets
_waccess
wcscpy_s
wcscat_s
wcschr
_wmkdir
_vfprintf_p
wcsrchr
??_V@YAXPAX@Z
fread
ftell
fseek
printf
isdigit
_wrename
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook

shlwapi

PathRemoveFileSpecW

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

46f1f12091f0cdc521b406a79fabc61b

Headers

DLL Characteristics

File Characteristics

Imports

userenv

wtsapi32

wininet

shell32

winmm

version

kernel32

user32

advapi32

msvcp90

msvcr90

shlwapi

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB