377f3bfb1d40b093f4c59bbb5aacb339cd6b1e00dcf6bc3ca642bf1971c8858b

Sharing

Copy URL Twitter E-mail

General

Target

377f3bfb1d40b093f4c59bbb5aacb339cd6b1e00dcf6bc3ca642bf1971c8858b
Size

5.4MB
MD5

7af635b06a5e027874916e73c98c93f8
SHA1

ddba9f51c1e757f0a5b75b277e1ded5fa74ae6ff
SHA256

377f3bfb1d40b093f4c59bbb5aacb339cd6b1e00dcf6bc3ca642bf1971c8858b
SHA512

2592b29647e1d0e2688dd4913aad88ed0cbaaa4867635f28a9ecd59edd4bb388ba6b9357d69ffe0c77cfc1d609498f921f41bbe3361525e57f8b72ceaf71f7e2
SSDEEP

98304:6d23Cl12hticUNlv+U9dYEjbhgiTsfyCxDG+zKWBM:6diEcmEU9yEjbMyCo+z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
377f3bfb1d40b093f4c59bbb5aacb339cd6b1e00dcf6bc3ca642bf1971c8858b

Files

377f3bfb1d40b093f4c59bbb5aacb339cd6b1e00dcf6bc3ca642bf1971c8858b
.exe windows:6 windows x86 arch:x86

e0d9dedcc88bf9f83375ae44fc1b8ac2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\T\BuildResults\bin\Release\AdobeCollabSync.pdb

Imports

shlwapi

StrCmpNA
PathStripPathW
UrlCanonicalizeA
PathRemoveFileSpecW
PathCreateFromUrlW
UrlIsW
StrCmpNW

kernel32

FreeEnvironmentStringsW
CreateDirectoryW
ProcessIdToSessionId
IsProcessInJob
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
QueryInformationJobObject
VerifyVersionInfoA
GetFileType
QueryDosDeviceW
GetCurrentProcess
SystemTimeToTzSpecificLocalTime
GetProcessTimes
K32GetProcessMemoryInfo
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
WaitForThreadpoolWorkCallbacks
CreateThreadpool
CloseThreadpool
QueueUserWorkItem
AreFileApisANSI
GetWindowsDirectoryW
ResetEvent
DuplicateHandle
GetCurrentThreadId
GetCommandLineW
GetTempPathW
OpenProcess
GetExitCodeProcess
WaitNamedPipeW
WaitForMultipleObjects
GetOverlappedResult
GetEnvironmentStringsW
DisconnectNamedPipe
ConnectNamedPipe
ResumeThread
TerminateProcess
GetCurrentProcessId
VerifyVersionInfoW
HeapSetInformation
GetProcessHeap
VerSetConditionMask
FindResourceA
SizeofResource
LockResource
LoadResource
GetModuleHandleExA
WideCharToMultiByte
FormatMessageW
FormatMessageA
GetThreadId
CreateWaitableTimerA
GetCurrentDirectoryW
GetEnvironmentVariableW
SetWaitableTimer
OpenEventA
SetThreadErrorMode
LocalFree
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
CreateEventA
SetEvent
DeleteCriticalSection
InitOnceBeginInitialize
InitOnceComplete
CreateProcessW
CreateNamedPipeW
CreateThread
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
LoadLibraryExA
ReleaseSemaphore
WaitForSingleObject
SwitchToThread
DeleteFileW
FindClose
FindFirstFileW
FlushFileBuffers
GetDriveTypeW
GetFileInformationByHandle
InitializeCriticalSectionEx
SetEndOfFile
SetFilePointer
MoveFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LocalAlloc
CreateSemaphoreA
GetSystemTimeAsFileTime
GetLocalTime
FileTimeToSystemTime
FindNextFileW
RemoveDirectoryW
MultiByteToWideChar
GetFileAttributesW
GetSystemDirectoryA
LoadLibraryA
lstrlenA
InitializeCriticalSectionAndSpinCount
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
GetDriveTypeA
HeapAlloc
HeapFree
WaitForSingleObjectEx
CreateFileA
PeekNamedPipe
CancelIoEx
WaitForMultipleObjectsEx
CreateNamedPipeA
LoadLibraryExW
GetUserDefaultLCID
QueryPerformanceCounter
QueryPerformanceFrequency
GetNativeSystemInfo
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EncodePointer
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
RtlUnwind
InterlockedPushEntrySList
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
WriteConsoleW
ExitProcess
GetCurrentThread
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
SetEnvironmentVariableW
SetStdHandle
HeapSize
SetLastError
RaiseException
DecodePointer
OutputDebugStringA
DeviceIoControl
GetFileSize
GetFileAttributesExW
CreateWaitableTimerW
CreateIoCompletionPort
SleepEx
PostQueuedCompletionStatus
GetQueuedCompletionStatus
QueueUserAPC
lstrlenW
GetTickCount
Sleep
OpenMutexW
SetNamedPipeHandleState
GetLastError
CloseHandle
WriteFile
ReadFile
GetVolumeInformationW
CreateFileW
GetFullPathNameW
GlobalAlloc
GlobalFree
SetFileAttributesW
TerminateThread
GetThreadErrorMode

user32

GetForegroundWindow
FindWindowW
PostMessageW
GetClassNameA
FindWindowA
IsHungAppWindow
LoadImageW
GetCursorPos
GetPropW
SetForegroundWindow
InsertMenuItemW
TrackPopupMenu
InsertMenuW
DestroyMenu
CreatePopupMenu
GetSystemMetrics
DestroyWindow
CreateWindowExW
RegisterClassW
CallWindowProcA
PostQuitMessage
DefWindowProcA
PostMessageA
GetMessageA
LoadStringW
GetWindowThreadProcessId
MsgWaitForMultipleObjects
SetPropW
TranslateMessage
DispatchMessageA
PeekMessageA

advapi32

ConvertSidToStringSidA
CryptSetHashParam
OpenThreadToken
RegOpenKeyA
RegOpenKeyW
RegSetValueExW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
GetTokenInformation
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
SetTokenInformation
GetLengthSid
DuplicateTokenEx
OpenProcessToken
RegDeleteTreeW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorA
TreeSetNamedSecurityInfoW
GetNamedSecurityInfoW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityDescriptorSacl
GetAclInformation
GetAce
CreateProcessAsUserW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptImportKey

shell32

SHCreateDirectoryExW
SHFileOperationA
ShellExecuteA
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetKnownFolderPath
SHQueryUserNotificationState
Shell_NotifyIconW

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree

sensapi

IsNetworkAlive

ws2_32

WSAStartup
WSACleanup
WSAGetLastError
WSACreateEvent
WSAEventSelect
WSAIoctl
WSASocketA

wininet

HttpAddRequestHeadersA
HttpEndRequestA
HttpSendRequestExA
InternetSetOptionA
InternetWriteFile
InternetReadFile
DetectAutoProxyUrl
HttpSendRequestA
InternetCrackUrlA
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetSetCookieExA
InternetCloseHandle
HttpQueryInfoA

mpr

WNetGetResourceInformationW
WNetGetConnectionW
WNetAddConnection2W
WNetCancelConnection2W

crypt32

CryptProtectData
CryptUnprotectData

oleaut32

SysFreeString
SafeArrayCreateVector
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayDestroy
SysAllocString

netapi32

NetShareGetInfo

winhttp

WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSetStatusCallback
WinHttpSetCredentials
WinHttpSendRequest
WinHttpWriteData

Exports

Exports

gudeCancel
gudeClearCache
gudeCreate
gudeDestroy
gudeDownload
gudeDownloadRangeToMemory
gudeDownloadToMemory
gudeErrorString
gudeHTTPStatusString
gudePause
gudeRegisterAddChunkHeaderCallback
gudeRegisterAddHeaderCallback
gudeRegisterAddParametersCallback
gudeRegisterCancellationCallback
gudeRegisterChunkErrorRetryCallback
gudeRegisterCompletionCallback
gudeRegisterErrorCallback
gudeRegisterLoggingCallback
gudeRegisterMonitorCallback
gudeRegisterPausedCallback
gudeRegisterProgressCallback
gudeRegisterRequestBodyCallback
gudeRegisterResponseBodyCallback
gudeRegisterResponseHeaderCallback
gudeRegisterSSLCertificatePolicyCallback
gudeRegisterSetServerTypeCallback
gudeRegisterSetTimeoutCallback
gudeRegisterStatusLineCallback
gudeResume
gudeSendRequest
gudeSetLogLevel
gudeSetMultipartUploadThreshold
gudeSetSystemProxyCredentials
gudeSetTargetDataRates
gudeSetWorkerPoolUpperLimit
gudeUpload
gudeUploadFromMemory
gudeVersion

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 891KB - Virtual size: 890KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 270KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 510KB - Virtual size: 510KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0d9dedcc88bf9f83375ae44fc1b8ac2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

advapi32

shell32

ole32

sensapi

ws2_32

wininet

mpr

crypt32

oleaut32

netapi32

winhttp

Exports

Exports

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 891KB - Virtual size: 890KB

.data Size: 270KB - Virtual size: 289KB

.didat Size: 512B - Virtual size: 196B

.rsrc Size: 18KB - Virtual size: 17KB

.reloc Size: 510KB - Virtual size: 510KB

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 891KB - Virtual size: 890KB

.data
Size: 270KB - Virtual size: 289KB

.didat
Size: 512B - Virtual size: 196B

.rsrc
Size: 18KB - Virtual size: 17KB

.reloc
Size: 510KB - Virtual size: 510KB