93cfb99336ca8657b174f3625bb2b94fce9266489e72ac0ae424a37bdf145637

Sharing

Copy URL Twitter E-mail

General

Target
93cfb99336ca8657b174f3625bb2b94fce9266489e72ac0ae424a37bdf145637
Size 1.1MB
Sample240228-zklthadd4y
SHA256 93cfb99336ca8657b174f3625bb2b94fce9266489e72ac0ae424a37bdf145637
MD5 c2e4eb448e0412b0eac194b80a789770
SHA1 252537262cd1566f75ce67acab4f61d09fd71819
SHA512 ef88d37149e6fec2e97c19f1bedb9bc51259500b831bceda8a762b02fb11080c61f05d2dbd3cdd4870fa47b3d6c8809d13e054c16d2afe6170b89a7c39d67025
SSDEEP 24576:xPyEy5OTyXEsIZi05LJAAzkzgbsOjqcGJoNVrhTjoOJowbP+4Moo8:xfzoEsIZi05LyZgJqJJqhTsDwbP+45o8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
93cfb99336ca8657b174f3625bb2b94fce9266489e72ac0ae424a37bdf145637

File Explorer

93cfb99336ca8657b174f3625bb2b94fce9266489e72ac0ae424a37bdf145637

.exe 1.1MB

93cfb99336ca8657b174f3625bb2b94fce9266489e72ac0ae424a37bdf145637

IMPHASH 54b6dc1d2cff534726ef4590b6a867a5
SHA256 93cfb99336ca8657b174f3625bb2b94fce9266489e72ac0ae424a37bdf145637
MD5 c2e4eb448e0412b0eac194b80a789770
SHA1 252537262cd1566f75ce67acab4f61d09fd71819
SHA512 ef88d37149e6fec2e97c19f1bedb9bc51259500b831bceda8a762b02fb11080c61f05d2dbd3cdd4870fa47b3d6c8809d13e054c16d2afe6170b89a7c39d67025
SSDEEP 24576:xPyEy5OTyXEsIZi05LJAAzkzgbsOjqcGJoNVrhTjoOJowbP+4Moo8:xfzoEsIZi05LyZgJqJJqhTsDwbP+45o8
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

595631

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\git_code\CommonPlatform\UpdateProgram\bin\Win32\Release\pdb\Update_2345Explorer.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

GetLastError RaiseException WritePrivateProfileStringA DecodePointer DeleteCriticalSection GetPrivateProfileStringA LoadLibraryW GetProcAddress FreeLibrary GetTempPathW CreateFileW EndUpdateResourceW UpdateResourceW BeginUpdateResourceW ExpandEnvironmentStringsW GetModuleFileNameW GetFileAttributesW GetModuleHandleW QueryDosDeviceW GetCurrentProcess OpenProcess GetCurrentThreadId SuspendThread GetExitCodeThread Sleep TerminateThread SwitchToThread OpenThread ResumeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForMultipleObjects LocalFree GetCurrentProcessId CreateProcessW GetExitCodeProcess GetACP MultiByteToWideChar WideCharToMultiByte ReadFile WriteFile SetFileTime SetFilePointer SetEndOfFile GetFileSize GetFileTime CreateMutexW ReleaseMutex GetVersionExW LockResource GetSystemInfo InitializeCriticalSectionAndSpinCount FindResourceW lstrcmpiW FindFirstFileW GetLongPathNameW GetFileAttributesExW lstrlenW DeleteFileW GetFileSizeEx FindNextFileW FindClose HeapFree HeapAlloc GetProcessHeap GetLogicalDriveStringsW ResetEvent InterlockedExchangeAdd CreateDirectoryW GetFullPathNameW SetFileAttributesW GetCurrentDirectoryW GetWindowsDirectoryW CopyFileW GetTempFileNameW FormatMessageW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetPrivateProfileStringW LocalAlloc InterlockedExchange SetLastError GetTickCount DeviceIoControl GetEnvironmentVariableW WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize SetStdHandle DeleteTimerQueueTimer GetCommandLineW MoveFileExW CloseHandle SetEvent CreateEventW OpenEventW WaitForSingleObject CreateTimerQueueTimer LoadResource GlobalMemoryStatusEx SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW HeapReAlloc GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead OutputDebugStringW RtlUnwind LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetFileType

user32

PostQuitMessage LoadCursorW TranslateMessage LoadIconW DispatchMessageW RegisterClassW CreateWindowExW DefWindowProcW GetMessageW

gdi32

GetStockObject

advapi32

GetUserNameW QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle DuplicateTokenEx AdjustTokenPrivileges SystemFunction036

shell32

SHGetFolderPathW ord680 SHGetSpecialFolderPathW

imagehlp

ImageEnumerateCertificates ImageRemoveCertificate

netapi32

NetLocalGroupGetMembers

Sharing

General

Malware Config

Signatures

File Explorer

93cfb99336ca8657b174f3625bb2b94fce9266489e72ac0ae424a37bdf145637

version

kernel32

user32

gdi32

advapi32

shell32

imagehlp

netapi32

generic