TS-240306-UF2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

TS-240306-UF2.exe
Size

406KB
MD5

5d382a9a1257a9601ef6ca19d3d96287
SHA1

c0a24dbfbbd9ea2759f1f2bd4e2af3b737b5129e
SHA256

afc958762650e786ba861f9b91a17806920615cea1db1d41c005e37953c4524b
SHA512

5c0f6c44c8fc67948cca8a3c6ad78399440cd90776e41714ab32229fcc3dcdd387a3dc2b1374f170f027202b39d8fac5fb465055e7c5e71cd44371e016b8a783
SSDEEP

6144:Jo1AmflUT57trr+A8C2l/pW8sJGxRTJ4ZITg/7UdDySHEd1fesgo8VJXTBcFcuFc:aHUT5pP+A+rBhTg/7UAvqJXTiNuUgO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TS-240306-UF2.exe

Files

TS-240306-UF2.exe
.exe windows:5 windows x64 arch:x64

8a21b0684db619e9a1ac6f612937cd94

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrcatW
GetCurrentProcess
lstrcpyW
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
OpenProcess
GetCurrentProcessId
lstrcmpW
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
GetStartupInfoW
CreateProcessW
ExitProcess
WideCharToMultiByte
QueryPerformanceFrequency
CreateEventW
SetEvent
ResetEvent
QueryPerformanceCounter
WaitForSingleObject
CloseHandle
WriteFile
ExpandEnvironmentStringsW
CopyFileW
GetFileAttributesW
CreateEventA
FormatMessageW
SetLastError
VirtualProtect
IsBadReadPtr
LoadLibraryA
GetNativeSystemInfo
ReadProcessMemory
GetWindowsDirectoryW
SetUnhandledExceptionFilter
MoveFileExW
GetModuleFileNameA
DeleteFileA
GetSystemTime
GetCurrentThreadId
CreateThread
CreateFileA
LocalFree
SetEnvironmentVariableA
GetExitCodeProcess
SetEnvironmentVariableW
CompareStringW
IsValidLocale
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetTickCount
Sleep
GetLocalTime
MultiByteToWideChar
lstrlenW
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
VirtualFree
CreateFileW
InitializeCriticalSection
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetStdHandle
WriteConsoleW
GetSystemTimeAsFileTime
FlushFileBuffers
ReadFile
SetFilePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileType
SetHandleCount
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetStringTypeW
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
HeapSize
GetLocaleInfoW
GetStdHandle
GetConsoleMode
GetConsoleCP
GetVersion
HeapSetInformation
TerminateProcess
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
SetEndOfFile
GetCPInfo
HeapReAlloc
ExitThread
EncodePointer
DecodePointer
TryEnterCriticalSection
CancelWaitableTimer
SetWaitableTimer
lstrlenA
UnmapViewOfFile
SwitchToThread
CreateFileMappingW
MapViewOfFileEx
GetFileSize
RaiseException
InitializeCriticalSectionAndSpinCount
HeapCreate
HeapDestroy
CreateWaitableTimerW

user32

PeekMessageW
MsgWaitForMultipleObjects
GetWindowTextW
DispatchMessageW
GetLastInputInfo
SendMessageW
wsprintfW
PostThreadMessageA
GetForegroundWindow
TranslateMessage

advapi32

RegSetValueExW
RegCreateKeyW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
GetCurrentHwProfileW
RegSetValueW

shell32

ShellExecuteA

ole32

CoUninitialize
CoGetObject
CoInitializeEx
CLSIDFromString
CoCreateInstance
CoInitialize

oleaut32

VariantClear
VariantInit
SysFreeString
SysStringLen
SysAllocString

ws2_32

shutdown
closesocket
send
setsockopt
WSAIoctl
InetNtopW
htons
ntohs
WSAGetLastError
inet_ntoa
gethostbyname
gethostname
WSAStringToAddressW
WSASetLastError
getpeername
getsockname
freeaddrinfo
getaddrinfo
WSAStartup
WSAResetEvent
WSAEventSelect
WSACleanup
bind
connect
recv
WSACloseEvent
WSACreateEvent
socket
WSAEnumNetworkEvents
WSAWaitForMultipleEvents

shlwapi

PathFileExistsA
StrChrW
PathFindFileNameA
PathFileExistsW

winmm

timeGetDevCaps
timeEndPeriod
timeBeginPeriod
timeGetTime

Sections

.text
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8a21b0684db619e9a1ac6f612937cd94

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

winmm

Sections

.text Size: 254KB - Virtual size: 254KB

.rdata Size: 81KB - Virtual size: 81KB

.data Size: 15KB - Virtual size: 32KB

.pdata Size: 13KB - Virtual size: 13KB

.rsrc Size: 34KB - Virtual size: 34KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 254KB - Virtual size: 254KB

.rdata
Size: 81KB - Virtual size: 81KB

.data
Size: 15KB - Virtual size: 32KB

.pdata
Size: 13KB - Virtual size: 13KB

.rsrc
Size: 34KB - Virtual size: 34KB

.reloc
Size: 6KB - Virtual size: 6KB