b8d3b767947c72dc35bf61d7e17126f8

Sharing

Copy URL Twitter E-mail

General

Target

b8d3b767947c72dc35bf61d7e17126f8
Size

246KB
MD5

b8d3b767947c72dc35bf61d7e17126f8
SHA1

a8e0c12ba4fc04cdb56764f65fd7cf580c84317f
SHA256

41809b848a3ee9a8254ae61294802380cb426e13b3079a0f69d3fd3a1859ab6b
SHA512

02bbb7601e1e3e66484fc731b91dbfa77f3e255be6e6a2beb6573e4e504131d5726a6711d5a34c8a6a2f6a9dc55b213ebf51228d50d49649976cc7b45ee1a673
SSDEEP

6144:DBjaJKZq8PwZuwoh8VPVlZmvJ12PWNrPDWf:DB+J6sZuwo27ZIJoo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b8d3b767947c72dc35bf61d7e17126f8

Files

b8d3b767947c72dc35bf61d7e17126f8
.exe windows:6 windows x64 arch:x64

3460ae4ee3908ea7e80909ead0204ab1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

TabTip.pdb

Imports

user32

GetWindow
GetAncestor
GetDlgCtrlID
WaitForInputIdle
MapVirtualKeyW
MapVirtualKeyExW
GetKeyboardLayout
GetForegroundWindow
GetWindowThreadProcessId
SendInput
UnhookWinEvent
SetWinEventHook
SetThreadDesktop
FindWindowW
GetSystemMetrics
SetProcessDPIAware
CloseDesktop
OpenInputDesktop
GetUserObjectInformationW
CharNextW
KillTimer
SetTimer
PostMessageW
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
UnregisterClassA
GetClassNameW
CharUpperW
GetThreadDesktop

msvcrt

memcpy_s
_wcsicmp
wcsstr
free
_beginthreadex
_wcsnicmp
wcstol
malloc
__CxxFrameHandler3
memmove_s
memcmp
calloc
_purecall
towupper
wcsrchr
_itow
qsort
wcschr
iswspace
_errno
realloc
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_vsnwprintf
_CxxThrowException
_exit
_XcptFilter
__wgetmainargs
__C_specific_handler
memset
_callnewh
wcsncmp
vswprintf_s
_vscwprintf
_wtoi
memcpy

ntdll

EtwEventRegister
EtwEventWrite
EtwEventUnregister
WinSqmAddToStream
NtQuerySystemInformation
RtlReportException
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
SetProcessShutdownParameters
CreateThread
CreateProcessAsUserW
GetExitCodeProcess
TerminateProcess
GetStartupInfoW
GetCurrentProcessId

api-ms-win-security-base-l1-1-0

InitializeSid
GetSidSubAuthority
CopySid
GetLengthSid
IsValidSid
EqualSid
InitializeAcl
AddAce
MakeAbsoluteSD
InitializeSecurityDescriptor
GetTokenInformation
DuplicateTokenEx
GetAclInformation
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
SetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSidLengthRequired
GetSecurityDescriptorControl

kernel32

CreateTimerQueueTimer
GetTickCount
QueueUserWorkItem
CompareStringW
WaitForMultipleObjects
Sleep
GetFileTime
OpenEventW
CreateFileW
GetModuleHandleW
GetModuleFileNameW
HeapSetInformation
LoadLibraryExW
GetModuleHandleExW
RegisterWaitForSingleObject
RaiseException
GetProcAddress
lstrlenW
FreeLibrary
WaitForSingleObject
SetEvent
CreateEventW
GetLastError
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
OpenProcess
CreateMutexW
DeleteTimerQueueTimer
K32EnumProcessModules
K32GetModuleFileNameExW
K32GetModuleBaseNameW
CompareFileTime
LoadLibraryW
GetVersionExA
HeapDestroy
HeapAlloc
UnregisterWait
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
OutputDebugStringA
GetCommandLineW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ole32

CoInitializeEx
CoTaskMemFree
CoDisconnectObject
CoRevokeClassObject
CoRegisterClassObject
CoInitialize
CoResumeClassObjects
CoInitializeSecurity
CoEnableCallCancellation
CoDisableCallCancellation
CoCancelCall
CoCreateInstance
CoUninitialize

oleaut32

VarBstrCat
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayGetVartype
SafeArrayCopy
SysAllocStringByteLen
SafeArrayCreate
SafeArrayDestroy
SafeArrayLock
SafeArrayUnlock
VarBstrCmp
VariantClear
VariantInit
SysStringLen
SafeArrayRedim
SysStringByteLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
SysFreeString

oleacc

AccessibleObjectFromWindow

shlwapi

PathFileExistsW
SHCreateStreamOnFileEx

imm32

ImmDisableTextFrameService

slc

SLGetWindowsInformationDWORD

shell32

SHGetFolderPathW

comctl32

ord344

api-ms-win-core-localregistry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
StartServiceW
OpenServiceW

Sections

.text
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3460ae4ee3908ea7e80909ead0204ab1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

msvcrt

ntdll

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-base-l1-1-0

kernel32

version

ole32

oleaut32

oleacc

shlwapi

imm32

slc

shell32

comctl32

api-ms-win-core-localregistry-l1-1-0

api-ms-win-service-management-l1-1-0

Sections

.text Size: 139KB - Virtual size: 139KB

.data Size: 1KB - Virtual size: 4KB

.pdata Size: 8KB - Virtual size: 7KB

.rsrc Size: 67KB - Virtual size: 67KB

.reloc Size: 29KB - Virtual size: 30KB

.text
Size: 139KB - Virtual size: 139KB

.data
Size: 1KB - Virtual size: 4KB

.pdata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 67KB - Virtual size: 67KB

.reloc
Size: 29KB - Virtual size: 30KB