AppPack_x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AppPack_x64.exe
Size

8.6MB
MD5

39c0d7bdae3c48b681a8d07982acc3d5
SHA1

85fc4dd471062df35f5588e16a8693681c8115f3
SHA256

1c54e0351c40685ce255cea0eacf8506f5fabdb8d8e6353e3222d61b9cfa24a8
SHA512

a56bb8c954757db59e64b7038d8fdd40f68a0a88d96c6820e4bc86a2c07473a904af970435a19c2b2e01d8eb22770d31a2f644c9a380a936b7427a4b1f90ad94
SSDEEP

49152:NFiM9wTJx0LAHrAKKZ2bxyd2RTMBISLdolorXPEiwGx61saFPIX3gSAYVnewoiTm:78+4RcLNa1wpTLz9Cx

Score

1^/10

Malware Config

Signatures

Files

AppPack_x64.exe
.exe windows:6 windows x64 arch:x64

39f2004774e924204b86169154d93672

Code Sign

67:f1:53:b2:0a:d3:39:9c:7e:dd:ce:2c:6c:af:d7:66
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07/06/2017, 00:00

Not After

20/07/2020, 23:59

Subject

CN=AnchorFree Inc,O=AnchorFree Inc,L=Menlo Park,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:9c:a9:dd:6c:18:eb:cc:d1:25:76:bb:e6:ec:88:0b:1d:5d:3a:65:7b:f4:d1:bc:82:d9:1a:b6:3a:51:7c:f1
Signer

Actual PE Digest

12:9c:a9:dd:6c:18:eb:cc:d1:25:76:bb:e6:ec:88:0b:1d:5d:3a:65:7b:f4:d1:bc:82:d9:1a:b6:3a:51:7c:f1

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ole32

CoUninitialize
OleSetContainedObject
OleUninitialize
OleInitialize
CoInitializeEx
CoGetClassObject

oleaut32

SysAllocStringLen
SysFreeString
SafeArrayCreate
SafeArrayDestroy
SafeArrayAccessData
VariantInit
VariantClear

gdi32

CreateSolidBrush
GetDeviceCaps

user32

GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
DefWindowProcW
PostQuitMessage
RegisterClassExW
CreateWindowExW
DestroyWindow
ShowWindow
SetWindowPos
IsIconic
IsZoomed
SetFocus
UpdateWindow
GetDC
ReleaseDC
SetWindowTextW
GetClientRect
GetWindowRect
AdjustWindowRect
GetWindowLongW
SetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
SetClassLongPtrW
GetDesktopWindow
LoadImageW
SystemParametersInfoW
GetClassNameW
GetMonitorInfoW
SendMessageA
WaitForInputIdle
GetForegroundWindow
GetWindowTextW
MessageBoxW
MessageBeep
EnumChildWindows
EnumWindows
MonitorFromWindow

comdlg32

GetSaveFileNameW
ChooseColorW
GetOpenFileNameW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

ntdll

NtWriteFile
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
NtQueryInformationProcess
NtCreateFile
NtCancelIoFileEx
RtlNtStatusToDosError
RtlPcToFileHeader
RtlDestroyProcessParameters
NtUnmapViewOfSection
RtlCreateProcessParametersEx
RtlUnwindEx
NtDeviceIoControlFile

kernel32

SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
SetHandleInformation
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
ReadProcessMemory
WriteProcessMemory
InitializeCriticalSectionAndSpinCount
TlsAlloc
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
QueryPerformanceCounter
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
TlsGetValue
GetCommandLineW
SetFileInformationByHandle
TlsSetValue
EncodePointer
TerminateProcess
QueryPerformanceFrequency
HeapAlloc
GetProcessHeap
HeapFree
TlsFree
HeapReAlloc
ReleaseMutex
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetFinalPathNameByHandleW
FreeLibrary
FormatMessageW
GetFullPathNameW
GetSystemInfo
GetConsoleWindow
CreateThread
GetCurrentThread
GetSystemTimeAsFileTime
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
SetConsoleOutputCP
SetConsoleCP
UnhandledExceptionFilter
WriteConsoleW
ReadConsoleW
ReleaseSRWLockShared
SetConsoleMode
GetConsoleMode
GetConsoleOutputCP
GetConsoleCP
GetACP
CreateProcessW
WaitForSingleObject
CloseHandle
Beep
GetStdHandle
WideCharToMultiByte
MultiByteToWideChar
MulDiv
GlobalFree
GlobalAlloc
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
OutputDebugStringW
GetCurrentProcess
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
RaiseException
DeleteCriticalSection
LoadLibraryExW
GetCurrentProcessId
GetCurrentThreadId

advapi32

LookupAccountSidW
RegSetValueExW
RegCreateKeyW
GetTokenInformation
OpenProcessToken
SystemFunction036
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

secur32

InitializeSecurityContextW
DeleteSecurityContext
AcceptSecurityContext
FreeContextBuffer
DecryptMessage
QueryContextAttributesW
EncryptMessage
ApplyControlToken
AcquireCredentialsHandleA
FreeCredentialsHandle

crypt32

CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateStore
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateContext
CertFreeCertificateContext

ws2_32

WSASend
send
WSAIoctl
shutdown
getpeername
getsockname
connect
bind
WSASocketW
closesocket
getsockopt
setsockopt
ioctlsocket
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
recv
WSAGetLastError

bcrypt

BCryptGenRandom

api-ms-win-crt-string-l1-1-0

strncpy
tolower
strcpy_s
isxdigit
strpbrk
strlen
wcscmp
wcslen
strncmp
wcscat
wcscpy
wcsncmp
wcsncpy
strcat
strcmp
strcpy
strncat

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
calloc
realloc
free

api-ms-win-crt-stdio-l1-1-0

__p__commode
__stdio_common_vsprintf
__acrt_iob_func
fputws
_set_fmode
_wfopen
__stdio_common_vfprintf
__stdio_common_vswprintf
fclose
_popen
_getcwd
_pclose
fputc
fgets
fopen

api-ms-win-crt-filesystem-l1-1-0

_wstat64
_stat64
remove
_wremove
_stat64i32

api-ms-win-crt-convert-l1-1-0

wcstoul
strtoul

api-ms-win-crt-environment-l1-1-0

_wgetenv
getenv

api-ms-win-crt-runtime-l1-1-0

_cexit
_c_exit
__p___argc
_register_thread_local_exe_atexit_callback
_exit
exit
system
__p___argv
_seh_filter_exe
_initterm_e
_initialize_onexit_table
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_register_onexit_function
_initterm
_crt_atexit
terminate
abort
_get_initial_narrow_environment

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 7.3MB - Virtual size: 7.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 952KB - Virtual size: 951KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39f2004774e924204b86169154d93672

Code Sign

67:f1:53:b2:0a:d3:39:9c:7e:dd:ce:2c:6c:af:d7:66Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

12:9c:a9:dd:6c:18:eb:cc:d1:25:76:bb:e6:ec:88:0b:1d:5d:3a:65:7b:f4:d1:bc:82:d9:1a:b6:3a:51:7c:f1Signer

Headers

DLL Characteristics

File Characteristics

Imports

ole32

oleaut32

gdi32

user32

comdlg32

shell32

api-ms-win-shcore-scaling-l1-1-1

ntdll

kernel32

advapi32

secur32

crypt32

ws2_32

bcrypt

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 7.3MB - Virtual size: 7.3MB

.rdata Size: 952KB - Virtual size: 951KB

.data Size: 25KB - Virtual size: 39KB

.pdata Size: 271KB - Virtual size: 271KB

_RDATA Size: 512B - Virtual size: 348B

.reloc Size: 22KB - Virtual size: 22KB

.rsrc Size: 16KB - Virtual size: 15KB

67:f1:53:b2:0a:d3:39:9c:7e:dd:ce:2c:6c:af:d7:66
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

12:9c:a9:dd:6c:18:eb:cc:d1:25:76:bb:e6:ec:88:0b:1d:5d:3a:65:7b:f4:d1:bc:82:d9:1a:b6:3a:51:7c:f1
Signer

.text
Size: 7.3MB - Virtual size: 7.3MB

.rdata
Size: 952KB - Virtual size: 951KB

.data
Size: 25KB - Virtual size: 39KB

.pdata
Size: 271KB - Virtual size: 271KB

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 22KB - Virtual size: 22KB

.rsrc
Size: 16KB - Virtual size: 15KB