aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530

Sharing

Copy URL Twitter E-mail

General

Target
aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530
Size 796KB
Sample240326-1w8cbage3s
SHA256 aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530
MD5 ecf496cfed962afd923d73576633a810
SHA1 62f53ef7db3f013f56271d65fb5177f29f215941
SHA512 65cc989d2f47644d83de43c212ec20a5b68be5d34f679989bd801b893c7f69ff42ca148a93a14eae4023e8d30719b15f331f0b2aaad6584e47f674677b9637bf
SSDEEP 12288:MBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdNo:o/nts0Q9K/0ooRQIxAk2wi0N/A
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530

File Explorer

aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530

.dll 796KB

aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530

IMPHASH e8eb55b0c30a51d6debf49c2415612ee
SHA256 aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530
MD5 ecf496cfed962afd923d73576633a810
SHA1 62f53ef7db3f013f56271d65fb5177f29f215941
SHA512 65cc989d2f47644d83de43c212ec20a5b68be5d34f679989bd801b893c7f69ff42ca148a93a14eae4023e8d30719b15f331f0b2aaad6584e47f674677b9637bf
SSDEEP 12288:MBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdNo:o/nts0Q9K/0ooRQIxAk2wi0N/A
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

TTPnpins.pdb

LogonIdFromWinStationNameA LogonIdFromWinStationNameW RemoteAssistancePrepareSystemRestore ServerGetInternetConnectorStatus ServerLicensingClose ServerLicensingDeactivateCurrentPolicy ServerLicensingFreePolicyInformation ServerLicensingGetAvailablePolicyIds ServerLicensingGetPolicy ServerLicensingGetPolicyInformationA ServerLicensingGetPolicyInformationW ServerLicensingLoadPolicy ServerLicensingOpenA ServerLicensingOpenW ServerLicensingSetPolicy ServerLicensingUnloadPolicy ServerQueryInetConnectorInformationA ServerQueryInetConnectorInformationW ServerSetInternetConnectorStatus WinStationActivateLicense WinStationAutoReconnect WinStationBroadcastSystemMessage WinStationCheckAccess WinStationCheckLoopBack WinStationCloseServer WinStationConnectA WinStationConnectCallback WinStationConnectEx WinStationConnectW WinStationDisconnect WinStationEnumerateA WinStationEnumerateExW WinStationEnumerateLicenses WinStationEnumerateProcesses WinStationEnumerateW WinStationEnumerate_IndexedA WinStationEnumerate_IndexedW WinStationFreeConsoleNotification WinStationFreeGAPMemory WinStationFreeMemory WinStationFreePropertyValue WinStationFreeUserCertificates WinStationFreeUserCredentials WinStationGenerateLicense WinStationGetAllProcesses WinStationGetAllSessionsW WinStationGetConnectionProperty WinStationGetDeviceId WinStationGetInitialApplication WinStationGetLanAdapterNameA WinStationGetLanAdapterNameW WinStationGetLoggedOnCount WinStationGetMachinePolicy WinStationGetProcessSid WinStationGetRestrictedLogonInfo WinStationGetSessionIds WinStationGetTermSrvCountersValue WinStationGetUserCertificates WinStationGetUserCredentials WinStationGetUserProfile WinStationInstallLicense WinStationIsHelpAssistantSession WinStationIsSessionPermitted WinStationIsSessionRemoteable WinStationNameFromLogonIdA WinStationNameFromLogonIdW WinStationNegotiateSession WinStationNtsdDebug WinStationOpenServerA WinStationOpenServerExA WinStationOpenServerExW WinStationOpenServerW WinStationQueryAllowConcurrentConnections WinStationQueryEnforcementCore WinStationQueryInformationA WinStationQueryInformationW WinStationQueryLicense WinStationQueryLogonCredentialsW WinStationQuerySessionVirtualIP WinStationQueryUpdateRequired WinStationRedirectErrorMessage WinStationRedirectLogonBeginPainting WinStationRedirectLogonError WinStationRedirectLogonMessage WinStationRedirectLogonStatus WinStationRegisterConsoleNotification WinStationRegisterConsoleNotificationEx WinStationRegisterNotificationEvent WinStationRemoveLicense WinStationRenameA WinStationRenameW WinStationReportUIResult WinStationReset WinStationRevertFromServicesSession WinStationSendMessageA WinStationSendMessageW WinStationSendWindowMessage WinStationServerPing WinStationSetAutologonPassword WinStationSetInformationA WinStationSetInformationW WinStationSetPoolCount WinStationShadow WinStationShadowStop WinStationShutdownSystem WinStationSwitchToServicesSession WinStationSystemShutdownStarted WinStationSystemShutdownWait WinStationTerminateProcess WinStationUnRegisterConsoleNotification WinStationUnRegisterNotificationEvent WinStationUserLoginAccessCheck WinStationVerify WinStationVirtualOpen WinStationVirtualOpenEx WinStationWaitSystemEvent _NWLogonQueryAdmin _NWLogonSetAdmin _WinStationAnnoyancePopup _WinStationBeepOpen _WinStationBreakPoint _WinStationCallback _WinStationCheckForApplicationName _WinStationFUSCanRemoteUserDisconnect _WinStationGetApplicationInfo _WinStationNotifyDisconnectPipe _WinStationNotifyLogoff _WinStationNotifyLogon _WinStationNotifyNewSession _WinStationOpenSessionDirectory _WinStationReInitializeSecurity _WinStationReadRegistry _WinStationSessionInitialized _WinStationShadowTarget _WinStationShadowTarget2 _WinStationShadowTargetSetup _WinStationUpdateClientCachedCredentials _WinStationUpdateSettings _WinStationUpdateUserConfig _WinStationWaitForConnect

Name

.text

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

524KB

Virtual Size

521KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

108KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

503B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

802B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

503B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

954B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

431B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=52, id=225, productName=VS2013 UPD2 build 30501, version=30501,

count=308, id=122, productName=VS2005 build 50727, version=50727,

count=395, id=1, productName=Unmarked objects,

count=67, id=202, productName=VS2012 UPD1 build 51106, version=51106,

count=479, id=149, productName=VS2008 build 21022, version=21022,

count=192, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=405, id=259, productName=VS2015 [14.0] build 23026, version=23026,

count=147, id=220, productName=VS2013 build 21005, version=21005,

count=145, id=258, productName=VS2015 UPD1 build 23506, version=23506,

count=248, id=204, productName=VS2012 UPD3 build 60610, version=60610,

count=409, id=157, productName=VS2010 build 30319, version=30319,

count=250, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=155, id=157, productName=VS2010 build 30319, version=30319,

count=314, id=222, productName=VS2013 UPD4 build 31101, version=31101,

count=197, id=225, productName=VS2013 build 21005, version=21005,

count=19, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530

advapi32

comdlg32

setupapi

generic