SkinChanger-874418[.]zip

Resubmissions

04/04/2024, 14:43

240404-r3qleabb447

04/04/2024, 14:40

240404-r1tv2sad517

Sharing

Copy URL Twitter E-mail

General

Target
SkinChanger-874418.zip
Size 24.9MB
Sample240404-r3qleabb44
SHA256 08ce69ddc27e8ae79d132fe69633cc2f33d8c81b873531847615c56b327e4807
MD5 c1059351d69dde3f5ba9a41af5a26697
SHA1 019ddbff55f0208a9f21bf367aed49cfa8c868f4
SHA512 6d8875176ce5742c15f7a415d9d150f9c65ec41e6d246ca5936ea08980d4f758c36135dac541db92fd0b3c4094e497bea7ff29059e146c9870f2eed0ada103f0
SSDEEP 786432:D0FbDCSjulG3JSNF/+g70/wYS91oZb+goP5:QJeSKlG342gYoYS9M1oh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Install_01234.exe

File Explorer

SkinChanger-874418.zip

.zip 24.9MB
Install_01234.exe

.exe 31.4MB

SkinChanger-874418.zip

SHA256 08ce69ddc27e8ae79d132fe69633cc2f33d8c81b873531847615c56b327e4807
MD5 c1059351d69dde3f5ba9a41af5a26697
SHA1 019ddbff55f0208a9f21bf367aed49cfa8c868f4
SHA512 6d8875176ce5742c15f7a415d9d150f9c65ec41e6d246ca5936ea08980d4f758c36135dac541db92fd0b3c4094e497bea7ff29059e146c9870f2eed0ada103f0
SSDEEP 786432:D0FbDCSjulG3JSNF/+g70/wYS91oZb+goP5:QJeSKlG342gYoYS9M1oh
MD5 SHA1 SHA512 SSDEEP

Install_01234.exe

IMPHASH fabb8ba9aebfc0ce54e565b7b38d8b74
SHA256 f6de6be71e6e3ba5946960993f85675822742d3b0c4c2091a32495f7e0a97a12
MD5 7fcd260ef5c45430f08171291a55c15a
SHA1 00d52875677faf7b35980d3dc604c80c29bce658
SHA512 70e411c1b9728a4fc663902ddace44695b0d3af4dbb55e523549193f035b897a9414ec554ff7ea720ea019df09d2168f4a5d1a00568c0aa11b8e0d26733b7d09
SSDEEP 786432:zrrrr8UhqpakPyTGhTi/btOWVMpmyovt23XuyeKe:wrokqTGhSUWOAyovaHe3
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6302786

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VerifyVersionInfoW FlushFileBuffers CreateDirectoryA GetThreadPriority PeekNamedPipe FreeEnvironmentStringsW FindNextFileA GetFileSizeEx SetPriorityClass LeaveCriticalSection GetSystemInfo SetThreadPriority GetProcessHeap InterlockedPushEntrySList DeleteTimerQueueTimer OutputDebugStringW InitializeCriticalSection EnumSystemLocalesW DuplicateHandle AcquireSRWLockExclusive SetLastError GetSystemDirectoryW InterlockedPopEntrySList GetLogicalDriveStringsW SwitchToThread WriteFile TlsGetValue LCMapStringW RegisterWaitForSingleObject RemoveDirectoryA GetSystemTimeAsFileTime GetTickCount CreateFileA SignalObjectAndWait lstrlenA GetVersionExW Sleep FindNextFileW SetFileAttributesA GetFileAttributesExW GetLastError InitializeCriticalSectionEx LocalFree GetTickCount64 HeapAlloc GetCurrentThreadId SetFilePointer SetFileTime GetFileType FindFirstFileExW ExitProcess SetFileAttributesW GetModuleHandleExW GetThreadTimes IsValidLocale GetEnvironmentVariableA HeapSize GetTimeFormatW InterlockedDecrement InterlockedExchange UnregisterWait LoadLibraryA GetProcessAffinityMask GlobalUnlock VerSetConditionMask CreateDirectoryW TlsAlloc GetFileAttributesA QueryPerformanceCounter RaiseException MoveFileExW InitializeSListHead RemoveDirectoryW GlobalFree ReadFile FreeLibraryAndExitThread GetNumaHighestNodeNumber GetModuleHandleA lstrcatA InterlockedIncrement FormatMessageA ReleaseSRWLockExclusive SetFilePointerEx DeleteFileA TlsFree GetFileInformationByHandle GetCommandLineW GetModuleFileNameW CreateTimerQueue GetCurrentProcess GetFileSize GetCurrentDirectoryW GetCPInfo GlobalAlloc QueryDepthSList GetFileAttributesW GlobalMemoryStatus IsDebuggerPresent SetThreadAffinityMask CompareStringW HeapReAlloc GetModuleFileNameA VirtualFree GetVersionExA TlsSetValue LoadLibraryW InitializeCriticalSectionAndSpinCount CreateEventW SetUnhandledExceptionFilter RtlUnwind LoadLibraryExW WaitForSingleObjectEx AreFileApisANSI FreeLibrary GetModuleHandleW TerminateProcess SleepEx SetEvent GetConsoleCP ChangeTimerQueueTimer GetProcAddress InterlockedFlushSList MoveFileA MoveFileW GetFullPathNameW ReadConsoleW GetStringTypeW GetStdHandle GetDriveTypeW FindClose CreateFileW GetACP CreateSemaphoreA WaitForMultipleObjects GetOEMCP FileTimeToSystemTime GetLogicalDriveStringsA MultiByteToWideChar ExitThread UnregisterWaitEx GetStartupInfoW CompareFileTime GetUserDefaultLCID GetTimeZoneInformation GlobalLock GetDateFormatW WriteConsoleW SetEnvironmentVariableA ResetEvent GetCurrentDirectoryA IsValidCodePage FindFirstFileW SetEndOfFile CreateEventA EncodePointer GetCommandLineA GetCurrentProcessId GetEnvironmentStringsW SetStdHandle HeapFree CreateThread VirtualAlloc GetVersion ReleaseSemaphore GetCurrentThread CloseHandle IsProcessorFeaturePresent UnhandledExceptionFilter DeleteFileW FileTimeToLocalFileTime WideCharToMultiByte EnterCriticalSection DeleteCriticalSection CreateTimerQueueTimer FindFirstFileA WaitForSingleObject VirtualProtect QueryPerformanceFrequency DecodePointer FormatMessageW CreateSemaphoreW GetLocaleInfoW GetConsoleMode

user32

wsprintfA InvalidateRect GetKeyState ShowWindow GetWindowRect SetWindowTextA MessageBoxA GetDlgItem EnableWindow GetFocus GetWindowTextW MapDialogRect EndDialog SetWindowLongA EmptyClipboard GetWindowTextLengthW MonitorFromWindow MessageBoxW OpenClipboard SendMessageA LoadStringW SystemParametersInfoA DialogBoxParamW CloseClipboard ScreenToClient GetWindowTextA LoadIconA GetWindowTextLengthA IsDlgButtonChecked SendMessageW LoadCursorA SetTimer KillTimer CharUpperA SetClipboardData SetCursor LoadStringA GetParent GetWindowLongA SetFocus SetWindowTextW CheckDlgButton PostMessageA MoveWindow CharUpperW GetMonitorInfoA DialogBoxParamA

advapi32

CryptDestroyHash CryptCreateHash CryptAcquireContextW CryptImportKey CryptEncrypt CryptHashData CryptGetHashParam CryptReleaseContext CloseServiceHandle CryptDestroyKey

shell32

SHGetSpecialFolderPathW SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA

ole32

CoInitialize CoUninitialize CoTaskMemFree OleInitialize CoCreateInstance

oleaut32

SysStringLen SysFreeString VariantClear SysAllocString SysAllocStringLen

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateChain CryptDecodeObjectEx CryptStringToBinaryW CertEnumCertificatesInStore CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertGetNameStringW CertOpenStore CertFindExtension CertFreeCertificateChainEngine CertFindCertificateInStore CertGetCertificateChain CertFreeCertificateContext CryptQueryObject PFXImportCertStore

wldap32

ord26 ord145 ord219 ord46 ord14 ord216 ord73 ord208 ord41 ord117 ord27 ord127 ord167 ord142 ord79 ord133 ord147 ord301

ws2_32

WSASetLastError getsockopt send WSAIoctl freeaddrinfo WSAEventSelect WSACloseEvent WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs gethostname WSAStartup WSACleanup setsockopt getaddrinfo htons __WSAFDIsSet select accept bind connect getsockname htonl listen recv socket WSAEnumNetworkEvents WSACreateEvent recvfrom sendto getpeername ioctlsocket