9d0ab5c4d5346fdef3a73f8eace3c44d51d15fb45fb163b96531280af633e397

Resubmissions

25/04/2024, 14:46

240425-r5ksyabf5w10

05/04/2024, 10:00

240405-l14scshe623

Sharing

Copy URL Twitter E-mail

General

Target
9d0ab5c4d5346fdef3a73f8eace3c44d51d15fb45fb163b96531280af633e397
Size 287KB
Sample240405-l14scshe62
SHA256 9d0ab5c4d5346fdef3a73f8eace3c44d51d15fb45fb163b96531280af633e397
MD5 b27dd5f143f6b6439f961d7a8b2ab694
SHA1 6cc977fe100747f0b4929de2094522ca54f9cb71
SHA512 46d8c4c2cd226460d7493f2c7c542de5dda539fa7e3269b3f1efdc64a4b2ada66149c0c143fd24b92fd12f540d59bd96da5e62cd81047988ed217680a7080d53
SSDEEP 6144:Ihi4JoXBtSE9Mrd9PUn732lLRnArX80xiKUinuPllHzcA5gbP3:CfJoRZMh9P2732lhMF5UiYlHfeD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/mbaeapina.dll

File Explorer

9d0ab5c4d5346fdef3a73f8eace3c44d51d15fb45fb163b96531280af633e397

.cab 287KB
mbaeapina.dll

.dll 740KB

9d0ab5c4d5346fdef3a73f8eace3c44d51d15fb45fb163b96531280af633e397

SHA256 9d0ab5c4d5346fdef3a73f8eace3c44d51d15fb45fb163b96531280af633e397
MD5 b27dd5f143f6b6439f961d7a8b2ab694
SHA1 6cc977fe100747f0b4929de2094522ca54f9cb71
SHA512 46d8c4c2cd226460d7493f2c7c542de5dda539fa7e3269b3f1efdc64a4b2ada66149c0c143fd24b92fd12f540d59bd96da5e62cd81047988ed217680a7080d53
SSDEEP 6144:Ihi4JoXBtSE9Mrd9PUn732lLRnArX80xiKUinuPllHzcA5gbP3:CfJoRZMh9P2732lhMF5UiYlHfeD
MD5 SHA1 SHA512 SSDEEP

mbaeapina.dll

IMPHASH 22ee5a3e54f624bc62e9f4702475fdb4
SHA256 9856b816a9d14d3b7db32f30b07624e4bcda7f1e265a7bb7a3e3476bfd54a759
MD5 f46e75eb89214e2fbb850b9d29b9f515
SHA1 1f35835a08f96fd9198864b8ded5baa1a27db710
SHA512 9168a57de11da133d0ba98c8b7491520e9c75ad4678a5ac11e9220e483bcf7a2b9cc868ffc19de60094e87a5059303d20bd1f4a30c4f567ab4c3237f5f4c520d
SSDEEP 12288:K+lcFmBrQHSTbgEQyl9l7zvUnyVK8vFn+hPrDqYOvMiue:8MES/3Qmn7oc9MiV
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

352696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

e:\jenkins_slave\workspace\N_MBAE_AeSdk\bin\x64\ReleaseNA\mbae-api-na.pdb

crypt32

CertComparePublicKeyInfo CryptMsgOpenToDecode CryptBinaryToStringW CryptMsgGetParam CryptMsgUpdate CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertOpenStore CertGetNameStringW CryptQueryObject CryptMsgClose

kernel32

LeaveCriticalSection EnterCriticalSection TryEnterCriticalSection GetLogicalDriveStringsW OpenProcess GetExitCodeProcess TerminateProcess Process32FirstW QueryDosDeviceW Module32FirstW Process32NextW CreateToolhelp32Snapshot Module32NextW GetCurrentProcess WaitForSingleObject InitializeCriticalSection DisableThreadLibraryCalls DeleteCriticalSection CreateThread SetEvent CreateRemoteThread SetLastError GetExitCodeThread CreateEventW WaitForMultipleObjects GetSystemDirectoryW SystemTimeToFileTime SetFilePointerEx GetSystemTimeAsFileTime GetPrivateProfileStringW FileTimeToSystemTime SwitchToThread WideCharToMultiByte MultiByteToWideChar GetVersion SetThreadPriority TerminateThread ReleaseSemaphore ReleaseMutex DuplicateHandle GetProcessHeap CreatePipe lstrcpyA lstrcatA lstrlenA CreateMutexW CreateSemaphoreW IsBadReadPtr VirtualProtectEx ExitProcess WriteProcessMemory ResumeThread lstrcpyW lstrlenW GetCurrentDirectoryW VirtualProtect VirtualQuery VirtualAllocEx VirtualFreeEx VirtualQueryEx GetCurrentThread OpenThread GetThreadContext SetThreadContext Thread32First Thread32Next VirtualAlloc VirtualFree GetOverlappedResult ResetEvent DeviceIoControl CreateFileMappingA CancelIo OpenEventW OpenFileMappingW GetWindowsDirectoryW FlushFileBuffers WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP LoadLibraryExW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetFileType HeapFree HeapAlloc GetFileSize ReadProcessMemory LoadLibraryW FreeLibrary VerifyVersionInfoW GetModuleHandleW VerSetConditionMask LocalAlloc lstrcmpA FindNextFileW FindClose FindFirstFileW GetCurrentProcessId DeleteFileW OutputDebugStringA GetCurrentThreadId GetFileAttributesExW GetModuleFileNameA GetSystemInfo LoadLibraryA GetLocalTime MoveFileW GetLastError GetModuleFileNameW ReadFile GetVersionExW Sleep GetLocaleInfoW WriteFile OutputDebugStringW CreateDirectoryW GetSystemDefaultUILanguage GetFullPathNameW LocalFree CloseHandle GetModuleHandleA CreateFileMappingW GetProcAddress GetFileSizeEx CreateFileW GetFileAttributesW UnmapViewOfFile MapViewOfFile GetTickCount GetStdHandle HeapSize GetModuleHandleExW GetOEMCP GetACP IsValidCodePage LCMapStringW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCPInfo RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader GetCommandLineA HeapReAlloc IsProcessorFeaturePresent IsDebuggerPresent GetStringTypeW EncodePointer DecodePointer

user32

GetSystemMetrics wsprintfW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW CryptGetHashParam CryptAcquireContextW CryptReleaseContext SetNamedSecurityInfoW GetNamedSecurityInfoW CryptCreateHash SetEntriesInAclW CryptDestroyHash CryptHashData SetSecurityDescriptorDacl InitializeSecurityDescriptor ConvertStringSecurityDescriptorToSecurityDescriptorW StartServiceW SetServiceObjectSecurity QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigW RegSetValueExA RegQueryValueExA RegOpenKeyExA RegEnumKeyW RegDeleteValueA GetKernelObjectSecurity FreeSid AllocateAndInitializeSid GetTokenInformation RegEnumKeyExW RegNotifyChangeKeyValue RegEnumValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken CreateWellKnownSid RegCreateKeyExW

shell32

CommandLineToArgvW SHGetFolderPathW

psapi

GetModuleInformation GetModuleBaseNameW GetProcessImageFileNameW EnumProcessModulesEx

netapi32

NetWkstaGetInfo NetApiBufferFree

wintrust

CryptCATAdminAcquireContext WinVerifyTrust CryptCATAdminEnumCatalogFromHash CryptCATAdminReleaseContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminReleaseCatalogContext CryptCATCatalogInfoFromContext

shlwapi

StrStrIW

Name

.text

Size

409KB

Virtual Size

409KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

200KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=199, version=41118,

count=13, id=223, version=20806,

count=77, id=225, version=20806,

count=197, id=224, version=20806,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=135, version=30729,

count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=223, productName=VS2013 UPD5 build 40629, version=40629,

count=12, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=25, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=274, id=1, productName=Unmarked objects,

count=3, id=203, version=65501,

count=35, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,