2faebee34e674ee9f7f163654717148e78c65a9ec80ed3d4f1cafdaa0cc399d3

Sharing

Copy URL Twitter E-mail

General

Target

2faebee34e674ee9f7f163654717148e78c65a9ec80ed3d4f1cafdaa0cc399d3
Size

315KB
MD5

bfffbd28688b495dc7601ac0ecefdf4f
SHA1

bf89e7ad5b2b811c981c931f34d2571bd10c4355
SHA256

2faebee34e674ee9f7f163654717148e78c65a9ec80ed3d4f1cafdaa0cc399d3
SHA512

052ae10efa8660d5e4054bc1643bfc2d5031a931f81b1a009aede9370b4b89857bcbf4046b6632fa11c1e8a6a1bf5282026fe685e233ff02e70c125f4946362e
SSDEEP

6144:AP2zbpJ/wWL6W2iLv5QLofL06L6VN13/SsLSoIg1sL/:AezWwYofQ6L6D13/ShoIg1sL/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2faebee34e674ee9f7f163654717148e78c65a9ec80ed3d4f1cafdaa0cc399d3

Files

2faebee34e674ee9f7f163654717148e78c65a9ec80ed3d4f1cafdaa0cc399d3
.exe windows:5 windows x86 arch:x86

440fdc1658dfb05cc7dc405076e32675

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

HotFixInstaller.pdb

Imports

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
InitiateSystemShutdownW
InitiateSystemShutdownExW
LookupAccountSidW
GetTokenInformation
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
CopySid
GetLengthSid
IsValidSid
InitializeAcl
AddAce
GetAclInformation
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
MakeSelfRelativeSD
GetSecurityDescriptorLength
GetSecurityDescriptorControl
MakeAbsoluteSD
InitializeSecurityDescriptor
RegCreateKeyExW
RegSetValueExW

kernel32

SetEvent
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
CreateFileW
GetLastError
ReadFile
ReadFileEx
WriteFile
GetOverlappedResult
SetFilePointer
FlushFileBuffers
GetFileSize
GetTempPathW
GetTempFileNameW
DeleteFileW
MoveFileW
CreateFileMappingW
UnmapViewOfFile
DuplicateHandle
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleFileNameW
CopyFileW
Sleep
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
CreateThread
WaitForSingleObject
MulDiv
WaitForSingleObjectEx
SetLastError
GetVersionExW
SetUnhandledExceptionFilter
CreateProcessW
ReleaseMutex
MapViewOfFile
CreateMutexW
InitializeCriticalSection
DeleteCriticalSection
GetCommandLineW
GetExitCodeProcess
GetUserDefaultUILanguage
SetThreadLocale
InterlockedExchange
GetSystemTime
GetStdHandle
WriteConsoleW
GetProcAddress
DebugBreak
HeapSetInformation
SizeofResource
LockResource
LoadResource
FindResourceW
RaiseException
lstrcpynW
MultiByteToWideChar
SetFileAttributesW
FindResourceExW
CreateEventW
CloseHandle
GetCurrentProcess
FreeLibrary
LoadLibraryW
GetSystemInfo
GetCurrentProcessId
GetModuleHandleW
IsProcessorFeaturePresent
InterlockedCompareExchange
GetProcessHeap
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetModuleHandleA
GetStringTypeW
GetStringTypeA
LCMapStringA
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
RtlUnwind
InitializeCriticalSectionAndSpinCount
LoadLibraryA
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
VirtualAlloc
HeapSize
IsDebuggerPresent
ExpandEnvironmentStringsW
GetEnvironmentVariableW
OutputDebugStringW
FormatMessageW
LocalFree
GetThreadLocale
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapDestroy
HeapCreate
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
ExitProcess
HeapAlloc
HeapFree
GetStartupInfoW

gdi32

RealizePalette
SelectPalette
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
DeleteObject

user32

SetWindowLongW
GetActiveWindow
GetWindow
GetDlgItem
IsWindow
ExitWindowsEx
PostMessageW
DefWindowProcW
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
SetWindowPos
SetWindowTextW
RegisterWindowMessageW
SendMessageW
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExW
MessageBoxW
CallWindowProcW
GetSystemMetrics
SetDlgItemTextW
UnregisterClassA
DestroyWindow
EndDialog
DialogBoxParamW
LoadImageW
GetDC
ReleaseDC
ShowWindow
EnableWindow
LoadCursorW
SetCursor
GetDesktopWindow

comdlg32

GetOpenFileNameW
GetSaveFileNameW

comctl32

PropertySheetW
DestroyPropertySheetPage
CreatePropertySheetPageW

shell32

SHGetFolderPathW
ShellExecuteW

ole32

CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantClear
SysStringLen
SysAllocString
SysFreeString
VariantInit
SysAllocStringByteLen
SysStringByteLen
OleLoadPicturePath

shlwapi

PathFindFileNameW
AssocQueryStringW
PathAppendW
PathFindExtensionW
PathRemoveFileSpecW
PathFileExistsW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

msi

ord78
ord8
ord238
ord88
ord169
ord137
ord141
ord116
ord115
ord171
ord254
ord70
ord150

userenv

ExpandEnvironmentStringsForUserW

Sections

.text
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

sbhfrx
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

440fdc1658dfb05cc7dc405076e32675

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

comdlg32

comctl32

shell32

ole32

oleaut32

shlwapi

version

msi

userenv

Sections

.text Size: 246KB - Virtual size: 245KB

.data Size: 12KB - Virtual size: 19KB

.rsrc Size: 28KB - Virtual size: 27KB

.reloc Size: 18KB - Virtual size: 18KB

sbhfrx Size: 4KB - Virtual size: 4KB

.text
Size: 246KB - Virtual size: 245KB

.data
Size: 12KB - Virtual size: 19KB

.rsrc
Size: 28KB - Virtual size: 27KB

.reloc
Size: 18KB - Virtual size: 18KB

sbhfrx
Size: 4KB - Virtual size: 4KB