11e96f2449e3fa7cb93e96af68b6fdea11c81f284094daaa067e0ef7df449619

General

Target
11e96f2449e3fa7cb93e96af68b6fdea11c81f284094daaa067e0ef7df449619
Size 2.4MB
Sample240507-ndzagade4v
SHA256 11e96f2449e3fa7cb93e96af68b6fdea11c81f284094daaa067e0ef7df449619
MD5 9204715f161063695663602d1d43da82
SHA1 2773332561e14710fd4514c6a6cdcb3384863fd2
SHA512 c068570b6fe947bd10676fc31efcf21ee79ab7eb19bc763919bbc7526515a6ccb5673cf32b0a75c8d86d67c338ca07016feb78c2802bc58e934a1eba788bb640
SSDEEP 49152:8VDZKvw4H8LMonNhJ+DkJE6GFVfoPRNJzaBt8:SDEvw4qjj2ENJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11e96f2449e3fa7cb93e96af68b6fdea11c81f284094daaa067e0ef7df449619

File Explorer

11e96f2449e3fa7cb93e96af68b6fdea11c81f284094daaa067e0ef7df449619

.exe 2.4MB

11e96f2449e3fa7cb93e96af68b6fdea11c81f284094daaa067e0ef7df449619

IMPHASH a6d2739c672c57895544c6292eba970b
SHA256 11e96f2449e3fa7cb93e96af68b6fdea11c81f284094daaa067e0ef7df449619
MD5 9204715f161063695663602d1d43da82
SHA1 2773332561e14710fd4514c6a6cdcb3384863fd2
SHA512 c068570b6fe947bd10676fc31efcf21ee79ab7eb19bc763919bbc7526515a6ccb5673cf32b0a75c8d86d67c338ca07016feb78c2802bc58e934a1eba788bb640
SSDEEP 49152:8VDZKvw4H8LMonNhJ+DkJE6GFVfoPRNJzaBt8:SDEvw4qjj2ENJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

485046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\master_lu\inst_ui\inst_ui\Release\inst_ui.pdb

kernel32

HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap SetFilePointer CloseHandle MapViewOfFile UnmapViewOfFile CreateFileMappingW CreateFileW GetFileAttributesExW GetLongPathNameW OpenProcess GetCurrentProcessId GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection CreateMutexW GetModuleFileNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW RaiseException GetCurrentThreadId SetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection MultiByteToWideChar LockResource FreeLibrary SetEvent WaitForSingleObject WaitForMultipleObjects LoadResource SizeofResource CreateEventW FindResourceW FindResourceExW GetVersionExW GlobalAlloc GlobalLock GlobalUnlock GlobalFree MulDiv GetProcAddress GetCurrentProcess TerminateProcess GetExitCodeProcess LoadLibraryW GetModuleHandleW WideCharToMultiByte LockFile UnlockFile GetFileSize ReadFile DecodePointer InterlockedIncrement InterlockedDecrement lstrcmpiW LoadLibraryExW DeleteFileW MoveFileExW LocalFree FindClose lstrlenW RemoveDirectoryW GetFullPathNameW SetFileAttributesW GetFileAttributesW FindFirstFileW FindNextFileW WriteFile GetLogicalDriveStringsW GetDriveTypeW GetTempPathW GetDiskFreeSpaceExW GetTempFileNameW Sleep GetTickCount WaitForSingleObjectEx OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA ReadConsoleW SetEndOfFile SetStdHandle SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW WriteConsoleW GetACP GetStdHandle GetModuleFileNameA ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread InterlockedFlushSList RtlUnwind CreateFileA lstrcmpiA lstrcmpA DeviceIoControl ResetEvent GetSystemWindowsDirectoryW FreeResource InterlockedCompareExchange GetThreadSelectorEntry ResumeThread SuspendThread GetThreadContext GetThreadPriority SetThreadPriority OpenThread GetCurrentThread GetWindowsDirectoryW GetSystemDirectoryW FindNextFileA FindFirstFileA FlushFileBuffers QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter ReleaseMutex GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree OpenFileMappingW GetFileSizeEx GetStringTypeW FormatMessageW SwitchToThread TlsAlloc

user32

LoadImageW SetWindowTextW GetSystemMetrics MoveWindow PostQuitMessage CharNextW PeekMessageW DispatchMessageW TranslateMessage GetMessageW GetShellWindow SystemParametersInfoW SetWindowRgn IsWindowVisible UpdateLayeredWindow RegisterWindowMessageW ShowWindow GetMonitorInfoW MonitorFromWindow IsDialogMessageW GetWindow GetParent ScreenToClient GetWindowRect EndDialog DialogBoxParamW BringWindowToTop SetWindowPos IsRectEmpty RedrawWindow SetCursor CopyRect PtInRect OffsetRect SetRect IsWindow ReleaseDC GetDC KillTimer SetTimer GetClientRect GetWindowTextLengthW GetWindowTextW InvalidateRect EndPaint BeginPaint DrawTextW LoadCursorW SetWindowLongW GetWindowLongW DestroyWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW CallWindowProcW DefWindowProcW PostMessageW SendMessageW GetWindowThreadProcessId FindWindowExW wsprintfW FindWindowW UnregisterClassA DrawFocusRect MapWindowPoints

oleaut32

SysFreeString SysAllocString VariantClear VarUI4FromStr VariantInit

generic

count=18, id=241, version=40116,

count=171, id=243, version=40116,

count=31, id=242, version=40116,

count=2, id=264, version=27030,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=3, id=260, version=27031,

count=6, id=261, version=27032,

count=2, id=199, version=41118,

count=25, id=259, version=26706,

count=6, id=261, version=27031,

count=35, id=260, version=26706,

count=75, id=261, version=26706,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=393, id=1, productName=Unmarked objects,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=67, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=256, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,

Sharing

General

Malware Config

Signatures

File Explorer

11e96f2449e3fa7cb93e96af68b6fdea11c81f284094daaa067e0ef7df449619

kernel32

user32

oleaut32

generic