MSCEditor112-8-1-12-1602870543 (1)[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

MSCEditor112-8-1-12-1602870543 (1).zip
Size

21.5MB
MD5

47a890fe4d26c544f93b07d9f14e70b6
SHA1

72bf04bd5fbfdea4c647635725cd40b873d69c6b
SHA256

8614e63b801782c45e436aa2b11cef3fab2675a1429d76eb07917531a8a7eb02
SHA512

75b7824fee81c784b9850429c23201e0fe1650bdff5d41c3219fc48e9527afe3ae154a5a4d0bf9412cb103a90461e952c2e201672ff15dd4a070314de0debfbb
SSDEEP

393216:1T9iHSNmGhu/BOlxQNwJ6GbvNNmBMz0O5z8hkNWA83Dw10f8MSXCDuEKK3miVGg/:1TIyNHhuFNwQGbvNNb0O5z8h2WA83cYH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/x64/MSCEditor.exe
unpack001/x86/MSCEditor.exe

Files

MSCEditor112-8-1-12-1602870543 (1).zip
.zip

Password: infected
README.txt
x64/MSCEditor.exe
.exe windows:6 windows x64 arch:x64

Password: infected

760ec52b4881dfc2b22c00b3d305f09b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FindClose
GetFileAttributesW
SetFileAttributesW
FormatMessageW
FileTimeToSystemTime
QueryPerformanceFrequency
MoveFileExW
GetConsoleWindow
GetTempFileNameW
CopyFileExW
QueryPerformanceCounter
AllocConsole
SetConsoleTitleW
MoveFileW
GetFileTime
SetEndOfFile
WriteConsoleW
HeapSize
ReadConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetACP
WriteFile
ExitProcess
HeapReAlloc
GetModuleHandleExW
RemoveDirectoryW
GetFileType
SetStdHandle
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetLocalTime
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameW
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStdHandle
FindNextFileW
CreateDirectoryW
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
CloseHandle
FreeResource
CreateFileW
GetFileSizeEx
SizeofResource
ExitThread
ReadFile
GetProcessHeap
LocalFree
HeapAlloc
FindResourceW
LoadResource
DeleteFileW
LockResource
GetLastError
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ResetEvent
SetEvent
GetCPInfo
GetLocaleInfoW
LCMapStringW
LocalAlloc
HeapFree
CompareStringW
DecodePointer
EncodePointer
GetProcAddress
GetModuleHandleW
LoadLibraryW
FindFirstFileW
GetTickCount
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
GetCurrentThread

user32

ShowScrollBar
GetWindowTextW
EnableWindow
EndPaint
BeginPaint
ChildWindowFromPoint
InvalidateRect
UpdateWindow
GetParent
CreateDialogIndirectParamW
SetScrollPos
CheckDlgButton
DrawIconEx
GetDlgItem
GetClientRect
TrackPopupMenuEx
MapDialogRect
SetMenuItemInfoW
DeferWindowPos
DefWindowProcW
GetWindow
EnumChildWindows
ScreenToClient
GetClassNameA
BeginDeferWindowPos
RegisterClassW
RegisterClassA
GetClassNameW
EndDeferWindowPos
IsWindowUnicode
OpenClipboard
CloseClipboard
EmptyClipboard
MoveWindow
ClipCursor
SetClipboardData
GetIconInfo
GetCursor
GetMenuItemID
GetMenu
GetSubMenu
IsWindow
CheckMenuItem
GetSysColorBrush
EnableMenuItem
DialogBoxParamW
SetRectEmpty
GetWindowTextLengthW
SetScrollInfo
CreateDialogParamW
LoadImageW
CallWindowProcW
PostMessageW
GetWindowRect
DestroyWindow
GetDC
SetWindowPos
MessageBoxW
SetWindowLongPtrW
CreateWindowExW
SendMessageW
EndDialog
GetSystemMetrics
SetWindowTextW
MessageBeep
CreatePopupMenu
GetScrollInfo
GetWindowLongPtrW
ShowWindow
OffsetRect
RedrawWindow
CopyRect
GetDlgCtrlID
MapWindowPoints
GetSysColor
GetDialogBaseUnits
IsDlgButtonChecked
DestroyMenu
SetFocus
LoadIconW
ScrollWindowEx
InsertMenuW

gdi32

SelectObject
CreateCompatibleDC
GetPixel
DeleteDC
GetObjectW
SetBkMode
SetWindowOrgEx
GetWindowOrgEx
GetTextMetricsW
SetTextColor
SetBkColor
DeleteObject
CreateSolidBrush

advapi32

RegCloseKey
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
SetSecurityDescriptorDacl
RegQueryValueExW
AllocateAndInitializeSid

shell32

ShellExecuteW
SHCreateItemFromParsingName
SHGetKnownFolderPath

ole32

CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance

comctl32

InitCommonControlsEx

urlmon

URLDownloadToFileW

d2d1

ord2
ord1

dwrite

DWriteCreateFactory

bcrypt

BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptFinishHash

shlwapi

SHCreateStreamOnFileEx
ord12

Sections

.text
Size: 820KB - Virtual size: 819KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 251KB - Virtual size: 250KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10.7MB - Virtual size: 10.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/msce.ini
x86/MSCEditor.exe
.exe windows:6 windows x86 arch:x86

Password: infected

bb9d978a563c40046a246a719b1bf8b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\patri\Documents\Visual Studio 2019\Projects\MSCEditor4\ReleaseWithMap\MSCEditor.pdb

Imports

kernel32

FindClose
GetFileAttributesW
SetFileAttributesW
FormatMessageW
FileTimeToSystemTime
QueryPerformanceFrequency
MoveFileExW
GetConsoleWindow
GetTempFileNameW
CopyFileExW
QueryPerformanceCounter
AllocConsole
SetConsoleTitleW
MoveFileW
GetFileTime
SetEndOfFile
WriteConsoleW
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
HeapReAlloc
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
ExitProcess
GetFileType
SetStdHandle
GetModuleHandleExW
ExitThread
RaiseException
RtlUnwind
RemoveDirectoryW
GetLocalTime
LoadLibraryExW
GetModuleFileNameW
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
GetCurrentThread
CreateThread
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
SetEvent
GetCPInfo
GetLocaleInfoW
GetStdHandle
FindNextFileW
CreateDirectoryW
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
CloseHandle
FreeResource
CreateFileW
GetFileSizeEx
SizeofResource
ReadFile
GetProcessHeap
LocalFree
HeapAlloc
FindResourceW
LoadResource
DeleteFileW
FindFirstFileW
LockResource
LCMapStringW
CompareStringW
GetProcAddress
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
GetLastError
LocalAlloc
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
HeapFree
DecodePointer
EncodePointer
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObjectEx
GetCurrentThreadId
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte

user32

CreateDialogParamW
GetWindowTextW
EnableWindow
EndPaint
BeginPaint
ChildWindowFromPoint
InvalidateRect
UpdateWindow
GetParent
CreateDialogIndirectParamW
SetScrollPos
CheckDlgButton
DrawIconEx
GetDlgItem
GetClientRect
TrackPopupMenuEx
SetWindowLongW
SetMenuItemInfoW
DeferWindowPos
DefWindowProcW
GetWindow
EnumChildWindows
ScreenToClient
GetClassNameA
BeginDeferWindowPos
RegisterClassW
RegisterClassA
GetClassNameW
EndDeferWindowPos
IsWindowUnicode
OpenClipboard
CloseClipboard
EmptyClipboard
MoveWindow
ClipCursor
SetClipboardData
GetIconInfo
GetCursor
GetMenuItemID
GetMenu
GetSubMenu
IsWindow
CheckMenuItem
GetSysColorBrush
EnableMenuItem
DialogBoxParamW
MapDialogRect
GetWindowLongW
GetWindowTextLengthW
SetScrollInfo
LoadImageW
ShowScrollBar
CallWindowProcW
PostMessageW
GetWindowRect
DestroyWindow
GetDC
SetWindowPos
MessageBoxW
CreateWindowExW
SendMessageW
EndDialog
GetSystemMetrics
SetWindowTextW
MessageBeep
CreatePopupMenu
GetScrollInfo
ShowWindow
OffsetRect
RedrawWindow
CopyRect
GetDlgCtrlID
MapWindowPoints
GetSysColor
GetDialogBaseUnits
IsDlgButtonChecked
DestroyMenu
SetFocus
LoadIconW
ScrollWindowEx
InsertMenuW
SetRectEmpty

gdi32

SelectObject
CreateCompatibleDC
GetPixel
DeleteDC
GetObjectW
SetBkMode
SetWindowOrgEx
GetWindowOrgEx
GetTextMetricsW
SetTextColor
SetBkColor
DeleteObject
CreateSolidBrush

advapi32

SetSecurityDescriptorDacl
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
RegQueryValueExW

shell32

SHCreateItemFromParsingName
ShellExecuteW
SHGetKnownFolderPath

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemFree

comctl32

InitCommonControlsEx

urlmon

URLDownloadToFileW

d2d1

ord1
ord2

dwrite

DWriteCreateFactory

bcrypt

BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptGetProperty
BCryptOpenAlgorithmProvider

shlwapi

ord12
SHCreateStreamOnFileEx

Sections

.text
Size: 594KB - Virtual size: 594KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10.7MB - Virtual size: 10.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x86/msce.ini

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

760ec52b4881dfc2b22c00b3d305f09b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

urlmon

d2d1

dwrite

bcrypt

shlwapi

Sections

.text Size: 820KB - Virtual size: 819KB

.rdata Size: 251KB - Virtual size: 250KB

.data Size: 22KB - Virtual size: 32KB

.pdata Size: 34KB - Virtual size: 33KB

.rsrc Size: 10.7MB - Virtual size: 10.7MB

.reloc Size: 6KB - Virtual size: 5KB

Password: infected

bb9d978a563c40046a246a719b1bf8b6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

urlmon

d2d1

dwrite

bcrypt

shlwapi

Sections

.text Size: 594KB - Virtual size: 594KB

.rdata Size: 146KB - Virtual size: 146KB

.data Size: 12KB - Virtual size: 18KB

.rsrc Size: 10.7MB - Virtual size: 10.7MB

.reloc Size: 31KB - Virtual size: 31KB

.text
Size: 820KB - Virtual size: 819KB

.rdata
Size: 251KB - Virtual size: 250KB

.data
Size: 22KB - Virtual size: 32KB

.pdata
Size: 34KB - Virtual size: 33KB

.rsrc
Size: 10.7MB - Virtual size: 10.7MB

.reloc
Size: 6KB - Virtual size: 5KB

.text
Size: 594KB - Virtual size: 594KB

.rdata
Size: 146KB - Virtual size: 146KB

.data
Size: 12KB - Virtual size: 18KB

.rsrc
Size: 10.7MB - Virtual size: 10.7MB

.reloc
Size: 31KB - Virtual size: 31KB