18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d

Sharing

Copy URL Twitter E-mail

General

Target
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d
Size 1.5MB
Sample240519-wxnbbaba96
SHA256 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d
MD5 0aeca481aacf87ee7d2136705455edd2
SHA1 11e10c7b59bb5bec242c37896c8f4373c009c552
SHA512 621ca61abdc9f5e5bb8efe80081b2f4c8a6febbeec96406d1e1d14d71ef0824de149bf7599800f61e5ecf4d20722b2a85bd67a2c725bff76f45d2e9495919bca
SSDEEP 24576:nLFZeV9rUW3uRIgRNMK88q9s14+6fsqetItnwn56fTaINc9q:LFgVIRIgRNMR8qq1bSsqEw/eEB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d

File Explorer

18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d

.exe 1.5MB

18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d

IMPHASH 73f69d2f0d153d2098bcc0bcd3f11f4a
SHA256 18b2e6f43a155bb750d5ce35e089dd63fcf9d83c61c95fe23e5624fb42d4eb5d
MD5 0aeca481aacf87ee7d2136705455edd2
SHA1 11e10c7b59bb5bec242c37896c8f4373c009c552
SHA512 621ca61abdc9f5e5bb8efe80081b2f4c8a6febbeec96406d1e1d14d71ef0824de149bf7599800f61e5ecf4d20722b2a85bd67a2c725bff76f45d2e9495919bca
SSDEEP 24576:nLFZeV9rUW3uRIgRNMK88q9s14+6fsqetItnwn56fTaINc9q:LFgVIRIgRNMR8qq1bSsqEw/eEB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

620841

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\tms\work\SeAppService\src\bin\Release\SeAppService.pdb

kernel32

MulDiv GetCommandLineW CreateDirectoryW MoveFileW FindClose FindFirstFileW FindNextFileW OpenProcess LockResource WriteFile FreeResource GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetCurrentProcessId InitializeCriticalSection DeviceIoControl CreateProcessW GetModuleHandleA FindResourceExW WritePrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStructW GetExitCodeProcess WaitForSingleObject MoveFileExW GetVersionExW VirtualQuery SetUnhandledExceptionFilter ReadFile LocalFree CreateThread TerminateThread SuspendThread SetEvent CreateEventW SetFilePointer ExitProcess Sleep DuplicateHandle GetSystemTimeAsFileTime GetSystemInfo ResetEvent SetEndOfFile SetFileTime SystemTimeToFileTime TlsAlloc TlsSetValue TlsFree lstrcmpA lstrcmpiA AssignProcessToJobObject IsBadReadPtr GetPrivateProfileStringW GetTickCount VirtualFree VirtualAlloc DeleteFileW CopyFileW GetTempPathW GetSystemDirectoryW WideCharToMultiByte CreateFileW LoadLibraryW GetFileSize MultiByteToWideChar FindResourceW LoadLibraryExW CreateMutexW lstrcmpiW CloseHandle SizeofResource LoadResource SetErrorMode TerminateProcess SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA WriteConsoleW GetTimeZoneInformation SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetModuleFileNameA GetConsoleMode GetConsoleCP RtlUnwind OpenThread HeapWalk HeapUnlock HeapLock GetFileSizeEx CreateFileA LocalFileTimeToFileTime GetStartupInfoW UnhandledExceptionFilter WaitForSingleObjectEx GetLocalTime DosDateTimeToFileTime GetFileType GetACP GetCurrentProcess FreeLibrary InterlockedDecrement InterlockedIncrement GetModuleHandleW GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection SetLastError GetLastError GetCurrentThreadId RaiseException GetProcessHeap GetModuleHandleExA GetStdHandle ResumeThread InterlockedExchangeAdd InterlockedCompareExchange GetFileAttributesW GetCurrentDirectoryW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleExW TlsGetValue SwitchToThread PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort InterlockedExchange SetFilePointerEx FlushFileBuffers IsProcessorFeaturePresent QueryPerformanceFrequency QueryPerformanceCounter OutputDebugStringA ReleaseMutex HeapSize HeapFree FlushInstructionCache InterlockedPushEntrySList HeapReAlloc HeapAlloc HeapDestroy GetProcAddress DecodePointer VirtualProtect LoadLibraryExA IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList

user32

PostMessageW DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW IsWindow SetWindowPos GetKeyState SetForegroundWindow GetDC SendMessageW GetWindowRect GetWindowLongW SetWindowLongW GetDesktopWindow FindWindowW FindWindowExW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx LoadCursorW MonitorFromWindow GetMonitorInfoW ReleaseDC DestroyWindow InvalidateRect IsIconic PeekMessageW DispatchMessageW TranslateMessage GetMessageW GetShellWindow PostThreadMessageW WindowFromPoint GetParent MapWindowPoints MoveWindow ReplyMessage IntersectRect ClientToScreen ShowWindow EnumDisplayMonitors EnumDisplayDevicesW GetWindowThreadProcessId PtInRect AllowSetForegroundWindow KillTimer SetTimer IsWindowVisible PostQuitMessage SendMessageTimeoutW GetMessagePos MonitorFromPoint GetCursorPos GetSystemMetrics OffsetRect FillRect MessageBoxW WaitMessage CallMsgFilterW GetQueueStatus MsgWaitForMultipleObjectsEx wvsprintfW SetCursor UnionRect SetFocus GetActiveWindow GetFocus SetCapture ReleaseCapture GetUpdateRect ScreenToClient IsRectEmpty GetWindow RegisterClassW EnableWindow SetPropW GetPropW IsZoomed SetWindowRgn CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos GetSysColor CharPrevW DrawTextW SetRect SetWindowTextW GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo GetClientRect EndPaint BeginPaint UpdateLayeredWindow CharNextW

gdi32

TextOutW MoveToEx ExtTextOutW GdiFlush CreatePenIndirect SetTextColor GetDIBits BitBlt SetBrushOrgEx GetObjectW CreateDIBSection GdiAlphaBlend SetStretchBltMode StretchBlt SelectObject GetStockObject DeleteObject DeleteDC CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap CreateFontIndirectW CreatePen Rectangle RestoreDC SaveDC GetTextMetricsW SetWindowOrgEx CreateRoundRectRgn GetObjectA CombineRgn CreateDCW SetBkMode CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo RoundRect SelectClipRgn ExtSelectClipRgn SetBkColor CreatePatternBrush

shell32

SHAppBarMessage ShellExecuteW SHGetSpecialFolderPathW SHGetFolderPathW SHChangeNotify ord680 CommandLineToArgvW

shlwapi

SHGetValueA PathFileExistsW PathFindFileNameW SHGetValueW PathAppendW SHSetValueW StrDupW SHStrDupW PathRemoveFileSpecW PathCombineW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ws2_32

bind closesocket send recv listen inet_addr htons socket accept WSAStartup

netapi32

Netbios

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

imm32

ImmReleaseContext ImmSetCompositionFontW ImmSetCompositionWindow ImmGetContext

generic

count=26, id=241, version=40116,

count=186, id=243, version=40116,

count=34, id=242, version=40116,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=26, id=259, version=26706,

count=35, id=260, version=26706,

count=78, id=261, version=26706,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=624, id=1, productName=Unmarked objects,

count=10, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=178, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=256, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,