42ef9f739531f8bfeb18962921396292488c15c45a86b898a8c090d7a1e2cab5

Sharing

Copy URL Twitter E-mail

General

Target
42ef9f739531f8bfeb18962921396292488c15c45a86b898a8c090d7a1e2cab5
Size 4.8MB
Sample240526-vd64msdc3y
SHA256 42ef9f739531f8bfeb18962921396292488c15c45a86b898a8c090d7a1e2cab5
MD5 a83ce55de43bb3e7c15aaf7d53b1befa
SHA1 6daf0f4ff9da79bb9615b7d9fed05160416ee0c3
SHA512 29251dddd12d6f83ed3a34f40d78592aa205e4b56dac9298f7775b9443b2b62c5af5c77fa36f9ddb1e2561414187cff4acbbf3aff91c511ff92031328edafacc
SSDEEP 98304:seLpmrmc2lAu28lkcf5YjovKqGYiOE8oLj5YINfSyo8aXl:TcmZl85gyjovK65E8ob5Sx8aXl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42ef9f739531f8bfeb18962921396292488c15c45a86b898a8c090d7a1e2cab5

File Explorer

42ef9f739531f8bfeb18962921396292488c15c45a86b898a8c090d7a1e2cab5

.exe 4.8MB

42ef9f739531f8bfeb18962921396292488c15c45a86b898a8c090d7a1e2cab5

IMPHASH c8f585918987a310f6428f02fe881c59
SHA256 42ef9f739531f8bfeb18962921396292488c15c45a86b898a8c090d7a1e2cab5
MD5 a83ce55de43bb3e7c15aaf7d53b1befa
SHA1 6daf0f4ff9da79bb9615b7d9fed05160416ee0c3
SHA512 29251dddd12d6f83ed3a34f40d78592aa205e4b56dac9298f7775b9443b2b62c5af5c77fa36f9ddb1e2561414187cff4acbbf3aff91c511ff92031328edafacc
SSDEEP 98304:seLpmrmc2lAu28lkcf5YjovKqGYiOE8oLj5YINfSyo8aXl:TcmZl85gyjovK65E8ob5Sx8aXl
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

182709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\gamemaster\installanduninstall\Inst\Install_Exe.pdb

kernel32

SizeofResource ReadFile FindClose CloseHandle MulDiv GetSystemTime CreatePipe PeekNamedPipe lstrcmpW lstrcmpiW lstrcpynW lstrlenA lstrlenW CreateMutexW LoadLibraryW LoadLibraryExW GetModuleFileNameW GetModuleHandleW CreateProcessW GetStartupInfoW FindResourceW FindResourceExW GetSystemDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetVersionExW MultiByteToWideChar WideCharToMultiByte LocalFree GetCommandLineW GetWindowsDirectoryW WritePrivateProfileStringW IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetFileSize WriteFile FlushFileBuffers CreateFileW DeviceIoControl lstrcmpA lstrcmpiA CreateFileA RtlUnwind TlsAlloc TlsGetValue TlsSetValue LeaveCriticalSection CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetACP Sleep GetFileType LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WaitForSingleObjectEx SetStdHandle GetConsoleCP GetConsoleMode SetFilePointerEx ReadConsoleW WriteConsoleW InterlockedCompareExchange GetPrivateProfileStringW LocalAlloc GetSystemInfo ResetEvent CreateDirectoryW GetTempFileNameW FormatMessageW GlobalAddAtomW TerminateThread CopyFileW ReleaseMutex GetExitCodeProcess GetFileAttributesExW CreateFileMappingW UnmapViewOfFile MapViewOfFile SetFilePointer WaitForMultipleObjects GetExitCodeThread MoveFileW GetLocalTime GetFileSizeEx GlobalFree MoveFileExW GetFileAttributesW SetFileAttributesW GetTickCount GetFullPathNameW RemoveDirectoryW GetDiskFreeSpaceExW GetTempPathW GetDriveTypeW GetLogicalDriveStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalFindAtomW GlobalDeleteAtom OpenProcess GetLongPathNameW CreateEventW SetEvent LoadResource GetStringTypeW EnterCriticalSection InitializeCriticalSection SetErrorMode SetLastError GetCurrentThreadId GetCurrentProcess GlobalMemoryStatusEx GlobalUnlock GlobalLock GlobalAlloc GetProcAddress FreeLibrary LockResource InterlockedDecrement InterlockedIncrement FreeResource GetSystemWindowsDirectoryW SetEndOfFile SetFileTime WaitForSingleObject GetFileInformationByHandle GetModuleHandleA InterlockedExchange DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError DecodePointer RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy TlsFree

user32

MonitorFromWindow LoadImageW PtInRect GetCursorPos MonitorFromPoint DialogBoxParamW CopyRect EndDialog LoadCursorW TrackPopupMenu AppendMenuW DestroyMenu GetSystemMetrics KillTimer SetTimer IsIconic UnregisterClassW ShowWindowAsync CharUpperW SetWindowLongW GetDesktopWindow GetParent FindWindowW GetClassNameW CreatePopupMenu GetWindow MessageBoxW UnhookWinEvent SetWinEventHook SystemParametersInfoW SetCursor OffsetRect SetWindowRgn UpdateLayeredWindow SetRect GetMonitorInfoW UpdateWindow PostQuitMessage IsRectEmpty WaitForInputIdle SendMessageTimeoutW GetWindowThreadProcessId FindWindowExW PostThreadMessageW wsprintfW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageW GetWindowLongW FillRect GetSysColor MapWindowPoints ScreenToClient ClientToScreen GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharNextW GetDlgItem BringWindowToTop IsWindowVisible SetWindowPos MoveWindow ShowWindow DestroyWindow IsChild IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW PostMessageW

shlwapi

PathFindExtensionW StrToInt64ExW wvnsprintfW PathIsDirectoryW wnsprintfW SHStrDupW PathAppendW PathStripToRootW PathFindFileNameW PathIsPrefixW StrToIntW StrCmpIW StrStrIA StrTrimA StrCmpNIW PathFileExistsW PathCombineW PathRemoveFileSpecW SHDeleteValueW SHGetValueA SHGetValueW SHSetValueW StrStrIW wnsprintfA SHDeleteKeyW PathRelativePathToW PathIsRelativeW StrCmpW SHSetValueA

comctl32

_TrackMouseEvent InitCommonControlsEx

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipDrawImageRectRectI GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipCreateBitmapFromStream GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateBitmapFromStreamICM GdipSetTextRenderingHint GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateSolidFill GdipDeleteBrush GdipDrawImagePointRectI GdipCreateFontFamilyFromName GdipDrawImageRectRect GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromFile

gdi32

CreateRectRgn EnumFontFamiliesW CreateFontW ExtTextOutW CombineRgn SetTextColor SetBkMode SetBkColor GetCurrentObject CreateFontIndirectW BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteObject GetDeviceCaps GetStockObject SelectObject GetObjectW RestoreDC SaveDC DeleteDC SetViewportOrgEx

advapi32

GetUserNameW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegDeleteKeyW GetTokenInformation GetTrusteeNameW BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW GetExplicitEntriesFromAclW SetEntriesInAclW LookupAccountNameW LookupAccountSidW DeleteAce EqualSid LookupPrivilegeValueW RegEnumKeyExW RegDeleteValueW OpenProcessToken AdjustTokenPrivileges

shell32

SHLoadInProc ShellExecuteExW ord75 SHFileOperationW ShellExecuteW ord165 SHChangeNotify CommandLineToArgvW Shell_NotifyIconW SHGetPathFromIDListW SHBrowseForFolderW SHCreateDirectoryExW SHGetSpecialFolderPathW ord680

ole32

CoCreateGuid CoInitialize CoUninitialize CoGetClassObject CoSetProxyBlanket CreateStreamOnHGlobal OleLockRunning OleUninitialize OleInitialize PropVariantClear CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CLSIDFromString CoCreateInstance OleRun

oleaut32

SysStringByteLen SysAllocStringByteLen OleCreateFontIndirect LoadRegTypeLi LoadTypeLi VarUI4FromStr VariantClear VariantInit SysStringLen SysFreeString SysAllocStringLen SysAllocString

urlmon

URLDownloadToCacheFileW

psapi

GetModuleFileNameExW EnumProcesses

winhttp

WinHttpOpenRequest WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpSetCredentials WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders

iphlpapi

GetAdaptersInfo

setupapi

SetupIterateCabinetW

generic

count=17, id=241, version=40116,

count=161, id=243, version=40116,

count=30, id=242, version=40116,

count=2, id=264, version=27030,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=5, id=261, version=27032,

count=3, id=199, version=41118,

count=23, id=259, version=26706,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=77, id=261, version=26706,

count=35, id=260, version=26706,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=487, id=1, productName=Unmarked objects,

count=79, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,