the-classic-event-helper[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

the-classic-event-helper.exe
Size

15.9MB
MD5

3304c0929cd23e5f15a070f7b9598a45
SHA1

3baa1637195aa49fddebea3b98e4ca5d49797c50
SHA256

d609b76349692fc05ae5cda118ee7eaee70d67fc56ce4c29d187a494de38c903
SHA512

7cbf5192e37b9c9967ed51b440420d1c5a8d362e3a925f1b92f2e9f2bdbf29858334229b4855ed029ef31289d96bc7b697cf68456a927e51c44147c0d4e5314d
SSDEEP

98304:H9Slk2FZ08Hai71szNulBLWvIFEc2GGLuAnZ1l+sS4JrE0e0Fluqw9so:HQlFZV71szmOc2GGaAJndsqw2o

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
the-classic-event-helper.exe

Files

the-classic-event-helper.exe
.exe windows:6 windows x64 arch:x64

814880f2bf66f52209d5498c7d0833ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WakeByAddressSingle
WaitOnAddress

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey
CredReadW
RegQueryValueExW
RegOpenKeyExW
SystemFunction036
ImpersonateAnonymousToken
RevertToSelf

kernel32

ReleaseSRWLockExclusive
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateThread
LoadLibraryExW
SwitchToThread
CloseHandle
HeapFree
HeapReAlloc
GetConsoleMode
SetConsoleMode
GetLastError
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetTimeZoneInformationForYear
GetCurrentThread
GlobalUnlock
GetStdHandle
GetFileInformationByHandleEx
SetConsoleCursorPosition
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
SetConsoleCursorInfo
GetConsoleCursorInfo
ReadConsoleInputW
GetNumberOfConsoleInputEvents
lstrlenW
FormatMessageW
WideCharToMultiByte
WaitForMultipleObjects
ResetEvent
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetSystemInfo
MoveFileExW
DeleteFileW
CopyFileExW
FindFirstFileW
FindClose
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
CompareStringOrdinal
RegisterWaitForSingleObject
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetQueuedCompletionStatusEx
Sleep
GetModuleHandleA
GetProcAddress
GlobalLock
GlobalSize
WriteConsoleW
LockFileEx
SetFileInformationByHandle
UnlockFile
WaitForSingleObject
MultiByteToWideChar
SetLastError
QueryPerformanceFrequency
GetModuleHandleW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
GetCurrentProcessId
CreateMutexA
ReleaseMutex
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
GetEnvironmentVariableW
GetModuleFileNameW
GetCommandLineW
CreateFileW
GetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
SetFilePointerEx
CreateDirectoryW
ReadConsoleW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateNamedPipeW
AcquireSRWLockExclusive
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
GetExitCodeProcess
QueryPerformanceCounter
GetSystemTimePreciseAsFileTime
HeapAlloc
GetProcessHeap
GetFileType
SetHandleInformation
PostQueuedCompletionStatus
UnregisterWaitEx
TerminateProcess
FindNextFileW
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
RtlAddFunctionTable
RtlDeleteFunctionTable
WakeAllConditionVariable
FreeLibrary
TlsFree
SleepConditionVariableSRW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

user32

OpenClipboard
CloseClipboard
GetClipboardData

bcrypt

BCryptGenRandom

ws2_32

freeaddrinfo
WSAStartup
accept
connect
listen
bind
getaddrinfo
WSAGetLastError
socket
closesocket
WSAIoctl
ioctlsocket
WSASocketW
WSACleanup
getsockname
setsockopt
recv
send
WSASend
shutdown
getpeername
getsockopt

ntdll

NtDeviceIoControlFile
NtReadFile
NtWriteFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile

api-ms-win-crt-math-l1-1-0

asinf
pow
fmod
fmodf
cosf
sinf
round
ceilf
floorf
roundf
fmaxf
trunc
fminf
__setusermatherr
truncf
_dsign
ceil
log2f
atan2f
tanh
tan
sqrt
sinh
sin
log2
log10
log
floor
exp
cosh
cos
atan2
atan
asin
acos
modf
frexp
ldexp

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_register_onexit_function
_initialize_onexit_table
_wassert
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_exit
exit
abort
strerror
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_errno

api-ms-win-crt-string-l1-1-0

strcmp
strcpy_s
strncat
strlen
isalpha
isupper
islower
isdigit
isxdigit
isspace
ispunct
strspn
strcspn
isalnum
isgraph
iscntrl
toupper
strpbrk
tolower
strncpy
strnlen
wcsncmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_aligned_malloc
_aligned_free
_callnewh
realloc
calloc
malloc
free

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-stdio-l1-1-0

__p__commode
__acrt_iob_func
__stdio_common_vsprintf
fwrite
_set_fmode

api-ms-win-crt-convert-l1-1-0

strtoul
strtoull
atoi
strtod

api-ms-win-crt-time-l1-1-0

strftime
_localtime64_s
clock
_gmtime64_s
_difftime64
_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

Sections

.text
Size: 10.6MB - Virtual size: 10.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 498KB - Virtual size: 498KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

814880f2bf66f52209d5498c7d0833ba

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

kernel32

ole32

shell32

user32

bcrypt

ws2_32

ntdll

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

msvcp140

Sections

.text Size: 10.6MB - Virtual size: 10.6MB

.rdata Size: 4.7MB - Virtual size: 4.7MB

.data Size: 26KB - Virtual size: 29KB

.pdata Size: 498KB - Virtual size: 498KB

_RDATA Size: 512B - Virtual size: 500B

.reloc Size: 74KB - Virtual size: 73KB

.text
Size: 10.6MB - Virtual size: 10.6MB

.rdata
Size: 4.7MB - Virtual size: 4.7MB

.data
Size: 26KB - Virtual size: 29KB

.pdata
Size: 498KB - Virtual size: 498KB

_RDATA
Size: 512B - Virtual size: 500B

.reloc
Size: 74KB - Virtual size: 73KB