ae29508763135d498e6b4fce7b74f1de89958711ac9c79b6e8bd557166f1fe86

Sharing

Copy URL Twitter E-mail

General

Target

ae29508763135d498e6b4fce7b74f1de89958711ac9c79b6e8bd557166f1fe86
Size

211KB
MD5

ea14be5cb716964f68eb846bc179d4d0
SHA1

fdba30c7a3d73c4268d3599ee1d8670c651a455d
SHA256

ae29508763135d498e6b4fce7b74f1de89958711ac9c79b6e8bd557166f1fe86
SHA512

4af7b227351961657b757395246f634bfa66b119bab2a54563baa1cef19219547fb2abbd5f47a90742070925ccd74d7024bf433822d1cd6347b33d1817b55f2e
SSDEEP

3072:HliU7zPz2GnvcYMMPmuipHYhxZKKR4CIZOIZKLUCFiom:HlXPz2Gd7P2itK+Hiom

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae29508763135d498e6b4fce7b74f1de89958711ac9c79b6e8bd557166f1fe86

Files

ae29508763135d498e6b4fce7b74f1de89958711ac9c79b6e8bd557166f1fe86
.exe windows:5 windows x86 arch:x86

690b9eede0620c9f716451d8e6a6ce1f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Tools\jenkins_home\workspace\PCTouch_Production\pospal-pos-pctouch\PospalBasePlatform\Release\InstallPackageGuard.pdb

Imports

kernel32

GetLastError
CreateMutexW
OpenProcess
WaitForSingleObject
GetExitCodeProcess
MoveFileW
CloseHandle
LocalFree
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetFileAttributesW
DeleteFileW
GetProcAddress
GetModuleHandleW
GetCurrentProcess
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
EnterCriticalSection
WriteFile
GetPrivateProfileIntW
InterlockedDecrement
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
CreateFileW
GetCurrentThreadId
RaiseException
GetLocalTime
DecodePointer
DeleteCriticalSection
GetCurrentProcessId
WideCharToMultiByte
InterlockedIncrement
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetStringTypeW
SetStdHandle
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
SetLastError
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
GetACP
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW

shell32

CommandLineToArgvW
SHFileOperationW

Exports

Exports

Initialize
_Initialize@0

Sections

.text
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

690b9eede0620c9f716451d8e6a6ce1f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

Exports

Exports

Sections

.text Size: 79KB - Virtual size: 79KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 2KB - Virtual size: 5KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 512B - Virtual size: 248B

.rsrc Size: 92KB - Virtual size: 91KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 79KB - Virtual size: 79KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 2KB - Virtual size: 5KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 248B

.rsrc
Size: 92KB - Virtual size: 91KB

.reloc
Size: 5KB - Virtual size: 4KB