Контекстное меню[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Контекстное меню.zip
Size 1.1MB
Sample240529-t2nfrscc77
SHA256 fb0e1a5a8ce0287140caa53c632cde2d111014e14b7f42b8fae5b287aaa3736b
MD5 e8c6d44edd23d9b49dae89442230baf7
SHA1 0e8c69e88c1ea07d4125cbae41f7c65242508210
SHA512 694c48bd7054cd7e0270867061a5add9e29f8bac8126deabfd29c6097a7c139d5ba33ef58b6ee2551eff1a602b57fa5fec43861d31aa0257e0fbfd06089debb9
SSDEEP 24576:SXtaYy5rbOkuFG2vRNzAmFbSDm+eMGPxpzRII8Z4EyFg7Ix:XYy5rJkvRNzAmUSqU+IaMg7u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
static1/unpack001/Work/nircmd.exe	Nirsoft

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Work/cecho.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/Work/RegToScript.exe	autoit_exe

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Work/RegToScript.exe
unpack001/Work/SoundChanger.exe
unpack001/Work/TrInstaller.exe
unpack001/Work/cecho.exe
unpack002/out.upx
unpack001/Work/explorer.exe.mui
unpack001/Work/nircmd.exe

File Explorer

Контекстное меню.zip

.zip 1.1MB
MENU.bat

.bat .vbs 183KB
Work/RegToScript.exe

.exe 941KB
Work/RegToScript.ini

966B
Work/RestExplorer.exe

.exe 806KB
Work/SoundChanger.exe

.exe 226KB
Work/TrInstaller.exe

.exe 89KB
Work/cecho.exe

.exe 25KB
out.upx

.exe 53KB
Work/explorer.exe.mui

.dll 14KB
Work/nircmd.exe

.exe 116KB

Контекстное меню.zip

SHA256 fb0e1a5a8ce0287140caa53c632cde2d111014e14b7f42b8fae5b287aaa3736b
MD5 e8c6d44edd23d9b49dae89442230baf7
SHA1 0e8c69e88c1ea07d4125cbae41f7c65242508210
SHA512 694c48bd7054cd7e0270867061a5add9e29f8bac8126deabfd29c6097a7c139d5ba33ef58b6ee2551eff1a602b57fa5fec43861d31aa0257e0fbfd06089debb9
SSDEEP 24576:SXtaYy5rbOkuFG2vRNzAmFbSDm+eMGPxpzRII8Z4EyFg7Ix:XYy5rJkvRNzAmUSqU+IaMg7u
MD5 SHA1 SHA512 SSDEEP

Work/RegToScript.exe

IMPHASH 77d45b1ee20c3b020c48ab42d23ce5ef
SHA256 ff14c17e3e380f4557b413f8a77fa40c8404a40a94d4719c0b33af2f58bd0a95
MD5 86ff97b1873b136a0ca5e6409f4760bc
SHA1 72e3c177e8f6de279bbac981eb4229fced7baf2b
SHA512 736473b2953394ae9de6f031c3c08438d2dff48c83e0c1892d086151968a7ef17af1069c2e115f7cd9d6272825c1ee84bc6aaeaa469507863debabb44108e06b
SSDEEP 24576:yfTkD0E003ubc2MRgCmP/ZwIDzq+Iha5a0HhI:GG00SSgCmP/ZwYj48a0B
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

195100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wsock32

WSACleanup socket inet_ntoa setsockopt ntohs recvfrom ioctlsocket htons WSAStartup __WSAFDIsSet select accept listen bind closesocket WSAGetLastError recv sendto send inet_addr gethostbyname gethostname connect

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_ReplaceIcon ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove InitCommonControlsEx ImageList_Create

mpr

WNetUseConnectionW WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W

wininet

InternetQueryDataAvailable InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetReadFile InternetConnectW

psapi

GetProcessMemoryInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho

userenv

DestroyEnvironmentBlock UnloadUserProfile CreateEnvironmentBlock LoadUserProfileW

uxtheme

IsThemeActive

kernel32

WaitForSingleObject HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW IsWow64Process GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress SetErrorMode GetModuleFileNameW WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx SetEndOfFile ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose GetLongPathNameW GetShortPathNameW CloseHandle FindNextFileW CopyFileExW MoveFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl GetLocalTime CompareStringW CreateThread LeaveCriticalSection GetStdHandle CreatePipe TerminateThread LoadLibraryExW FindResourceExW CopyFileW VirtualFree FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW HeapReAlloc HeapSize GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW GetProcessId SetPriorityClass LoadLibraryW VirtualAlloc GetFullPathNameW SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW lstrcmpiW DecodePointer GetLastError RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection EncodePointer DuplicateHandle GetCurrentProcess EnterCriticalSection GetCurrentThread ExitProcess GetModuleHandleExW ExitThread GetSystemTimeAsFileTime ResumeThread GetCommandLineW IsProcessorFeaturePresent RtlPcToFileHeader RtlUnwindEx IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetStringTypeW SetStdHandle GetFileType GetConsoleCP GetConsoleMode ReadConsoleW GetTimeZoneInformation GetDateFormatW GetTimeFormatW LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW DeleteFileW SetEnvironmentVariableA

user32

RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed GetWindowLongW MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongPtrW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics SetWindowLongPtrW GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture UnregisterHotKey CharLowerBuffW MonitorFromRect LoadImageW CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu GetCursorInfo GetCursorPos DeleteMenu CheckMenuRadioItem GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic TranslateMessage SystemParametersInfoW keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongPtrW GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation SetWindowPos CopyImage AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate TrackPopupMenuEx DispatchMessageW OpenWindowStationW GetUserObjectSecurity MessageBoxW DefWindowProcW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon FindWindowW PeekMessageW ScreenToClient

gdi32

StrokePath DeleteObject GetTextExtentPoint32W ExtCreatePen GetDeviceCaps EndPath SetPixel CloseFigure LineTo AngleArc MoveToEx CreateCompatibleBitmap CreateCompatibleDC Ellipse PolyDraw BeginPath Rectangle SetViewportOrgEx SelectObject StretchBlt GetDIBits DeleteDC GetPixel CreateDCW GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject StrokeAndFillPath

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

GetAce RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid LogonUserW AllocateAndInitializeSid CheckTokenMembership RegCreateKeyExW FreeSid GetTokenInformation GetSecurityDescriptorDacl GetAclInformation AddAce SetSecurityDescriptorDacl GetUserNameW InitiateSystemShutdownExW

shell32

DragQueryPoint ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHGetPathFromIDListW SHBrowseForFolderW SHCreateShellItem SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFolderPathW SHFileOperationW ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

CoTaskMemAlloc CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoCreateInstance IIDFromString StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoInitialize CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket

oleaut32

UnRegisterTypeLi UnRegisterTypeLibForUser RegisterTypeLibForUser RegisterTypeLi LoadTypeLibEx VariantCopyInd SysReAllocString SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData CreateDispTypeInfo SafeArrayAllocData SafeArrayAllocDescriptorEx SafeArrayCreateVector SysAllocString VariantTimeToSystemTime VarR8FromDec SafeArrayGetVartype OleLoadPicture QueryPathOfRegTypeLi VariantCopy VariantClear CreateStdDispatch DispCallFunc VariantChangeType SysStringLen SafeArrayAccessData VariantInit

Work/RestExplorer.exe

IMPHASH 42b8d4fa3bc2c4336a20de1bdf1422d8
SHA256 ec890a669da3c53b73ca83ec0c267fa0dcf1ad428feb829a3422ebc36bc1841f
MD5 ac75bde2b70097ca86e16987bf387857
SHA1 06e72123132e1ef58f7b7ea3c8e65cb75062e6d6
SHA512 f4994e8e5a807caa254e73e9796d61bcea204f0aa80cc391bccddbf28478f738c1d4f095518196a9b152654596beb184b36507ffcf434407d78ad1c3e43b96a0
SSDEEP 12288:v69zDWz/xwNqdsbrIX3JALF1QbCagrEGgtNryyCJuDT/PNa04YQtHyw4AR6SPWc:v2DW/xbmX2YIb+Qsu3/PNLDQtHyZiP3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

PE Signature issue

Digest

dc:69:d1:c8:9c:75:55:9f:df:6f:7a:9b:14:64:0d:78:f0:c4:a1:cf

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sordum Software

Chains

Mar 28, 2023

Minor OS version

Major OS version

Entry point

119932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wsock32

__WSAFDIsSet setsockopt ntohs recvfrom sendto htons select listen WSAStartup bind closesocket connect socket send WSACleanup ioctlsocket accept WSAGetLastError inet_addr gethostbyname gethostname recv

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx ImageList_Destroy

mpr

WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W WNetUseConnectionW

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetConnectW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetQueryOptionW InternetQueryDataAvailable

psapi

EnumProcesses GetModuleBaseNameW GetProcessMemoryInfo EnumProcessModules

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile LoadUserProfileW

kernel32

HeapAlloc Sleep GetCurrentThreadId RaiseException MulDiv GetVersionExW GetSystemInfo MultiByteToWideChar WideCharToMultiByte GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose DeleteFileW FindNextFileW lstrcmpiW MoveFileW CopyFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetProcessHeap CompareStringW CompareStringA DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetStdHandle CreatePipe TerminateThread GetTempPathW GetTempFileNameW VirtualFree FormatMessageW GetExitCodeProcess SetErrorMode GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW DeviceIoControl SetFileAttributesW GetShortPathNameW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetComputerNameW GetWindowsDirectoryW GetSystemDirectoryW GetCurrentProcessId GetCurrentThread GetProcessIoCounters CreateProcessW SetPriorityClass LoadLibraryW VirtualAlloc LoadLibraryExW HeapFree WaitForSingleObject CreateThread DuplicateHandle GetLastError CloseHandle GetCurrentProcess GetProcAddress LoadLibraryA FreeLibrary GetModuleFileNameW GetFullPathNameW ExitProcess ExitThread GetSystemTimeAsFileTime ResumeThread GetStartupInfoW EncodePointer DecodePointer FlsGetValue FlsSetValue SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW FlsFree SetLastError FlsAlloc HeapSize RtlUnwindEx GetCPInfo GetACP GetOEMCP IsValidCodePage UnhandledExceptionFilter SetUnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlPcToFileHeader GetModuleFileNameA HeapSetInformation HeapCreate SetHandleCount GetFileType GetStartupInfoA SetStdHandle GetConsoleCP GetConsoleMode LCMapStringW LCMapStringA SetFilePointer GetTimeZoneInformation GetDateFormatA GetTimeFormatA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetTickCount HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEndOfFile GetLocalTime SetEnvironmentVariableA

user32

IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed GetWindowLongW MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongPtrW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics SetWindowLongPtrW GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW ReleaseCapture SetCapture WindowFromPoint DispatchMessageW TranslateMessage PeekMessageW UnregisterHotKey CharLowerBuffW MonitorFromRect LoadImageW CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu IsCharAlphaNumericW GetCursorPos DeleteMenu CheckMenuRadioItem GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW IsClipboardFormatAvailable keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongPtrW GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity GetUserObjectSecurity CloseDesktop CloseWindowStation IsCharAlphaW GetKeyboardLayoutNameW ClientToScreen RegisterHotKey GetCursorInfo SetWindowPos CopyImage AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard TrackPopupMenuEx GetClipboardData OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW MessageBoxW DefWindowProcW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon OpenClipboard BlockInput GetMessageW SystemParametersInfoW LockWindowUpdate GetDesktopWindow

gdi32

DeleteObject GetObjectW GetTextExtentPoint32W ExtCreatePen StrokeAndFillPath StrokePath EndPath SetPixel CloseFigure CreateCompatibleBitmap CreateCompatibleDC SelectObject StretchBlt GetDIBits LineTo AngleArc MoveToEx Ellipse PolyDraw BeginPath Rectangle GetDeviceCaps SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject CreateDCW GetPixel DeleteDC SetViewportOrgEx

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegEnumValueW RegDeleteValueW RegDeleteKeyW RegSetValueExW RegCreateKeyExW GetUserNameW RegConnectRegistryW RegEnumKeyExW CloseServiceHandle UnlockServiceDatabase LockServiceDatabase OpenSCManagerW InitiateSystemShutdownExW AdjustTokenPrivileges RegCloseKey RegQueryValueExW RegOpenKeyExW OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW InitializeSecurityDescriptor InitializeAcl GetLengthSid CopySid SetSecurityDescriptorDacl LogonUserW GetTokenInformation GetAclInformation GetAce AddAce GetSecurityDescriptorDacl

shell32

DragQueryPoint ShellExecuteExW SHGetFolderPathW DragQueryFileW SHEmptyRecycleBinW SHBrowseForFolderW SHFileOperationW SHGetPathFromIDListW SHGetDesktopFolder SHGetMalloc ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoInitialize CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemFree CLSIDFromString StringFromCLSID IIDFromString StringFromIID OleInitialize CreateBindCtx CLSIDFromProgID CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket OleUninitialize

oleaut32

SafeArrayAllocData SafeArrayAllocDescriptorEx SysAllocString OleLoadPicture SafeArrayGetVartype SafeArrayDestroyData SafeArrayAccessData VariantInit VariantCopy VariantClear VariantTimeToSystemTime SafeArrayDestroyDescriptor LoadRegTypeLi GetActiveObject SafeArrayUnaccessData VarR8FromDec

Work/SoundChanger.exe

IMPHASH 7182b1ea6f92adbf459a2c65d8d4dd9e
SHA256 7987fd74868b355632df577b9d18d449f696b2a96ea7633cae35cd07c600a588
MD5 85c6cb4b878b49c4f73abd6316b58230
SHA1 2a3e616b036819035bbfe4e0a2dc49c82449a314
SHA512 fc269c2f16b0adcdbcf5d5b2ac55ba079d46b6801508d5db82a7adf5085b9e11024dfe745d416c7fc5e09b05d057cdae8589891965b6534bcd07f8ecc8dfc606
SSDEEP 6144:nt5hBPi0BW69hd1MMdxPe9N9uA069TBnFuCndEJA:ntzww69T9FTWq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msvcrt

memset wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsdup free _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc

kernel32

GetModuleHandleW HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile GetTempFileNameW LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetShortPathNameW GetSystemDirectoryW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetProcAddress GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess RtlLookupFunctionEntry RtlVirtualUnwind RemoveVectoredExceptionHandler AddVectoredExceptionHandler HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW GetTempPathW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject

shell32

ShellExecuteExW SHGetFolderLocation SHGetPathFromIDListW

winmm

timeBeginPeriod

ole32

CoInitialize CoTaskMemFree

shlwapi

PathAddBackslashW PathRenameExtensionW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW

user32

CharUpperW CharLowerW MessageBoxW DefWindowProcW GetWindowLongPtrW GetWindowTextLengthW GetWindowTextW EnableWindow DestroyWindow UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled GetSystemMetrics CreateWindowExW SetWindowLongPtrW SendMessageW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos

gdi32

GetStockObject

comctl32

InitCommonControlsEx

Work/TrInstaller.exe

IMPHASH 011c2f426028ccdbff462868360716a6
SHA256 f7331de17aac3cfcb855d72571368c3d563556f68f9e138956fc8179ce3bc19b
MD5 28060f18f05f730ded91d9bde00ae438
SHA1 d334a9f148b332df47e467f8a09e3ad97c3eb616
SHA512 c7e3d5620681b4f13e99205f3c2243cf3db7f133fa2b638e2002b090cf2abd024a0a742d4f3f5489026c98cd27261cdeb255fdcd62662c4a8aa48db81c506e31
SSDEEP 1536:GqqBNbySepJy3PNRi7iYgnD3OtQDUNUd/+9d:VzvA3P3i7Pw+ts98d
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5004

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Work/cecho.exe

SHA256 5c1211559dda10592cfedd57681f18f4a702410816d36eda95aee6c74e3c6a47
MD5 e783bc59d0ed6cfbd8891f94ae23d1b3
SHA1 47fe9045da4b1be2a52d80c0b3cf790e04d29108
SHA512 d09fc6574359a5df8885b035a8d05c4743d58f56fee3ffc2cc4fd7c3beec93c8994cd1f296b99a2f0f17b13ec7b03415912f49e13f5d1541839878f6bc498020
SSDEEP 384:KwoPn3OgrkyDyjNKA7DY+kRKzRq92/A2Yo8SKwRS0JSqRdmMOOI1Kz+ge+u0GgfT:tofFhw9NkRKFqIA4Q0ndmMI15glZBf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 90af84ad43d0194690591a62f419609be871621e4a939cf5f201128c46a70d06
MD5 ae6218f3b9075e0988eea46a12517d7e
SHA1 1d3456f92caf732d1958f798765002d8a5d193c6
SHA512 8fe40b39875ae8d1793210c1314e50621134cd3d81e9207c53590083969c7341e7428aff4565e5bdfbbff46ce04ffcdada6f504e44ebd3079e3a824ce261295b
SSDEEP 1536:Gowokc6Tqpif41trHUHVoQforZzd63RSG:TsuiQ1lUXOg3RP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7375

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Work/explorer.exe.mui

SHA256 f6913d22dbb63439374a3bc7938f3b0349da2056b81f82f6f058aae515537c86
MD5 3938fd28a440a591963d139b29ac4a64
SHA1 cfbbae54795d6899a71d99c8c468fbc01bd2956b
SHA512 8a4dadbcefd3b6d6ada18e150eb6204ae72ab1955f7478cd06341dd7b231b791fee9b9fd2cc4db3d055577ad1b58eee4481c28479103900ad22e3fe1b595774d
SSDEEP 96:i8RL6t6v0BP5c45wCwCNZH6FTHk+vxji0nFGCSoltGpisiDp/VApzvmfe8zlfORG:AtZJN2FTHJ34KO2fWB4N
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Work/nircmd.exe

IMPHASH 52b115a47ffae378901264c3506742b0
SHA256 7160db2b7a6680480e64f0845512d203a575f807831faf9a652aaef0988f876c
MD5 5ed4728caa339c2a7479102f0c04c087
SHA1 20cd453fcac9d9960b0076715d985a55784a6b53
SHA512 a521eac0d54fbfb9726fad3fafcd7779d455ca46e065a3eafc1a7883961b061550bab8e93ce576904b6c6b2d25cf129ff3d2437ed26a6033ac7c0b4c628dc865
SSDEEP 3072:WG0YiclG1aM2F3W07EBxp+wrppp8pKZOijA81fBRHwHlAqzPWKwv:hiclGwI07580l5WJv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Nirsoft
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

89136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Projects\VS2005\NirCmd\x64\release\NirCmd.pdb

winmm

mixerClose mixerOpen mciSendStringA mixerGetLineInfoA mixerGetControlDetailsA mixerGetLineControlsA mixerSetControlDetails waveOutGetVolume waveOutGetNumDevs waveOutGetDevCapsA waveOutSetVolume

msvcrt

_initterm __getmainargs _acmdln exit _cexit _exit _c_exit _XcptFilter __C_specific_handler _onexit __dllonexit __setusermatherr _strlwr atof puts _mbsicmp _snprintf _strnicmp strtol atoi _stricmp strcmp _commode _fmode __set_app_type _itoa strtoul strchr strcpy _memicmp memcmp strrchr wcslen malloc wcscpy free wcscmp wcsrchr _wcsicmp memcpy strlen ??3@YAXPEAX@Z ??2@YAPEAX_K@Z memset _strcmpi sprintf strcat

kernel32

DeleteFileA WinExec LocalFileTimeToFileTime GetStdHandle CreateProcessA SetComputerNameA GetEnvironmentVariableA DeviceIoControl WritePrivateProfileStringA GetCurrentProcess TerminateProcess CreateToolhelp32Snapshot Process32First Process32Next GetCurrentThreadId GetStartupInfoA Beep GetSystemTime SetProcessAffinityMask ReadProcessMemory SetConsoleTextAttribute GetSystemDirectoryA OutputDebugStringA WaitForSingleObject SetPriorityClass Sleep OpenProcess LocalFree GetWindowsDirectoryA CopyFileA GetModuleHandleA FreeLibrary GetProcAddress LoadLibraryA GlobalAlloc CloseHandle GlobalSize GlobalLock GlobalUnlock SystemTimeToFileTime MultiByteToWideChar GetFileAttributesA ReadFile GetModuleFileNameA GetTimeFormatA FindNextFileA LoadLibraryExA FormatMessageA SetFileTime GetDateFormatA CreateDirectoryA GetFileTime WriteFile FindFirstFileA GetLastError GetVersionExA CreateFileA GetFileSize SetFileAttributesA WideCharToMultiByte FindClose SetFilePointer

user32

GetMessageA TranslateMessage TrackPopupMenu DispatchMessageA GetWindowTextA KillTimer GetParent FindWindowA SendInput ShowWindow PostQuitMessage AttachThreadInput DefWindowProcA SendMessageTimeoutA SystemParametersInfoA GetActiveWindow GetSystemMetrics IsWindowVisible SetTimer SetWindowPos DestroyIcon PostMessageA ExitWindowsEx InvalidateRect SetCursorPos MessageBeep GetWindowThreadProcessId ChangeDisplaySettingsA SetDlgItemTextA GetSysColorBrush ChildWindowFromPoint DialogBoxParamA LoadCursorA SetCursor EndDialog SendMessageA GetDlgItem SetWindowTextA MessageBoxA GetDlgItemTextA CreateWindowExA GetWindowTextLengthA GetClipboardFormatNameA EmptyClipboard RegisterClipboardFormatA SetClipboardData CloseClipboard OpenClipboard GetWindowLongA SetWindowLongA ReleaseDC GetDC GetClipboardData SetForegroundWindow EnableWindow MapWindowPoints GetWindowPlacement GetCursorPos GetWindowRect MoveWindow SetFocus GetClassNameA SetWindowPlacement GetMonitorInfoA EnumWindows EnumDisplaySettingsA GetDesktopWindow EnumDisplayMonitors EnumDisplayDevicesA IsWindowEnabled EnumChildWindows RegisterClassA GetForegroundWindow

gdi32

CreateCompatibleBitmap DeleteDC BitBlt CreateCompatibleDC GetDeviceCaps SelectObject CreateDIBitmap GetObjectA SetTextColor CreateFontIndirectA SetBkMode DeleteObject

advapi32

RegQueryInfoKeyA RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteKeyA RegDeleteValueA

shell32

ExtractIconExA SHFileOperationA ShellExecuteExA SHChangeNotify ShellExecuteA Shell_NotifyIconA

ole32

OleGetClipboard ReleaseStgMedium CoCreateInstance CoUninitialize CoInitialize CoTaskMemAlloc CoTaskMemFree PropVariantClear

Sharing

General

Malware Config

Signatures

File Explorer

Контекстное меню.zip

MENU.bat

Work/RegToScript.exe

wsock32

version

winmm

comctl32

mpr

wininet

psapi

iphlpapi

userenv

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic

Work/RegToScript.ini

Work/RestExplorer.exe

PE Signature issue

wsock32

version

winmm

comctl32

mpr

wininet

psapi

userenv

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic

Work/SoundChanger.exe

msvcrt

kernel32

shell32

winmm

ole32

shlwapi

user32

gdi32

comctl32

generic

Work/TrInstaller.exe

msvcrt

advapi32

kernel32

generic

Work/cecho.exe

generic

out.upx

generic

Work/explorer.exe.mui

generic

Work/nircmd.exe

winmm

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

generic