7e5708e0c9d102f0fcd551ed25bf1813c3b3a4aea321d48d224f7bd0401e413e

Sharing

Copy URL Twitter E-mail

General

Target
7e5708e0c9d102f0fcd551ed25bf1813c3b3a4aea321d48d224f7bd0401e413e
Size 1.4MB
Sample240529-tm2d3sca85
SHA256 7e5708e0c9d102f0fcd551ed25bf1813c3b3a4aea321d48d224f7bd0401e413e
MD5 348e78e919f6ed502f39c0f4fea6973a
SHA1 779a6b69ba189cddadd274aa2b28cef2f4d4a719
SHA512 8816246b6b817c29b7a4d500e33c5698ffdc1daaf0f4f0c49823c37193a6d02fbcf99287576526d804d9af50b0acc1ab295be6396bc862a850fb6ed3f899ef7d
SSDEEP 24576:1E4IuY1tnsa4mCOMuFrK09bhLDoyYEn6n63twWxCinyGuQdTl9k:mjDsa4rEFrLZloVr63t6inyGug8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e5708e0c9d102f0fcd551ed25bf1813c3b3a4aea321d48d224f7bd0401e413e

File Explorer

7e5708e0c9d102f0fcd551ed25bf1813c3b3a4aea321d48d224f7bd0401e413e

.exe 1.4MB

7e5708e0c9d102f0fcd551ed25bf1813c3b3a4aea321d48d224f7bd0401e413e

IMPHASH 4c8a86dd9fddf628b9c2af04480b095c
SHA256 7e5708e0c9d102f0fcd551ed25bf1813c3b3a4aea321d48d224f7bd0401e413e
MD5 348e78e919f6ed502f39c0f4fea6973a
SHA1 779a6b69ba189cddadd274aa2b28cef2f4d4a719
SHA512 8816246b6b817c29b7a4d500e33c5698ffdc1daaf0f4f0c49823c37193a6d02fbcf99287576526d804d9af50b0acc1ab295be6396bc862a850fb6ed3f899ef7d
SSDEEP 24576:1E4IuY1tnsa4mCOMuFrK09bhLDoyYEn6n63twWxCinyGuQdTl9k:mjDsa4rEFrLZloVr63t6inyGug8
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

395503

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\BuildProjects_Redist\Redist\src\360Game\src\setup\installer\bin\Release\uninst.pdb

kernel32

SetLastError TerminateThread SuspendThread SetEvent CreateEventW FlushInstructionCache GetCurrentProcess InterlockedExchange GetTempFileNameW WideCharToMultiByte TerminateProcess OpenProcess GetPrivateProfileIntW MoveFileW FindNextFileW RemoveDirectoryW FindClose FindFirstFileW DeleteFileW GetPrivateProfileStringW CreateThread Sleep WaitForSingleObject GetTickCount MoveFileExW CopyFileW GetFileAttributesW SetFileAttributesW GetTempPathW GetLongPathNameW InterlockedIncrement InterlockedDecrement LoadLibraryExW lstrcmpiW GetCurrentThreadId CreateMutexW DecodePointer RaiseException InitializeCriticalSectionAndSpinCount FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy MultiByteToWideChar LeaveCriticalSection EnterCriticalSection FreeLibrary DeleteCriticalSection InitializeCriticalSection LocalFree GetLastError CreateProcessW LoadLibraryW GetModuleFileNameW GetCurrentProcessId CloseHandle DeviceIoControl CreateFileW LoadLibraryExA VirtualQuery VirtualProtect SetThreadContext GetThreadContext ResumeThread ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock GetSystemTime FormatMessageW GetFileSizeEx LocalFileTimeToFileTime SystemTimeToFileTime CreateFileA GetCurrentThread GetProcAddress WriteConsoleW FlushFileBuffers LCMapStringW GetModuleHandleW GetWindowsDirectoryW IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent VirtualAlloc VirtualFree lstrlenW WriteFile GlobalAlloc GlobalFree GetFileSize ReadFile MulDiv GlobalLock GlobalUnlock TlsAlloc TlsFree TlsGetValue TlsSetValue VerifyVersionInfoW VerSetConditionMask CreateToolhelp32Snapshot Process32FirstW Process32NextW GetVersionExW WaitForMultipleObjects EncodePointer ExitThread GetCommandLineW RtlUnwind GetSystemTimeAsFileTime IsValidCodePage GetACP GetOEMCP GetCPInfo ExitProcess GetModuleHandleExW SetFilePointerEx GetConsoleMode ReadConsoleW GetStdHandle GetFileType GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW GetConsoleCP SetStdHandle

user32

CopyRect EqualRect SetRectEmpty SetRect DrawIcon DrawIconEx GetIconInfo FillRect ClientToScreen IsRectEmpty GetFocus GetKeyState TrackMouseEvent MonitorFromPoint SubtractRect RegisterClipboardFormatW HideCaret SetCursor GetSysColor PtInRect GetCursorPos GetCaretBlinkTime GetAsyncKeyState UnionRect OpenClipboard GetClipboardData CloseClipboard CharLowerBuffW CharLowerW IsChild WindowFromPoint IntersectRect GetKeyNameTextW EmptyClipboard SetClipboardData InflateRect GetAncestor SetClassLongW OffsetRect SetWindowRgn SystemParametersInfoW IsZoomed ScreenToClient UpdateLayeredWindow EndPaint BeginPaint SetFocus CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW IsWindowVisible CallWindowProcW SetWindowLongW IsWindow DestroyWindow MessageBoxW PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW DefWindowProcW SwitchToThisWindow BringWindowToTop SetForegroundWindow GetWindowThreadProcessId AttachThreadInput GetForegroundWindow FindWindowW KillTimer SendMessageW GetSystemMetrics PostQuitMessage SetWindowTextW ShowWindow GetWindow MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent GetClientRect MapWindowPoints SetWindowPos GetWindowLongW SetTimer PostMessageW LoadImageW UnregisterClassW ReleaseCapture SetCapture DrawTextW ReleaseDC GetDC InvalidateRect MapVirtualKeyW IsClipboardFormatAvailable

gdi32

GetObjectW DeleteDC CreateFontW BitBlt StretchBlt CreatePen MoveToEx CreateFontIndirectW GetObjectA CreateSolidBrush Rectangle RoundRect GetStockObject CreateDCW GetDIBits CreateCompatibleBitmap GetBitmapBits SetBitmapBits SetTextColor GetCurrentObject SetViewportOrgEx SetStretchBltMode GetDeviceCaps RectVisible SaveDC IntersectClipRect RestoreDC SetROP2 SetBkColor ExtTextOutW GetTextMetricsW SelectClipRgn GetClipBox CombineRgn CreateRectRgn CreateRoundRectRgn CreateCompatibleDC CreateDIBSection DeleteObject GetTextExtentPoint32W SetBkMode SelectObject LineTo

advapi32

RegDeleteKeyW RegCloseKey RegQueryInfoKeyW RegQueryValueExA CloseServiceHandle DeleteService QueryServiceStatus ControlService OpenServiceW OpenSCManagerW RegEnumValueW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryValueExW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW SHChangeNotify ShellExecuteW CommandLineToArgvW

ole32

CoUninitialize CoInitialize CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW PathAppendW PathRemoveFileSpecW PathSkipRootW PathIsDirectoryW SHGetValueW PathFindFileNameW PathMatchSpecW PathGetArgsW PathRemoveArgsW PathUnquoteSpacesW SHDeleteKeyW PathCombineW PathAddBackslashW

comctl32

InitCommonControlsEx

Name

.text

Size

497KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

43KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

608KB

Virtual Size

607KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=3, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=2, id=199, version=41118,

count=30, id=223, productName=VS2013 build 21005, version=21005,

count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,

count=235, id=224, productName=VS2013 build 21005, version=21005,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=225, version=20806,

count=83, id=225, productName=VS2013 build 21005, version=21005,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=516, id=1, productName=Unmarked objects,

count=122, id=229, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,