9a3fc4a3e71ed71921e2f7d28b5d3ebe5ea0808cd9103ff03969b5752a6b2f01

Sharing

Copy URL Twitter E-mail

General

Target
9a3fc4a3e71ed71921e2f7d28b5d3ebe5ea0808cd9103ff03969b5752a6b2f01
Size 1.5MB
Sample240602-e4kqbsba3v
SHA256 9a3fc4a3e71ed71921e2f7d28b5d3ebe5ea0808cd9103ff03969b5752a6b2f01
MD5 1c2c0758f33e0bde14e7ce0ce1561b73
SHA1 55a165bc3353eada18868c7d88d88e010ff285d9
SHA512 f7b18d1b26416ab7877ffed386424f7997beb7eb2b34174c1e05af447c2238fff5eccb6fb88730e7bd04d64b4ab42c86198a9f1cd0199654cf2eb697066f8395
SSDEEP 24576:t29NxntFFxy6565lOmeJI9JwGXYByO+6bsqetItnwn56fT+A:MTxtFG5lOmeJyJwAYByJesqEw/yA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a3fc4a3e71ed71921e2f7d28b5d3ebe5ea0808cd9103ff03969b5752a6b2f01

File Explorer

9a3fc4a3e71ed71921e2f7d28b5d3ebe5ea0808cd9103ff03969b5752a6b2f01

.exe 1.5MB

9a3fc4a3e71ed71921e2f7d28b5d3ebe5ea0808cd9103ff03969b5752a6b2f01

IMPHASH 5a2e4c7c65d65ad712bbb31470f02fe5
SHA256 9a3fc4a3e71ed71921e2f7d28b5d3ebe5ea0808cd9103ff03969b5752a6b2f01
MD5 1c2c0758f33e0bde14e7ce0ce1561b73
SHA1 55a165bc3353eada18868c7d88d88e010ff285d9
SHA512 f7b18d1b26416ab7877ffed386424f7997beb7eb2b34174c1e05af447c2238fff5eccb6fb88730e7bd04d64b4ab42c86198a9f1cd0199654cf2eb697066f8395
SSDEEP 24576:t29NxntFFxy6565lOmeJI9JwGXYByO+6bsqetItnwn56fT+A:MTxtFG5lOmeJyJwAYByJesqEw/yA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

623529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Project\seapp\bin\Release\SeAppService.pdb

kernel32

IsBadReadPtr MulDiv GetCommandLineW CreateDirectoryW MoveFileW FindClose FindFirstFileW FindNextFileW OpenProcess LockResource WriteFile FreeResource GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetCurrentProcessId InitializeCriticalSection DeviceIoControl CreateProcessW GetModuleHandleA FindResourceExW WritePrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStructW GetExitCodeProcess WaitForSingleObject MoveFileExW GetVersionExW VirtualQuery SetUnhandledExceptionFilter ReadFile LocalFree CreateThread TerminateThread SuspendThread SetEvent CreateEventW SetFilePointer ExitProcess Sleep DuplicateHandle GetSystemTimeAsFileTime GetSystemInfo ResetEvent SetEndOfFile SetFileTime SystemTimeToFileTime TlsAlloc TlsSetValue TlsFree lstrcmpA lstrcmpiA AssignProcessToJobObject GetPrivateProfileStringW GetTickCount VirtualFree VirtualAlloc DeleteFileW CopyFileW GetTempPathW GetSystemDirectoryW WideCharToMultiByte CreateFileW GetFileSize MultiByteToWideChar FindResourceW LoadLibraryExW LoadLibraryW OpenMutexW CreateMutexW lstrcmpiW CloseHandle SizeofResource LoadResource SetErrorMode TerminateProcess SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA WriteConsoleW GetTimeZoneInformation SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetModuleFileNameA GetConsoleMode GetConsoleCP RtlUnwind OpenThread HeapWalk HeapUnlock HeapLock GetFileSizeEx CreateFileA LocalFileTimeToFileTime GetStartupInfoW UnhandledExceptionFilter WaitForSingleObjectEx GetLocalTime DosDateTimeToFileTime GetFileType GetACP GetCurrentProcess FreeLibrary InterlockedDecrement InterlockedIncrement GetModuleHandleW GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection SetLastError GetLastError GetCurrentThreadId RaiseException GetProcessHeap GetModuleHandleExA GetStdHandle ResumeThread InterlockedExchangeAdd InterlockedCompareExchange GetFileAttributesW GetCurrentDirectoryW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleExW TlsGetValue SwitchToThread PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort InterlockedExchange SetFilePointerEx FlushFileBuffers IsProcessorFeaturePresent QueryPerformanceFrequency QueryPerformanceCounter OutputDebugStringA ReleaseMutex HeapSize HeapFree FlushInstructionCache InterlockedPushEntrySList HeapReAlloc HeapAlloc HeapDestroy GetProcAddress DecodePointer VirtualProtect LoadLibraryExA IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList

user32

PostMessageW DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW IsWindow SetWindowPos GetKeyState SetForegroundWindow GetDC SendMessageW GetWindowRect GetWindowLongW SetWindowLongW GetDesktopWindow FindWindowW FindWindowExW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx LoadCursorW MonitorFromWindow GetMonitorInfoW ReleaseDC DestroyWindow InvalidateRect IsIconic PeekMessageW DispatchMessageW TranslateMessage GetMessageW GetShellWindow PostThreadMessageW WindowFromPoint GetParent MapWindowPoints MoveWindow ReplyMessage IntersectRect ClientToScreen ShowWindow EnumDisplayMonitors EnumDisplayDevicesW GetWindowThreadProcessId PtInRect AllowSetForegroundWindow KillTimer SetTimer IsWindowVisible PostQuitMessage SendMessageTimeoutW GetMessagePos MonitorFromPoint GetCursorPos GetSystemMetrics OffsetRect FillRect MessageBoxW WaitMessage CallMsgFilterW GetQueueStatus MsgWaitForMultipleObjectsEx wvsprintfW SetCursor UnionRect SetFocus GetActiveWindow GetFocus SetCapture ReleaseCapture GetUpdateRect ScreenToClient IsRectEmpty GetWindow RegisterClassW EnableWindow SetPropW GetPropW IsZoomed SetWindowRgn CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos GetSysColor CharPrevW DrawTextW SetRect SetWindowTextW GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo GetClientRect EndPaint BeginPaint UpdateLayeredWindow CharNextW

gdi32

TextOutW MoveToEx ExtTextOutW GdiFlush CreateRectRgnIndirect SetTextColor GetDIBits BitBlt SetBrushOrgEx GetObjectW CreateDIBSection GdiAlphaBlend SetStretchBltMode StretchBlt SelectObject GetStockObject DeleteObject DeleteDC CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap CreateFontIndirectW CreatePen Rectangle RestoreDC SaveDC GetTextMetricsW SetWindowOrgEx CreateRoundRectRgn GetObjectA CombineRgn CreateDCW CreatePenIndirect SetBkMode CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo RoundRect SelectClipRgn ExtSelectClipRgn SetBkColor CreatePatternBrush

shell32

SHAppBarMessage ShellExecuteW SHGetSpecialFolderPathW SHGetFolderPathW SHChangeNotify ord680 CommandLineToArgvW

shlwapi

SHGetValueA PathFileExistsW PathFindFileNameW SHGetValueW PathAppendW SHSetValueW StrDupW SHStrDupW PathRemoveFileSpecW PathCombineW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ws2_32

bind closesocket send recv listen inet_addr htons socket accept WSAStartup

netapi32

Netbios

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

imm32

ImmReleaseContext ImmSetCompositionFontW ImmSetCompositionWindow ImmGetContext

generic

count=26, id=241, version=40116,

count=186, id=243, version=40116,

count=34, id=242, version=40116,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=26, id=259, version=26706,

count=35, id=260, version=26706,

count=78, id=261, version=26706,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=625, id=1, productName=Unmarked objects,

count=10, id=260, version=27048,

count=178, id=261, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,