3357b467592b54be17bbbe1767407170ac8b9f5e8283b628228ffd5d1b006041

Sharing

Copy URL Twitter E-mail

General

Target
3357b467592b54be17bbbe1767407170ac8b9f5e8283b628228ffd5d1b006041
Size 4.8MB
Sample240603-s2ecesba7x
SHA256 3357b467592b54be17bbbe1767407170ac8b9f5e8283b628228ffd5d1b006041
MD5 b48418167e3363f195bcad0fe6001c0a
SHA1 681a31f18d99323bf2d687231a11b00f32f6f195
SHA512 775c321f092ca0e0af8f7464f4377d96f8435a33103ed5e7deca5aafcb9c7f465c7fdedfe1b2c605f6e2ebefbf3cdd67be6e08c3c8f25368378d1f67a7405634
SSDEEP 98304:seLpmrmc2lAu28lkcf5YjovKqGYiOE8oLj5YINfSyo8aXA:TcmZl85gyjovK65E8ob5Sx8aXA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3357b467592b54be17bbbe1767407170ac8b9f5e8283b628228ffd5d1b006041

File Explorer

3357b467592b54be17bbbe1767407170ac8b9f5e8283b628228ffd5d1b006041

.exe 4.8MB

3357b467592b54be17bbbe1767407170ac8b9f5e8283b628228ffd5d1b006041

IMPHASH c8f585918987a310f6428f02fe881c59
SHA256 3357b467592b54be17bbbe1767407170ac8b9f5e8283b628228ffd5d1b006041
MD5 b48418167e3363f195bcad0fe6001c0a
SHA1 681a31f18d99323bf2d687231a11b00f32f6f195
SHA512 775c321f092ca0e0af8f7464f4377d96f8435a33103ed5e7deca5aafcb9c7f465c7fdedfe1b2c605f6e2ebefbf3cdd67be6e08c3c8f25368378d1f67a7405634
SSDEEP 98304:seLpmrmc2lAu28lkcf5YjovKqGYiOE8oLj5YINfSyo8aXA:TcmZl85gyjovK65E8ob5Sx8aXA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

182709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\gamemaster\installanduninstall\Inst\Install_Exe.pdb

kernel32

SizeofResource ReadFile FindClose CloseHandle MulDiv GetSystemTime CreatePipe PeekNamedPipe lstrcmpW lstrcmpiW lstrcpynW lstrlenA lstrlenW CreateMutexW LoadLibraryW LoadLibraryExW GetModuleFileNameW GetModuleHandleW CreateProcessW GetStartupInfoW FindResourceW FindResourceExW GetSystemDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetVersionExW MultiByteToWideChar WideCharToMultiByte LocalFree GetCommandLineW GetWindowsDirectoryW WritePrivateProfileStringW IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetFileSize WriteFile FlushFileBuffers CreateFileW DeviceIoControl lstrcmpA lstrcmpiA CreateFileA RtlUnwind TlsAlloc TlsGetValue TlsSetValue LeaveCriticalSection CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetACP Sleep GetFileType LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WaitForSingleObjectEx SetStdHandle GetConsoleCP GetConsoleMode SetFilePointerEx ReadConsoleW WriteConsoleW InterlockedCompareExchange GetPrivateProfileStringW LocalAlloc GetSystemInfo ResetEvent CreateDirectoryW GetTempFileNameW FormatMessageW GlobalAddAtomW TerminateThread CopyFileW ReleaseMutex GetExitCodeProcess GetFileAttributesExW CreateFileMappingW UnmapViewOfFile MapViewOfFile SetFilePointer WaitForMultipleObjects GetExitCodeThread MoveFileW GetLocalTime GetFileSizeEx GlobalFree MoveFileExW GetFileAttributesW SetFileAttributesW GetTickCount GetFullPathNameW RemoveDirectoryW GetDiskFreeSpaceExW GetTempPathW GetDriveTypeW GetLogicalDriveStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalFindAtomW GlobalDeleteAtom OpenProcess GetLongPathNameW CreateEventW SetEvent LoadResource GetStringTypeW EnterCriticalSection InitializeCriticalSection SetErrorMode SetLastError GetCurrentThreadId GetCurrentProcess GlobalMemoryStatusEx GlobalUnlock GlobalLock GlobalAlloc GetProcAddress FreeLibrary LockResource InterlockedDecrement InterlockedIncrement FreeResource GetSystemWindowsDirectoryW SetEndOfFile SetFileTime WaitForSingleObject GetFileInformationByHandle GetModuleHandleA InterlockedExchange DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError DecodePointer RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy TlsFree

user32

MonitorFromWindow LoadImageW PtInRect GetCursorPos MonitorFromPoint DialogBoxParamW CopyRect EndDialog LoadCursorW TrackPopupMenu AppendMenuW DestroyMenu GetSystemMetrics KillTimer SetTimer IsIconic UnregisterClassW ShowWindowAsync CharUpperW SetWindowLongW GetDesktopWindow GetParent FindWindowW GetClassNameW CreatePopupMenu GetWindow MessageBoxW UnhookWinEvent SetWinEventHook SystemParametersInfoW SetCursor OffsetRect SetWindowRgn UpdateLayeredWindow SetRect GetMonitorInfoW UpdateWindow PostQuitMessage IsRectEmpty WaitForInputIdle SendMessageTimeoutW GetWindowThreadProcessId FindWindowExW PostThreadMessageW wsprintfW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageW GetWindowLongW FillRect GetSysColor MapWindowPoints ScreenToClient ClientToScreen GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharNextW GetDlgItem BringWindowToTop IsWindowVisible SetWindowPos MoveWindow ShowWindow DestroyWindow IsChild IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW PostMessageW

shlwapi

PathFindExtensionW StrToInt64ExW wvnsprintfW PathIsDirectoryW wnsprintfW SHStrDupW PathAppendW PathStripToRootW PathFindFileNameW PathIsPrefixW StrToIntW StrCmpIW StrStrIA StrTrimA StrCmpNIW PathFileExistsW PathCombineW PathRemoveFileSpecW SHDeleteValueW SHGetValueA SHGetValueW SHSetValueW StrStrIW wnsprintfA SHDeleteKeyW PathRelativePathToW PathIsRelativeW StrCmpW SHSetValueA

comctl32

_TrackMouseEvent InitCommonControlsEx

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipDrawImageRectRectI GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipCreateBitmapFromStream GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateBitmapFromStreamICM GdipSetTextRenderingHint GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateSolidFill GdipDeleteBrush GdipDrawImagePointRectI GdipCreateFontFamilyFromName GdipDrawImageRectRect GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromFile

gdi32

CreateRectRgn EnumFontFamiliesW CreateFontW ExtTextOutW CombineRgn SetTextColor SetBkMode SetBkColor GetCurrentObject CreateFontIndirectW BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteObject GetDeviceCaps GetStockObject SelectObject GetObjectW RestoreDC SaveDC DeleteDC SetViewportOrgEx

advapi32

GetUserNameW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegDeleteKeyW GetTokenInformation GetTrusteeNameW BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW GetExplicitEntriesFromAclW SetEntriesInAclW LookupAccountNameW LookupAccountSidW DeleteAce EqualSid LookupPrivilegeValueW RegEnumKeyExW RegDeleteValueW OpenProcessToken AdjustTokenPrivileges

shell32

SHLoadInProc ShellExecuteExW ord75 SHFileOperationW ShellExecuteW ord165 SHChangeNotify CommandLineToArgvW Shell_NotifyIconW SHGetPathFromIDListW SHBrowseForFolderW SHCreateDirectoryExW SHGetSpecialFolderPathW ord680

ole32

CoCreateGuid CoInitialize CoUninitialize CoGetClassObject CoSetProxyBlanket CreateStreamOnHGlobal OleLockRunning OleUninitialize OleInitialize PropVariantClear CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CLSIDFromString CoCreateInstance OleRun

oleaut32

SysStringByteLen SysAllocStringByteLen OleCreateFontIndirect LoadRegTypeLi LoadTypeLi VarUI4FromStr VariantClear VariantInit SysStringLen SysFreeString SysAllocStringLen SysAllocString

urlmon

URLDownloadToCacheFileW

psapi

GetModuleFileNameExW EnumProcesses

winhttp

WinHttpOpenRequest WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpSetCredentials WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders

iphlpapi

GetAdaptersInfo

setupapi

SetupIterateCabinetW

generic

count=17, id=241, version=40116,

count=161, id=243, version=40116,

count=30, id=242, version=40116,

count=2, id=264, version=27030,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=5, id=261, version=27032,

count=3, id=199, version=41118,

count=23, id=259, version=26706,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=77, id=261, version=26706,

count=35, id=260, version=26706,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=487, id=1, productName=Unmarked objects,

count=79, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,