1d0594c5b15a4f69c497614851338682a4177eb05dc55f36d2e67cd3fca00b78

Sharing

Copy URL Twitter E-mail

General

Target
1d0594c5b15a4f69c497614851338682a4177eb05dc55f36d2e67cd3fca00b78
Size 4.8MB
Sample240603-s3pvjsbb3x
SHA256 1d0594c5b15a4f69c497614851338682a4177eb05dc55f36d2e67cd3fca00b78
MD5 9c4cf0841ebf0e99274e584fb4975ff3
SHA1 cb62fa9ffd65818f809a43b37e1ebb539fa74453
SHA512 7e29efeb86fc8e70b74ea8a27238483ddf1434ffb8ce0d0499115f9a64406d67c2b92fdbe1f4c3749d2774228d97395f953fc53625e6ee653bdbb8e70f7a1840
SSDEEP 98304:seLpmrmc2lAu28lkcf5YjovKqGYiOE8oLj5YINfSyo8aXv:TcmZl85gyjovK65E8ob5Sx8aXv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d0594c5b15a4f69c497614851338682a4177eb05dc55f36d2e67cd3fca00b78

File Explorer

1d0594c5b15a4f69c497614851338682a4177eb05dc55f36d2e67cd3fca00b78

.exe 4.8MB

1d0594c5b15a4f69c497614851338682a4177eb05dc55f36d2e67cd3fca00b78

IMPHASH c8f585918987a310f6428f02fe881c59
SHA256 1d0594c5b15a4f69c497614851338682a4177eb05dc55f36d2e67cd3fca00b78
MD5 9c4cf0841ebf0e99274e584fb4975ff3
SHA1 cb62fa9ffd65818f809a43b37e1ebb539fa74453
SHA512 7e29efeb86fc8e70b74ea8a27238483ddf1434ffb8ce0d0499115f9a64406d67c2b92fdbe1f4c3749d2774228d97395f953fc53625e6ee653bdbb8e70f7a1840
SSDEEP 98304:seLpmrmc2lAu28lkcf5YjovKqGYiOE8oLj5YINfSyo8aXv:TcmZl85gyjovK65E8ob5Sx8aXv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

182709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\gamemaster\installanduninstall\Inst\Install_Exe.pdb

kernel32

SizeofResource ReadFile FindClose CloseHandle MulDiv GetSystemTime CreatePipe PeekNamedPipe lstrcmpW lstrcmpiW lstrcpynW lstrlenA lstrlenW CreateMutexW LoadLibraryW LoadLibraryExW GetModuleFileNameW GetModuleHandleW CreateProcessW GetStartupInfoW FindResourceW FindResourceExW GetSystemDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetVersionExW MultiByteToWideChar WideCharToMultiByte LocalFree GetCommandLineW GetWindowsDirectoryW WritePrivateProfileStringW IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetFileSize WriteFile FlushFileBuffers CreateFileW DeviceIoControl lstrcmpA lstrcmpiA CreateFileA RtlUnwind TlsAlloc TlsGetValue TlsSetValue LeaveCriticalSection CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetACP Sleep GetFileType LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WaitForSingleObjectEx SetStdHandle GetConsoleCP GetConsoleMode SetFilePointerEx ReadConsoleW WriteConsoleW InterlockedCompareExchange GetPrivateProfileStringW LocalAlloc GetSystemInfo ResetEvent CreateDirectoryW GetTempFileNameW FormatMessageW GlobalAddAtomW TerminateThread CopyFileW ReleaseMutex GetExitCodeProcess GetFileAttributesExW CreateFileMappingW UnmapViewOfFile MapViewOfFile SetFilePointer WaitForMultipleObjects GetExitCodeThread MoveFileW GetLocalTime GetFileSizeEx GlobalFree MoveFileExW GetFileAttributesW SetFileAttributesW GetTickCount GetFullPathNameW RemoveDirectoryW GetDiskFreeSpaceExW GetTempPathW GetDriveTypeW GetLogicalDriveStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalFindAtomW GlobalDeleteAtom OpenProcess GetLongPathNameW CreateEventW SetEvent LoadResource GetStringTypeW EnterCriticalSection InitializeCriticalSection SetErrorMode SetLastError GetCurrentThreadId GetCurrentProcess GlobalMemoryStatusEx GlobalUnlock GlobalLock GlobalAlloc GetProcAddress FreeLibrary LockResource InterlockedDecrement InterlockedIncrement FreeResource GetSystemWindowsDirectoryW SetEndOfFile SetFileTime WaitForSingleObject GetFileInformationByHandle GetModuleHandleA InterlockedExchange DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError DecodePointer RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy TlsFree

user32

MonitorFromWindow LoadImageW PtInRect GetCursorPos MonitorFromPoint DialogBoxParamW CopyRect EndDialog LoadCursorW TrackPopupMenu AppendMenuW DestroyMenu GetSystemMetrics KillTimer SetTimer IsIconic UnregisterClassW ShowWindowAsync CharUpperW SetWindowLongW GetDesktopWindow GetParent FindWindowW GetClassNameW CreatePopupMenu GetWindow MessageBoxW UnhookWinEvent SetWinEventHook SystemParametersInfoW SetCursor OffsetRect SetWindowRgn UpdateLayeredWindow SetRect GetMonitorInfoW UpdateWindow PostQuitMessage IsRectEmpty WaitForInputIdle SendMessageTimeoutW GetWindowThreadProcessId FindWindowExW PostThreadMessageW wsprintfW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageW GetWindowLongW FillRect GetSysColor MapWindowPoints ScreenToClient ClientToScreen GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharNextW GetDlgItem BringWindowToTop IsWindowVisible SetWindowPos MoveWindow ShowWindow DestroyWindow IsChild IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW PostMessageW

shlwapi

PathFindExtensionW StrToInt64ExW wvnsprintfW PathIsDirectoryW wnsprintfW SHStrDupW PathAppendW PathStripToRootW PathFindFileNameW PathIsPrefixW StrToIntW StrCmpIW StrStrIA StrTrimA StrCmpNIW PathFileExistsW PathCombineW PathRemoveFileSpecW SHDeleteValueW SHGetValueA SHGetValueW SHSetValueW StrStrIW wnsprintfA SHDeleteKeyW PathRelativePathToW PathIsRelativeW StrCmpW SHSetValueA

comctl32

_TrackMouseEvent InitCommonControlsEx

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipDrawImageRectRectI GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipCreateBitmapFromStream GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateBitmapFromStreamICM GdipSetTextRenderingHint GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateSolidFill GdipDeleteBrush GdipDrawImagePointRectI GdipCreateFontFamilyFromName GdipDrawImageRectRect GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromFile

gdi32

CreateRectRgn EnumFontFamiliesW CreateFontW ExtTextOutW CombineRgn SetTextColor SetBkMode SetBkColor GetCurrentObject CreateFontIndirectW BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteObject GetDeviceCaps GetStockObject SelectObject GetObjectW RestoreDC SaveDC DeleteDC SetViewportOrgEx

advapi32

GetUserNameW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegDeleteKeyW GetTokenInformation GetTrusteeNameW BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW GetExplicitEntriesFromAclW SetEntriesInAclW LookupAccountNameW LookupAccountSidW DeleteAce EqualSid LookupPrivilegeValueW RegEnumKeyExW RegDeleteValueW OpenProcessToken AdjustTokenPrivileges

shell32

SHLoadInProc ShellExecuteExW ord75 SHFileOperationW ShellExecuteW ord165 SHChangeNotify CommandLineToArgvW Shell_NotifyIconW SHGetPathFromIDListW SHBrowseForFolderW SHCreateDirectoryExW SHGetSpecialFolderPathW ord680

ole32

CoCreateGuid CoInitialize CoUninitialize CoGetClassObject CoSetProxyBlanket CreateStreamOnHGlobal OleLockRunning OleUninitialize OleInitialize PropVariantClear CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CLSIDFromString CoCreateInstance OleRun

oleaut32

SysStringByteLen SysAllocStringByteLen OleCreateFontIndirect LoadRegTypeLi LoadTypeLi VarUI4FromStr VariantClear VariantInit SysStringLen SysFreeString SysAllocStringLen SysAllocString

urlmon

URLDownloadToCacheFileW

psapi

GetModuleFileNameExW EnumProcesses

winhttp

WinHttpOpenRequest WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpSetCredentials WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders

iphlpapi

GetAdaptersInfo

setupapi

SetupIterateCabinetW

generic

count=17, id=241, version=40116,

count=161, id=243, version=40116,

count=30, id=242, version=40116,

count=2, id=264, version=27030,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=5, id=261, version=27032,

count=3, id=199, version=41118,

count=23, id=259, version=26706,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=77, id=261, version=26706,

count=35, id=260, version=26706,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=487, id=1, productName=Unmarked objects,

count=79, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,