9bab2b8fbf182d4e94e64efdad999cb8780e581a6f813ce8e9a3a3b61917f5ce

Sharing

Copy URL Twitter E-mail

General

Target
9bab2b8fbf182d4e94e64efdad999cb8780e581a6f813ce8e9a3a3b61917f5ce
Size 4.8MB
Sample240608-d45vtshd28
SHA256 9bab2b8fbf182d4e94e64efdad999cb8780e581a6f813ce8e9a3a3b61917f5ce
MD5 01b3202113150a34b4427a594ef88b6c
SHA1 fed0330cfdff6b8ad85f718b286b7d0ca86ee732
SHA512 56b658265b41af72983cebed06657941fbf1363153ff3139587232756dc73847829c59192920168752fd49a1699dc6f48e6f81db004a7c0f7797b2fbd443d486
SSDEEP 98304:nXHfZysNkdeOVWB4PGrx2fEyMmzHJhYlRJT:nPx1dx2f9MmzHwX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9bab2b8fbf182d4e94e64efdad999cb8780e581a6f813ce8e9a3a3b61917f5ce

File Explorer

9bab2b8fbf182d4e94e64efdad999cb8780e581a6f813ce8e9a3a3b61917f5ce

.exe 4.8MB

9bab2b8fbf182d4e94e64efdad999cb8780e581a6f813ce8e9a3a3b61917f5ce

IMPHASH 8eddeb221d4f4ddf082b97a42df1d43b
SHA256 9bab2b8fbf182d4e94e64efdad999cb8780e581a6f813ce8e9a3a3b61917f5ce
MD5 01b3202113150a34b4427a594ef88b6c
SHA1 fed0330cfdff6b8ad85f718b286b7d0ca86ee732
SHA512 56b658265b41af72983cebed06657941fbf1363153ff3139587232756dc73847829c59192920168752fd49a1699dc6f48e6f81db004a7c0f7797b2fbd443d486
SSDEEP 98304:nXHfZysNkdeOVWB4PGrx2fEyMmzHJhYlRJT:nPx1dx2f9MmzHwX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

697010

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Work\MasterLu\install_and_uninstall\Release\Install.pdb

kernel32

GetStartupInfoW GetPrivateProfileStringW GetTempFileNameW GetPrivateProfileIntW OpenEventW GlobalAddAtomW GetFileSizeEx DecodePointer InterlockedIncrement InterlockedDecrement lstrcmpiW LoadLibraryExW GetCommandLineW CopyFileW GetLocalTime SystemTimeToFileTime VirtualAllocEx VirtualFreeEx ReadProcessMemory WriteProcessMemory OutputDebugStringA GetLongPathNameW GlobalFree GlobalUnlock GlobalLock GlobalAlloc CreateEventW WaitForMultipleObjects WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetDiskFreeSpaceExW GetSystemDirectoryW GetDriveTypeW GetLogicalDriveStringsW MoveFileExW MoveFileW FindNextFileW FindFirstFileW DeleteFileW GetFileAttributesW SetFileAttributesW GetFullPathNameW RemoveDirectoryW GetWindowsDirectoryW GetTempPathW WriteConsoleW ReadConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW lstrlenW GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetACP GetModuleFileNameA ExitProcess GetTimeZoneInformation GetModuleHandleExW ResumeThread ExitThread RtlUnwind WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore SetProcessAffinityMask VirtualProtect GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask SetCurrentDirectoryW GetExitCodeProcess TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException MultiByteToWideChar GetFileSize OpenProcess UnlockFile LockFile MulDiv Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalFindAtomW CreateMutexW GetVersion GetCurrentProcessId WideCharToMultiByte FindClose SetLastError GetTickCount Sleep GetLastError LocalFree LocalAlloc GetVersionExW WritePrivateProfileStringW FindResourceExW FindResourceW GetModuleHandleW GetModuleFileNameW DeviceIoControl SizeofResource LoadResource FreeLibrary LockResource GetFileAttributesExW CreateFileW CreateFileMappingW UnmapViewOfFile MapViewOfFile OutputDebugStringW LoadLibraryW DosDateTimeToFileTime LocalFileTimeToFileTime SetFilePointer ReadFile GetProcessHeap HeapSize GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue ReleaseMutex FindNextFileA FindFirstFileA lstrlenA lstrcmpiA lstrcmpA GetSystemWindowsDirectoryW FreeResource GetStdHandle SetEndOfFile GetFileInformationByHandle CompareFileTime FindCloseChangeNotification FindFirstChangeNotificationW SearchPathW RtlCaptureStackBackTrace SetFileTime FlushFileBuffers SetUnhandledExceptionFilter UnhandledExceptionFilter OpenFileMappingW GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetNativeSystemInfo GetExitCodeThread GetCurrentThread WaitForSingleObjectEx DuplicateHandle GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread TryEnterCriticalSection QueryPerformanceFrequency QueryPerformanceCounter GetStringTypeW LoadLibraryExA HeapFree HeapReAlloc HeapAlloc VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent InterlockedCompareExchange InterlockedExchange GetEnvironmentVariableW CreateDirectoryW FormatMessageW GetShortPathNameW GetSystemInfo ResetEvent HeapDestroy GetProcAddress DeleteFileA CreateFileA GetTempFileNameA GetTempPathA CreateProcessW GlobalDeleteAtom GetCurrentDirectoryW CloseHandle GetDateFormatW WriteFile

user32

BeginPaint DrawFocusRect CopyRect PtInRect ScreenToClient LoadCursorW OffsetRect IsRectEmpty SetCursor IsWindow PostMessageW GetWindowThreadProcessId FindWindowExW SetForegroundWindow IsIconic DefWindowProcW EndPaint SetRect IsWindowVisible ShowWindow SendMessageW ReleaseDC GetDC KillTimer SetTimer CallWindowProcW UnregisterClassA SendNotifyMessageW SendMessageTimeoutW MoveWindow MessageBoxW IsDialogMessageW EndDialog DialogBoxParamW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW InvalidateRect GetClientRect GetWindowRect GetWindowLongW SetWindowLongW wsprintfW EnableWindow RedrawWindow GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow FindWindowW MapWindowPoints SetWindowTextW GetSystemMetrics GetParent PostQuitMessage ExitWindowsEx RegisterWindowMessageW CharNextW BringWindowToTop DestroyWindow PeekMessageW DispatchMessageW TranslateMessage GetMessageW GetWindowTextLengthW DrawTextW UnhookWinEvent SetWinEventHook GetWindowTextW GetShellWindow WaitForInputIdle SystemParametersInfoW SetWindowRgn SetWindowPos UpdateLayeredWindow

gdi32

SaveDC RestoreDC SetTextColor SetBkMode CreateRectRgn CombineRgn SetViewportOrgEx CreateCompatibleDC CreateCompatibleBitmap BitBlt SetBkColor DeleteDC SelectObject GetTextExtentPoint32W GetDeviceCaps CreateFontIndirectW EnumFontFamiliesW DeleteObject CreateFontW ExtTextOutW

advapi32

LockServiceDatabase RegQueryValueExA RegOpenKeyExA RegEnumKeyExA GetTokenInformation CryptContextAddRef CryptDecrypt CryptEncrypt CryptImportKey CryptGenRandom CryptSetKeyParam CryptDestroyKey RegSetValueExW RegQueryInfoKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegEnumValueW DuplicateTokenEx RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken UnlockServiceDatabase StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceLockStatusW QueryServiceConfig2W QueryServiceConfigW OpenServiceW OpenSCManagerW RegGetValueW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW CryptReleaseContext GetUserNameW AllocateAndInitializeSid FreeSid CheckTokenMembership EqualSid DeleteAce LookupAccountSidW LookupAccountNameW SetEntriesInAclW GetExplicitEntriesFromAclW GetNamedSecurityInfoW SetNamedSecurityInfoW BuildExplicitAccessWithNameW GetTrusteeNameW CryptAcquireContextW

shell32

SHCreateDirectoryExW SHFileOperationW ord165 SHGetSpecialFolderLocation SHGetDesktopFolder SHChangeNotify ShellExecuteExW ShellExecuteW SHLoadInProc SHBrowseForFolderW CommandLineToArgvW SHGetSpecialFolderPathW SHGetPathFromIDListW

ole32

CoInitializeEx CoInitializeSecurity CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoCreateGuid CoCreateInstance CoTaskMemFree OleRun CreateStreamOnHGlobal StringFromGUID2 CoInitialize CoSetProxyBlanket

oleaut32

VariantCopy CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo VariantInit SysStringLen VariantClear SysAllocStringByteLen SysStringByteLen SysFreeString VarUI4FromStr SysAllocString

shlwapi

StrStrIA StrCmpNIW StrTrimA StrCmpIW StrToIntExW SHGetValueA PathAppendA PathFindFileNameA PathRenameExtensionA PathAppendW PathCombineW PathFileExistsW PathRemoveFileSpecW PathFindExtensionW wnsprintfW StrCmpW PathFindFileNameW SHGetValueW PathUnquoteSpacesW SHSetValueW PathIsPrefixW PathIsRelativeW PathIsRootW SHSetValueA AssocQueryStringW SHDeleteKeyW PathIsDirectoryW SHDeleteValueW StrStrIW

comctl32

_TrackMouseEvent InitCommonControlsEx

gdiplus

GdipDeleteFontFamily GdipGraphicsClear GdipDrawImagePointRectI GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipSetTextRenderingHint GdipCreateFont GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageRectRect GdipDrawImageRectRectI GdipCloneBrush GdipCreateFontFamilyFromName GdipDeleteFont GdiplusStartup GdipDeleteBrush GdipCreateSolidFill GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipDrawString GdipFillRectangleI GdipMeasureString GdipCreateStringFormat

cabinet

ord22 ord23 ord20

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW EnumProcesses

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

secur32

GetUserNameExW

crypt32

CryptBinaryToStringW CertGetNameStringW CryptStringToBinaryA CryptBinaryToStringA CryptStringToBinaryW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

generic

count=22, id=241, version=40116,

count=175, id=243, version=40116,

count=32, id=242, version=40116,

count=1, id=261, version=27031,

count=2, id=264, version=27049,

count=1, productName=Unmarked objects (old),

count=21, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=261, version=27032,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=16, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=38, id=260, version=26706,

count=136, id=261, version=26706,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=511, id=1, productName=Unmarked objects,

count=1, id=260, version=27049,

count=85, id=261, version=27049,

count=1, id=256, version=27049,

count=1, id=255, version=27049,

count=2, id=151,

count=1, id=258, version=27049,