fb326ae60a37fe1d72f7c0ec82632378[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
fb326ae60a37fe1d72f7c0ec82632378.bin
Size 41.9MB
Sample240611-enrtpsvamj
SHA256 36d5fd64e38982141541a189be1167da8ce93559a5a2d0689a75553becac94d4
MD5 fb326ae60a37fe1d72f7c0ec82632378
SHA1 0de1b37e179a44f880e7ff49f4cc607b943958e9
SHA512 b5a174a8131cbfbef847daaf00ea48ce80f0a3127f873c99e95619ed3e390738716723deaffdf76ea8da14a27a67d8304dfbe8154401a5dd4f7312f57cb5d99e
SSDEEP 786432:xwvnIe84yEZwcCUmeaeYzeyChA/tQ1/BJ754U/Hz4gQ7sCZzEECamVf:xwvn7yBVea3zFCK/8J75RvzZ6EEgVf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb326ae60a37fe1d72f7c0ec82632378.bin

File Explorer

fb326ae60a37fe1d72f7c0ec82632378.bin

.exe 41.9MB

fb326ae60a37fe1d72f7c0ec82632378.bin

IMPHASH 9a11d54486321d15743e9644d8652e51
SHA256 36d5fd64e38982141541a189be1167da8ce93559a5a2d0689a75553becac94d4
MD5 fb326ae60a37fe1d72f7c0ec82632378
SHA1 0de1b37e179a44f880e7ff49f4cc607b943958e9
SHA512 b5a174a8131cbfbef847daaf00ea48ce80f0a3127f873c99e95619ed3e390738716723deaffdf76ea8da14a27a67d8304dfbe8154401a5dd4f7312f57cb5d99e
SSDEEP 786432:xwvnIe84yEZwcCUmeaeYzeyChA/tQ1/BJ754U/Hz4gQ7sCZzEECamVf:xwvn7yBVea3zFCK/8J75RvzZ6EEgVf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

710818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\master_lu\lds_install_and_uninstall\install_and_uninstall\Release\Install.pdb

kernel32

GetStartupInfoW GetPrivateProfileStringW GetTempFileNameW GetPrivateProfileIntW OpenEventW GlobalAddAtomW GetFileSizeEx DecodePointer InterlockedIncrement InterlockedDecrement lstrcmpiW LoadLibraryA LoadLibraryExW GetCommandLineW CopyFileW GetLocalTime SystemTimeToFileTime VirtualAllocEx VirtualFreeEx ReadProcessMemory WriteProcessMemory OutputDebugStringA GetLongPathNameW GlobalFree GlobalUnlock GlobalLock GlobalAlloc CreateEventW WaitForMultipleObjects WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetDiskFreeSpaceExW GetSystemDirectoryW GetDriveTypeW GetLogicalDriveStringsW MoveFileExW MoveFileW FindNextFileW FindFirstFileW DeleteFileW GetFileAttributesW SetFileAttributesW GetFullPathNameW RemoveDirectoryW GetWindowsDirectoryW GetTempPathW WriteConsoleW ReadConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW lstrlenW GetConsoleCP SetFilePointerEx GetFileType GetACP GetModuleFileNameA ExitProcess GetTimeZoneInformation GetModuleHandleExW ResumeThread ExitThread RtlUnwind WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore SetProcessAffinityMask VirtualProtect GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask SetCurrentDirectoryW GetExitCodeProcess TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException MultiByteToWideChar GetFileSize UnlockFile OpenProcess LockFile MulDiv Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalFindAtomW CreateMutexW GetVersion GetCurrentProcessId WideCharToMultiByte FindClose SetLastError GetTickCount Sleep GetLastError LocalFree LocalAlloc GetVersionExW WritePrivateProfileStringW FindResourceExW FindResourceW GetModuleHandleW GetModuleFileNameW DeviceIoControl SizeofResource LoadResource FreeLibrary LockResource GetFileAttributesExW CreateFileW CreateFileMappingW UnmapViewOfFile MapViewOfFile OutputDebugStringW LoadLibraryW DosDateTimeToFileTime LocalFileTimeToFileTime SetFilePointer ReadFile GetProcessHeap HeapSize GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue FileTimeToDosDateTime FileTimeToLocalFileTime GetSystemTime GetFileTime ReleaseMutex FindNextFileA FindFirstFileA lstrlenA lstrcmpiA lstrcmpA GetSystemWindowsDirectoryW FreeResource GetStdHandle SetEndOfFile GetFileInformationByHandle CompareFileTime FindCloseChangeNotification RtlCaptureStackBackTrace FindFirstChangeNotificationW SearchPathW SetFileTime FlushFileBuffers SetUnhandledExceptionFilter UnhandledExceptionFilter OpenFileMappingW GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetNativeSystemInfo GetExitCodeThread GetCurrentThread WaitForSingleObjectEx DuplicateHandle GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread TryEnterCriticalSection QueryPerformanceFrequency HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter GetStringTypeW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent InterlockedCompareExchange InterlockedExchange GetEnvironmentVariableW CreateDirectoryW FormatMessageW GetShortPathNameW GetSystemInfo ResetEvent HeapDestroy GetProcAddress DeleteFileA CreateFileA GetTempFileNameA GetTempPathA CreateProcessW GlobalDeleteAtom GetCurrentDirectoryW CloseHandle GetConsoleMode WriteFile

user32

BeginPaint DrawFocusRect CopyRect PtInRect ScreenToClient LoadCursorW OffsetRect SetRect SetCursor IsWindow PostMessageW GetWindowThreadProcessId FindWindowExW SetForegroundWindow IsIconic IsRectEmpty DefWindowProcW CallWindowProcW IsWindowVisible ShowWindow SendMessageW ReleaseDC GetDC KillTimer SetTimer UnregisterClassA SendNotifyMessageW SendMessageTimeoutW MessageBoxW wsprintfW IsDialogMessageW EndPaint ExitWindowsEx EndDialog DialogBoxParamW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW InvalidateRect GetClientRect GetWindowRect GetWindowLongW SetWindowLongW EnableWindow RedrawWindow GetMonitorInfoW LoadImageW GetWindow FindWindowW MapWindowPoints SetWindowTextW GetSystemMetrics MoveWindow PostQuitMessage GetParent RegisterWindowMessageW SetProcessDPIAware CharNextW BringWindowToTop DestroyWindow PeekMessageW DispatchMessageW TranslateMessage GetMessageW GetWindowTextLengthW DrawTextW UnhookWinEvent SetWinEventHook GetWindowTextW MonitorFromWindow GetShellWindow WaitForInputIdle SystemParametersInfoW SetWindowRgn SetWindowPos UpdateLayeredWindow

gdi32

SaveDC RestoreDC SetTextColor SetBkMode CreateRectRgn CombineRgn SetViewportOrgEx CreateCompatibleDC CreateCompatibleBitmap ExtTextOutW SetBkColor DeleteDC SelectObject GetTextExtentPoint32W GetDeviceCaps CreateFontIndirectW EnumFontFamiliesW DeleteObject CreateFontW BitBlt

advapi32

LockServiceDatabase RegQueryValueExA RegOpenKeyExA RegEnumKeyExA GetTokenInformation CryptContextAddRef CryptDecrypt CryptEncrypt CryptImportKey CryptGenRandom CryptSetKeyParam CryptDestroyKey RegSetValueExW RegQueryInfoKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegEnumValueW DuplicateTokenEx RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken UnlockServiceDatabase StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceLockStatusW QueryServiceConfig2W QueryServiceConfigW OpenServiceW OpenSCManagerW RegGetValueW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW CryptReleaseContext GetUserNameW AllocateAndInitializeSid FreeSid CheckTokenMembership EqualSid DeleteAce LookupAccountSidW LookupAccountNameW SetEntriesInAclW GetExplicitEntriesFromAclW GetNamedSecurityInfoW SetNamedSecurityInfoW BuildExplicitAccessWithNameW GetTrusteeNameW CryptAcquireContextW

shell32

SHFileOperationW SHGetPathFromIDListW SHCreateDirectoryExW SHGetSpecialFolderLocation ord165 SHChangeNotify ShellExecuteExW ShellExecuteW SHLoadInProc SHBrowseForFolderW CommandLineToArgvW SHGetSpecialFolderPathW SHGetDesktopFolder

ole32

CoTaskMemRealloc CoTaskMemAlloc CoInitializeSecurity CoInitializeEx CoUninitialize CoCreateGuid CoCreateInstance CoTaskMemFree OleRun CreateStreamOnHGlobal StringFromGUID2 CoInitialize CoSetProxyBlanket

oleaut32

VariantCopy CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo VariantInit SysStringLen VariantClear SysAllocStringByteLen SysStringByteLen VarUI4FromStr SysFreeString SysAllocString

shlwapi

PathIsRelativeW StrStrIA StrCmpNIW StrTrimA StrCmpIW StrToIntExW SHGetValueA PathAppendA PathFindFileNameA PathRenameExtensionA PathAppendW PathCombineW PathFileExistsW PathRemoveFileSpecW PathFindExtensionW wnsprintfW StrCmpW PathFindFileNameW SHGetValueW PathUnquoteSpacesW SHSetValueW PathIsPrefixW AssocQueryStringW PathIsRootW StrStrIW SHDeleteKeyW PathIsDirectoryW SHDeleteValueW SHSetValueA

comctl32

_TrackMouseEvent InitCommonControlsEx

gdiplus

GdipSetStringFormatFlags GdipFillRectangleI GdipCreateFont GdipGraphicsClear GdipDrawImagePointRectI GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipSetTextRenderingHint GdiplusStartup GdipDeleteFont GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageRectRect GdipDrawImageRectRectI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreateImageAttributes GdipDeleteStringFormat GdipDrawString GdiplusShutdown GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateStringFormat GdipMeasureString GdipSetStringFormatAlign

cabinet

ord22 ord23 ord20

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW EnumProcesses

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

secur32

GetUserNameExW

crypt32

CryptBinaryToStringW CertGetNameStringW CryptStringToBinaryA CryptBinaryToStringA CryptStringToBinaryW

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

generic

count=22, id=241, version=40116,

count=175, id=243, version=40116,

count=32, id=242, version=40116,

count=6, id=261, version=27031,

count=2, id=264, version=27030,

count=1, productName=Unmarked objects (old),

count=21, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=261, version=27032,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=38, id=260, version=26706,

count=136, id=261, version=26706,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=517, id=1, productName=Unmarked objects,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=102, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=256, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,

count=2, id=151,

count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,