ebc3a274210b8d24a55d6fe265c20c0130e1567199dc678f982eab507a37c66e

Sharing

Copy URL Twitter E-mail

General

Target
ebc3a274210b8d24a55d6fe265c20c0130e1567199dc678f982eab507a37c66e
Size 3.3MB
Sample240612-3vdgnazbll
SHA256 ebc3a274210b8d24a55d6fe265c20c0130e1567199dc678f982eab507a37c66e
MD5 0ccc51ea80acef0c1a0cc27338b87c9f
SHA1 613205496ecc9c7d91cc4d9457e9507a6e50fce4
SHA512 0b507da5d92b494c86659fa93d8e78b586dd5462486321820f58287f432c2547caf6f44a0c12ee3307f3dc916d9dc99506c2a9e4702549d38d79ddfbc98dfe39
SSDEEP 98304:iA4wLgc2mK8yXeqhQWNq7Nff6tA/usauUt:ijwLRyOaaW7t
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebc3a274210b8d24a55d6fe265c20c0130e1567199dc678f982eab507a37c66e

File Explorer

ebc3a274210b8d24a55d6fe265c20c0130e1567199dc678f982eab507a37c66e

.exe 3.3MB

ebc3a274210b8d24a55d6fe265c20c0130e1567199dc678f982eab507a37c66e

IMPHASH e4a30d6720cea657b57ca6feec67f579
SHA256 ebc3a274210b8d24a55d6fe265c20c0130e1567199dc678f982eab507a37c66e
MD5 0ccc51ea80acef0c1a0cc27338b87c9f
SHA1 613205496ecc9c7d91cc4d9457e9507a6e50fce4
SHA512 0b507da5d92b494c86659fa93d8e78b586dd5462486321820f58287f432c2547caf6f44a0c12ee3307f3dc916d9dc99506c2a9e4702549d38d79ddfbc98dfe39
SSDEEP 98304:iA4wLgc2mK8yXeqhQWNq7Nff6tA/usauUt:ijwLRyOaaW7t
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1893282

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Landun\workspace\CommonComponent\ACE-Guard\1.compile_source\output\Win32\Release\SGuardUpdate32.pdb

iphlpapi

GetAdaptersInfo

shlwapi

PathFindFileNameW PathFindFileNameA PathFileExistsW PathAppendW PathRemoveFileSpecW

ws2_32

accept WSAIoctl WSAStartup getaddrinfo WSACleanup WSAGetLastError ioctlsocket sendto recv recvfrom connect socket send closesocket select WSASetLastError freeaddrinfo htons htonl listen gethostname shutdown gethostbyname getservbyname __WSAFDIsSet bind getpeername getsockname getsockopt ntohs setsockopt

wldap32

ord33 ord22 ord79 ord32 ord27 ord26 ord200 ord30 ord41 ord50 ord60 ord211 ord301 ord46 ord217 ord143 ord35

crypt32

CertFreeCertificateContext CertCloseStore CertFindCertificateInStore CertOpenStore CertEnumCertificatesInStore CertDuplicateCertificateContext CertGetCertificateContextProperty

kernel32

UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead GetStringTypeW TlsAlloc TlsGetValue TlsSetValue TlsFree GetCPInfo GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateThread ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler GetConsoleMode ReadConsoleInputA SetConsoleMode ExitProcess GetACP ReadConsoleW GetConsoleCP GetCurrentThread IsValidLocale GetCurrentDirectoryW SetStdHandle FindFirstFileExW IsValidCodePage CreateFileW GetFileAttributesW AreFileApisANSI CloseHandle RaiseException GetLastError SetLastError HeapAlloc HeapReAlloc HeapFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent ReleaseMutex WaitForSingleObject WaitForSingleObjectEx CreateMutexA CreateMutexW CreateEventW Sleep TerminateProcess GetCurrentThreadId GetThreadTimes GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW GetNativeSystemInfo GetOEMCP CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW LocalAlloc LocalFree CreateFileMappingA GetTimeZoneInformation CompareStringW MultiByteToWideChar WideCharToMultiByte LCMapStringW GetLocaleInfoW GetUserDefaultLCID EnumSystemLocalesW InterlockedExchange InterlockedCompareExchange HeapSize HeapDestroy DeleteCriticalSection GetCurrentProcessId GetProcessHeap GetModuleHandleW InterlockedIncrement CreateDirectoryW FindFirstFileW FindNextFileW FindClose DeleteFileW OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetExitCodeProcess GetCommandLineA GetCommandLineW SetCurrentDirectoryW CopyFileW MoveFileW GetFileSize GetModuleHandleExW ExpandEnvironmentStringsW RemoveDirectoryW OpenEventW VerSetConditionMask VerifyVersionInfoW GetFileSizeEx SystemTimeToFileTime GetCurrentProcess GetModuleFileNameA Module32FirstW Module32NextW SetUnhandledExceptionFilter ReadFile WriteFile SetFilePointerEx GetSystemTime InitializeCriticalSection SleepEx LoadLibraryA GetModuleHandleA GetSystemDirectoryA QueryPerformanceFrequency VerifyVersionInfoA QueryPerformanceCounter ExpandEnvironmentStringsA WaitForMultipleObjects GetFileType GetStdHandle PeekNamedPipe FormatMessageA FlushConsoleInputBuffer GlobalMemoryStatus TryEnterCriticalSection HeapCreate GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW HeapValidate GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA DeleteFileA HeapCompact UnlockFile LockFileEx FlushFileBuffers GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW

user32

wsprintfW GetProcessWindowStation GetUserObjectInformationW MessageBoxA

advapi32

GetTokenInformation QueryServiceStatus CreateServiceW DeregisterEventSource RegCloseKey RegOpenKeyExW RegQueryValueExW RegisterEventSourceA ReportEventA CryptAcquireContextA CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashA CryptEnumProvidersA QueryServiceStatusEx OpenServiceW QueryServiceConfigA OpenSCManagerW CloseServiceHandle InitializeSecurityDescriptor FreeSid OpenProcessToken SetEntriesInAclW AllocateAndInitializeSid SetFileSecurityW SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW QueryServiceConfigW StartServiceW ControlService SetServiceObjectSecurity DeleteService ChangeServiceConfig2W

shell32

ShellExecuteExW

ntdll

RtlUnwind

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

578KB

Virtual Size

577KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

74KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

760B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

640KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

70KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

ebc3a274210b8d24a55d6fe265c20c0130e1567199dc678f982eab507a37c66e

iphlpapi

shlwapi

ws2_32

wldap32

crypt32

kernel32

user32

advapi32

shell32

ntdll

generic