abb310ce27c892f0307dc1526735a4b8f2d038f3c1946225351faa4067966457

Sharing

Copy URL Twitter E-mail

General

Target
abb310ce27c892f0307dc1526735a4b8f2d038f3c1946225351faa4067966457
Size 1.3MB
Sample240612-e6dpss1ckg
SHA256 abb310ce27c892f0307dc1526735a4b8f2d038f3c1946225351faa4067966457
MD5 de2771f5c185f9a342ac6f3ade5b57f0
SHA1 9fc4e0b2b2628bcba33f2c61d0480e8a34377b48
SHA512 b3725a05cf1ad5f7cb0f242d24c2678ea0a3f0d8973e51a4aa2f583b0a732c8f7cf77b9bb2d79eeb44df4c3e2df99d17a38dc8a17b6c840327948d9d56f225d8
SSDEEP 24576:Kcyvw2M/r6mEusqK01BooooEbiiIHBlPa1GJdO+eUBP1S14e4uP4NDX:KhOrzE6ooooECK1GJdO+eiP1SOe43NDX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
abb310ce27c892f0307dc1526735a4b8f2d038f3c1946225351faa4067966457

File Explorer

abb310ce27c892f0307dc1526735a4b8f2d038f3c1946225351faa4067966457

.exe 1.3MB

abb310ce27c892f0307dc1526735a4b8f2d038f3c1946225351faa4067966457

IMPHASH 46c8dee621ff737948aafe8f34fa5716
SHA256 abb310ce27c892f0307dc1526735a4b8f2d038f3c1946225351faa4067966457
MD5 de2771f5c185f9a342ac6f3ade5b57f0
SHA1 9fc4e0b2b2628bcba33f2c61d0480e8a34377b48
SHA512 b3725a05cf1ad5f7cb0f242d24c2678ea0a3f0d8973e51a4aa2f583b0a732c8f7cf77b9bb2d79eeb44df4c3e2df99d17a38dc8a17b6c840327948d9d56f225d8
SSDEEP 24576:Kcyvw2M/r6mEusqK01BooooEbiiIHBlPa1GJdO+eUBP1S14e4uP4NDX:KhOrzE6ooooECK1GJdO+eiP1SOe43NDX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

308816

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_sfx.pdb

shell32

SHGetFolderPathW

ntdll

RtlNtStatusToDosError VerSetConditionMask RtlUnwind

kernel32

CreateProcessW WaitForSingleObject GetExitCodeProcess VerifyVersionInfoW GetPriorityClass GetProcessTimes K32GetProcessMemoryInfo CreateEventW SetEvent ResetEvent CreateSemaphoreW ReleaseSemaphore GetSystemInfo GetVersionExW QueryPerformanceCounter ExpandEnvironmentStringsW GetModuleFileNameW GetFileAttributesW LoadLibraryExW GetWindowsDirectoryW GetSystemDirectoryW DeviceIoControl VirtualAlloc VirtualFree VirtualProtect HeapDestroy HeapReAlloc GlobalMemoryStatusEx WaitForMultipleObjects TerminateThread GetExitCodeThread TlsFree SetFilePointer SetEndOfFile MoveFileExW LockFileEx CreateFileMappingW MapViewOfFile UnmapViewOfFile GetFileAttributesExW FindFirstFileW FindClose CreateDirectoryW RemoveDirectoryW FindFirstFileExW FindNextFileW QueryDosDeviceW GetEnvironmentVariableW WriteConsoleW K32GetMappedFileNameW CopyFileW SetFileInformationByHandle GetFileSizeEx GetDiskFreeSpaceExW FindResourceW LoadResource LockResource SizeofResource GetVolumePathNameW GetVolumeNameForVolumeMountPointW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose VirtualQuery GetSystemTimes SetFilePointerEx GetTickCount64 RaiseException GetConsoleOutputCP GetStdHandle GetCommandLineA GetFileType SetStdHandle FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList OutputDebugStringW K32GetProcessImageFileNameW OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot UpdateProcThreadAttribute DeleteProcThreadAttributeList InitializeProcThreadAttributeList FreeLibrary LocalFree TlsSetValue TlsGetValue TlsAlloc GetCurrentProcessId ReadConsoleW GetSystemTimeAsFileTime FileTimeToSystemTime OutputDebugStringA GetFullPathNameW ReadFile GetFileInformationByHandle DeleteFileW LeaveCriticalSection EnterCriticalSection FlushFileBuffers GetLastError WriteFile CreateFileW SetLastError Sleep DeleteCriticalSection InitializeCriticalSection CompareStringW GetModuleHandleW GetProcessHeap GetProcAddress HeapAlloc GetCurrentThreadId GetModuleHandleExW HeapFree GetUserDefaultUILanguage GetCommandLineW GetCurrentProcess InitializeCriticalSectionEx WideCharToMultiByte MultiByteToWideChar CloseHandle GetConsoleMode LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetFileAttributesW UnlockFileEx FindResourceExW HeapSize GetVersion GlobalUnlock GlobalLock GlobalAlloc CreateThread GetStartupInfoW IsDebuggerPresent InitializeSListHead TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount LoadLibraryExA HeapSetInformation IsProcessorFeaturePresent ExitProcess lstrcpyW SetDllDirectoryW GlobalFree GetTimeZoneInformation LoadLibraryW GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx WaitForSingleObjectEx LCMapStringEx EncodePointer DecodePointer GetCPInfo

user32

MessageBoxW PostMessageW GetSystemMetrics CharLowerW SetWindowLongW GetWindowLongW DefWindowProcW SystemParametersInfoW LoadImageW CreateWindowExW SendMessageW SetWindowPos SetFocus DestroyWindow PostQuitMessage DestroyIcon GetDC ReleaseDC GetMessageW IsDialogMessageW TranslateMessage DispatchMessageW LoadIconW EndPaint BeginPaint InvalidateRect UpdateWindow RegisterWindowMessageW KillTimer DrawTextW SetTimer MoveWindow LoadCursorW IsWindow ShowWindow SetWindowTextW UnregisterClassW GetClassInfoExW RegisterClassExW

advapi32

GetTokenInformation IsValidSid GetSidSubAuthority GetSidSubAuthorityCount DuplicateTokenEx CryptReleaseContext CryptGenRandom CryptAcquireContextW RegCloseKey RegQueryValueExW RegOpenKeyExW LookupAccountSidW ConvertStringSecurityDescriptorToSecurityDescriptorW CreateProcessAsUserW OpenProcessToken

comctl32

ord17

gdiplus

GdipGetImageWidth GdipGetImageHeight GdipLoadImageFromStream GdipGetPropertyItemSize GdipDeleteGraphics GdipImageGetFrameCount GdipCreateFromHDC GdipImageGetFrameDimensionsList GdiplusStartup GdiplusShutdown GdipImageGetFrameDimensionsCount GdipCloneImage GdipImageSelectActiveFrame GdipFree GdipDisposeImage GdipDrawImageRectI GdipAlloc GdipGetPropertyItem

shlwapi

PathMatchSpecW

gdi32

SelectObject DeleteObject GetTextExtentPoint32W SetBkMode SetTextColor DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateFontIndirectW

ole32

CoCreateInstance CreateStreamOnHGlobal

Name

.text

Size

909KB

Virtual Size

909KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

194KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=17, id=259, version=29395,

count=190, id=261, version=29395,

count=2, id=253, version=31823,

count=19, id=260, version=31823,

count=24, id=259, version=31823,

count=97, id=261, version=31823,

count=25, id=260, version=29395,

count=5, id=260, productName=VS2019 v16.4.0 build 28314, version=28314,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=261, version=30146,

count=1, id=261, productName=VS2019 v16.10.3 build 30038, version=30038,

count=6, productName=Unmarked objects (old),

count=1, id=263, version=29395,

count=19, id=257, version=29395,

count=430, id=1, productName=Unmarked objects,

count=146, id=265, version=31937,

count=1, id=256, version=31937,

count=1, id=255, version=31937,

count=3, id=151,

count=1, id=258, version=31937,