bae5fe142c644c51f6a42f4fd42731a9cf76aa5a26e7fb4238926bc26151f06a

Sharing

Copy URL Twitter E-mail

General

Target
bae5fe142c644c51f6a42f4fd42731a9cf76aa5a26e7fb4238926bc26151f06a
Size 4.8MB
Sample240612-t4vb4a1hmd
SHA256 bae5fe142c644c51f6a42f4fd42731a9cf76aa5a26e7fb4238926bc26151f06a
MD5 21a7016589be75741008e2024741aa03
SHA1 775bf745221cb0a161eb136c59ef23f6b8a7ab51
SHA512 d17b15d710aef926a43b0b207743a37004a5b2c35109dab1b54524e4f95951ad28823460898f51c5b2bb5b4ec4d5709c959b1e3556a589f163b3a4f6c0f285ba
SSDEEP 98304:GmhCP6iL6YbmkRcKkAUArR7FVqwzlOfVH5WIZBzO8PFIe:GbzbLfUYRRVAtZBO8PFIe
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bae5fe142c644c51f6a42f4fd42731a9cf76aa5a26e7fb4238926bc26151f06a

File Explorer

bae5fe142c644c51f6a42f4fd42731a9cf76aa5a26e7fb4238926bc26151f06a

.exe 4.8MB

bae5fe142c644c51f6a42f4fd42731a9cf76aa5a26e7fb4238926bc26151f06a

IMPHASH ed7fed570c4f1b0dd3cd1f6afb5b0498
SHA256 bae5fe142c644c51f6a42f4fd42731a9cf76aa5a26e7fb4238926bc26151f06a
MD5 21a7016589be75741008e2024741aa03
SHA1 775bf745221cb0a161eb136c59ef23f6b8a7ab51
SHA512 d17b15d710aef926a43b0b207743a37004a5b2c35109dab1b54524e4f95951ad28823460898f51c5b2bb5b4ec4d5709c959b1e3556a589f163b3a4f6c0f285ba
SSDEEP 98304:GmhCP6iL6YbmkRcKkAUArR7FVqwzlOfVH5WIZBzO8PFIe:GbzbLfUYRRVAtZBO8PFIe
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2138658

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Magictray\MagicTray\Bin\Release\mytime.pdb

kernel32

CreateMutexW CreateProcessW GetStartupInfoW GetCommandLineW GetDriveTypeW GetSystemDirectoryW GetTempPathW GetWindowsDirectoryW GetDiskFreeSpaceExW SetFileAttributesW DeleteFileW CopyFileW MoveFileW MoveFileExW WaitNamedPipeW IsBadReadPtr IsBadCodePtr GetTickCount FileTimeToSystemTime GetTimeZoneInformation TzSpecificLocalTimeToSystemTime SystemTimeToTzSpecificLocalTime GetSystemInfo SetLocalTime GetLocalTime GetSystemTime DeviceIoControl FlushFileBuffers GetLogicalDrives Sleep EnterCriticalSection SetLastError GetCurrentThreadId CreateThread SetUnhandledExceptionFilter TerminateProcess GetCurrentProcessId SetProcessWorkingSetSize VirtualProtect LocalFree GlobalMemoryStatusEx GlobalFree GlobalUnlock GlobalLock GlobalAlloc FreeResource InterlockedDecrement InterlockedIncrement EndUpdateResourceW UpdateResourceW BeginUpdateResourceW BeginUpdateResourceA LoadLibraryExW LoadLibraryExA FreeLibrary Module32NextW Module32FirstW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetVersionExW LoadLibraryW lstrlenW lstrlenA WaitForSingleObject WriteProcessMemory CreateRemoteThread OpenProcess VirtualFreeEx VirtualAllocEx FindNextFileW FindFirstFileW GetFileAttributesW CreateFileW CreateDirectoryW DosDateTimeToFileTime FileTimeToDosDateTime LocalFileTimeToFileTime FileTimeToLocalFileTime CloseHandle SetFileTime GetFileTime FindClose ReadFile WriteFile GetFileSizeEx GetFileSize WideCharToMultiByte MultiByteToWideChar InitializeCriticalSectionAndSpinCount GetLastError DecodePointer GetFullPathNameW lstrcpyW FindResourceW GetModuleHandleW GetModuleFileNameW SizeofResource LoadResource DeleteCriticalSection LeaveCriticalSection InitializeCriticalSection RaiseException GetCurrentProcess GetProcessHeap HeapSize HeapFree SetEndOfFile GetCurrentDirectoryW SetCurrentDirectoryW WriteConsoleW SetStdHandle OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler HeapQueryInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP SetFilePointerEx ReadConsoleW GetConsoleMode LockResource GetFileType GetACP GetStdHandle GetModuleFileNameA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread GetFullPathNameA InterlockedFlushSList RtlUnwind CreateFileA SetFilePointer UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent GetUserDefaultUILanguage lstrcmpW IsBadStringPtrW MulDiv SetEvent TerminateThread GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW HeapReAlloc HeapAlloc HeapDestroy GetProcAddress GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW FormatMessageW VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent GetThreadTimes GetCurrentThread QueryPerformanceFrequency QueryPerformanceCounter VirtualQuery FindResourceExW lstrcmpiW

gdi32

ExtSelectClipRgn SelectClipRgn RoundRect Rectangle LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateRectRgnIndirect CreateRectRgn CreatePen CombineRgn SetStretchBltMode SetBkColor GetBitmapBits CreateCompatibleBitmap CreatePatternBrush CreateSolidBrush PtInRegion OffsetRgn SetWindowOrgEx SaveDC RestoreDC CreateRoundRectRgn DeleteObject GetTextMetricsW SetDIBColorTable SelectObject CreateDIBSection CreateCompatibleDC CreateDCW StretchBlt GdiFlush TextOutW SetBitmapBits MoveToEx GetObjectW GetObjectA SetTextColor SetBkMode SelectPalette RealizePalette GetStockObject GetDIBits GetDeviceCaps DeleteDC CreateFontIndirectW BitBlt

comdlg32

GetSaveFileNameW ChooseFontW ChooseColorW GetOpenFileNameW

advapi32

FreeSid OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation SetTokenInformation AllocateAndInitializeSid GetLengthSid GetUserNameW CreateProcessAsUserW DuplicateTokenEx RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegFlushKey RegOpenKeyExW RegQueryValueExW RegSetValueExW ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle CreateServiceW OpenSCManagerW OpenServiceW StartServiceW SetEntriesInAclW SetNamedSecurityInfoW ConvertStringSidToSidW CryptGenRandom CryptReleaseContext CryptAcquireContextA

shell32

ShellExecuteExW CommandLineToArgvW SHFileOperationW SHCreateDirectoryExW SHGetFolderPathW ShellExecuteW

ole32

CreateILockBytesOnHGlobal ReleaseStgMedium OleDuplicateData OleSetContainedObject OleCreateStaticFromData StgCreateDocfileOnILockBytes StgCreateDocfile OleUninitialize OleInitialize CoInitialize CoUninitialize CoSetProxyBlanket CoCreateInstance CLSIDFromString CLSIDFromProgID OleRun CreateStreamOnHGlobal OleLockRunning

oleaut32

SysFreeString VariantCopy VariantChangeType CreateErrorInfo VarUdateFromDate VariantInit VariantTimeToSystemTime SetErrorInfo GetErrorInfo SystemTimeToVariantTime SysAllocStringByteLen SysStringByteLen SysAllocString VariantClear

shlwapi

PathFindFileNameW PathFindExtensionW PathAppendW PathFileExistsW

gdiplus

GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipCreateHBITMAPFromBitmap GdipGetFontSize GdipCreateBitmapFromScan0 GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipSaveImageToStream GdipSaveImageToFile GdipDisposeImage GdipCloneImage GdipLoadImageFromFileICM GdipLoadImageFromFile GdipSetPenWidth GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipGetPathWorldBounds GdipAddPathString GdipDeletePath GdipTranslateWorldTransform GdipFree GdipAlloc GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipSetStringFormatHotkeyPrefix GdipRotateWorldTransform GdipDrawLineI GdipDrawLinesI GdipFillRectangleI GdipFillEllipseI GdipDrawImageRectI GdipDrawImageRectRectI GdipDrawPath GdipDrawRectangleI GdipSetImageAttributesColorKeys GdipSetPenDashStyle GdipAddPathArcI GdipAddPathLineI GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipGetImageEncodersSize GdipGetImageEncoders GdipDeleteFontFamily GdipCreateFontFromDC GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdiplusShutdown GdiplusStartup GdipSaveGraphics GdipDrawImageI GdipGraphicsClear GdipSetImageAttributesWrapMode GdipSetImageAttributesColorMatrix GdipDeleteFont GdipCreateFontFromLogfontA GdipGetFamily GdipCreatePath GdipGetFontStyle GdipCreateBitmapFromHBITMAP GdipGetImagePalette GdipGetImagePaletteSize GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateImageAttributes GdipDisposeImageAttributes GdipReleaseDC

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

urlmon

URLDownloadToFileW

wininet

InternetCloseHandle InternetOpenW InternetSetOptionW HttpOpenRequestA InternetConnectW InternetQueryOptionW InternetOpenUrlW InternetReadFile HttpOpenRequestW HttpSendRequestA HttpSendRequestExW HttpEndRequestW HttpQueryInfoW InternetWriteFile InternetConnectA HttpAddRequestHeadersA

iphlpapi

GetAdaptersInfo

winmm

sndPlaySoundW mciSendStringW

powrprof

SetSuspendState

sensapi

IsNetworkAlive

dbghelp

MiniDumpWriteDump

ws2_32

sendto htonl htons inet_addr ntohl recvfrom setsockopt socket WSAStartup WSACleanup

comctl32

_TrackMouseEvent ord17

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

660KB

Virtual Size

660KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

61KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

13B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7.8MB

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=27, id=241, version=40116,

count=182, id=243, version=40116,

count=33, id=242, version=40116,

count=21, id=264, version=24215,

count=2, id=199, version=41118,

count=25, id=259, version=24123,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=36, id=260, version=24123,

count=3, id=261, version=23013,

count=74, id=261, version=24123,

count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=597, id=1, productName=Unmarked objects,

count=90, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,