d9b0c8df38014e2415fa1a95dd4256f98f21dc8042b4c8816465bc80d352ec43

Sharing

Copy URL Twitter E-mail

General

Target
d9b0c8df38014e2415fa1a95dd4256f98f21dc8042b4c8816465bc80d352ec43
Size 4.8MB
Sample240617-ajtqaavfjc
SHA256 d9b0c8df38014e2415fa1a95dd4256f98f21dc8042b4c8816465bc80d352ec43
MD5 769cea094e2e5f1bb0392870c0b5b1c7
SHA1 957eb1821cd3d73b3df274da5755246fe523429d
SHA512 98abc5437bc519657618eb70771fe098b8af8e26acf359cb27123371de5f067afcff31b60301698f667d040b86db1b7589c2cd307ba2720a138758ff4cf9c716
SSDEEP 98304:seLpmrmc2lAu28lkcf5YjovKqGYiOE8oLj5YINfSyo8aXW:TcmZl85gyjovK65E8ob5Sx8aXW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9b0c8df38014e2415fa1a95dd4256f98f21dc8042b4c8816465bc80d352ec43

File Explorer

d9b0c8df38014e2415fa1a95dd4256f98f21dc8042b4c8816465bc80d352ec43

.exe 4.8MB

d9b0c8df38014e2415fa1a95dd4256f98f21dc8042b4c8816465bc80d352ec43

IMPHASH c8f585918987a310f6428f02fe881c59
SHA256 d9b0c8df38014e2415fa1a95dd4256f98f21dc8042b4c8816465bc80d352ec43
MD5 769cea094e2e5f1bb0392870c0b5b1c7
SHA1 957eb1821cd3d73b3df274da5755246fe523429d
SHA512 98abc5437bc519657618eb70771fe098b8af8e26acf359cb27123371de5f067afcff31b60301698f667d040b86db1b7589c2cd307ba2720a138758ff4cf9c716
SSDEEP 98304:seLpmrmc2lAu28lkcf5YjovKqGYiOE8oLj5YINfSyo8aXW:TcmZl85gyjovK65E8ob5Sx8aXW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

182709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\gamemaster\installanduninstall\Inst\Install_Exe.pdb

kernel32

SizeofResource ReadFile FindClose CloseHandle MulDiv GetSystemTime CreatePipe PeekNamedPipe lstrcmpW lstrcmpiW lstrcpynW lstrlenA lstrlenW CreateMutexW LoadLibraryW LoadLibraryExW GetModuleFileNameW GetModuleHandleW CreateProcessW GetStartupInfoW FindResourceW FindResourceExW GetSystemDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetVersionExW MultiByteToWideChar WideCharToMultiByte LocalFree GetCommandLineW GetWindowsDirectoryW WritePrivateProfileStringW IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetFileSize WriteFile FlushFileBuffers CreateFileW DeviceIoControl lstrcmpA lstrcmpiA CreateFileA RtlUnwind TlsAlloc TlsGetValue TlsSetValue LeaveCriticalSection CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetACP Sleep GetFileType LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WaitForSingleObjectEx SetStdHandle GetConsoleCP GetConsoleMode SetFilePointerEx ReadConsoleW WriteConsoleW InterlockedCompareExchange GetPrivateProfileStringW LocalAlloc GetSystemInfo ResetEvent CreateDirectoryW GetTempFileNameW FormatMessageW GlobalAddAtomW TerminateThread CopyFileW ReleaseMutex GetExitCodeProcess GetFileAttributesExW CreateFileMappingW UnmapViewOfFile MapViewOfFile SetFilePointer WaitForMultipleObjects GetExitCodeThread MoveFileW GetLocalTime GetFileSizeEx GlobalFree MoveFileExW GetFileAttributesW SetFileAttributesW GetTickCount GetFullPathNameW RemoveDirectoryW GetDiskFreeSpaceExW GetTempPathW GetDriveTypeW GetLogicalDriveStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalFindAtomW GlobalDeleteAtom OpenProcess GetLongPathNameW CreateEventW SetEvent LoadResource GetStringTypeW EnterCriticalSection InitializeCriticalSection SetErrorMode SetLastError GetCurrentThreadId GetCurrentProcess GlobalMemoryStatusEx GlobalUnlock GlobalLock GlobalAlloc GetProcAddress FreeLibrary LockResource InterlockedDecrement InterlockedIncrement FreeResource GetSystemWindowsDirectoryW SetEndOfFile SetFileTime WaitForSingleObject GetFileInformationByHandle GetModuleHandleA InterlockedExchange DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError DecodePointer RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy TlsFree

user32

MonitorFromWindow LoadImageW PtInRect GetCursorPos MonitorFromPoint DialogBoxParamW CopyRect EndDialog LoadCursorW TrackPopupMenu AppendMenuW DestroyMenu GetSystemMetrics KillTimer SetTimer IsIconic UnregisterClassW ShowWindowAsync CharUpperW SetWindowLongW GetDesktopWindow GetParent FindWindowW GetClassNameW CreatePopupMenu GetWindow MessageBoxW UnhookWinEvent SetWinEventHook SystemParametersInfoW SetCursor OffsetRect SetWindowRgn UpdateLayeredWindow SetRect GetMonitorInfoW UpdateWindow PostQuitMessage IsRectEmpty WaitForInputIdle SendMessageTimeoutW GetWindowThreadProcessId FindWindowExW PostThreadMessageW wsprintfW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageW GetWindowLongW FillRect GetSysColor MapWindowPoints ScreenToClient ClientToScreen GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharNextW GetDlgItem BringWindowToTop IsWindowVisible SetWindowPos MoveWindow ShowWindow DestroyWindow IsChild IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW PostMessageW

shlwapi

PathFindExtensionW StrToInt64ExW wvnsprintfW PathIsDirectoryW wnsprintfW SHStrDupW PathAppendW PathStripToRootW PathFindFileNameW PathIsPrefixW StrToIntW StrCmpIW StrStrIA StrTrimA StrCmpNIW PathFileExistsW PathCombineW PathRemoveFileSpecW SHDeleteValueW SHGetValueA SHGetValueW SHSetValueW StrStrIW wnsprintfA SHDeleteKeyW PathRelativePathToW PathIsRelativeW StrCmpW SHSetValueA

comctl32

_TrackMouseEvent InitCommonControlsEx

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipDrawImageRectRectI GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipCreateBitmapFromStream GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateBitmapFromStreamICM GdipSetTextRenderingHint GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateSolidFill GdipDeleteBrush GdipDrawImagePointRectI GdipCreateFontFamilyFromName GdipDrawImageRectRect GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromFile

gdi32

CreateRectRgn EnumFontFamiliesW CreateFontW ExtTextOutW CombineRgn SetTextColor SetBkMode SetBkColor GetCurrentObject CreateFontIndirectW BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteObject GetDeviceCaps GetStockObject SelectObject GetObjectW RestoreDC SaveDC DeleteDC SetViewportOrgEx

advapi32

GetUserNameW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegDeleteKeyW GetTokenInformation GetTrusteeNameW BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW GetExplicitEntriesFromAclW SetEntriesInAclW LookupAccountNameW LookupAccountSidW DeleteAce EqualSid LookupPrivilegeValueW RegEnumKeyExW RegDeleteValueW OpenProcessToken AdjustTokenPrivileges

shell32

SHLoadInProc ShellExecuteExW ord75 SHFileOperationW ShellExecuteW ord165 SHChangeNotify CommandLineToArgvW Shell_NotifyIconW SHGetPathFromIDListW SHBrowseForFolderW SHCreateDirectoryExW SHGetSpecialFolderPathW ord680

ole32

CoCreateGuid CoInitialize CoUninitialize CoGetClassObject CoSetProxyBlanket CreateStreamOnHGlobal OleLockRunning OleUninitialize OleInitialize PropVariantClear CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CLSIDFromString CoCreateInstance OleRun

oleaut32

SysStringByteLen SysAllocStringByteLen OleCreateFontIndirect LoadRegTypeLi LoadTypeLi VarUI4FromStr VariantClear VariantInit SysStringLen SysFreeString SysAllocStringLen SysAllocString

urlmon

URLDownloadToCacheFileW

psapi

GetModuleFileNameExW EnumProcesses

winhttp

WinHttpOpenRequest WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpSetCredentials WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders

iphlpapi

GetAdaptersInfo

setupapi

SetupIterateCabinetW

generic

count=17, id=241, version=40116,

count=161, id=243, version=40116,

count=30, id=242, version=40116,

count=2, id=264, version=27030,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=5, id=261, version=27032,

count=3, id=199, version=41118,

count=23, id=259, version=26706,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=77, id=261, version=26706,

count=35, id=260, version=26706,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=487, id=1, productName=Unmarked objects,

count=79, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,