4da2e14ac63d77b1d3acbe96b9faf7039ba5dcac9e405fd953f3f7c594df254b

Sharing

Copy URL

Twitter E-mail

General

Target

4da2e14ac63d77b1d3acbe96b9faf7039ba5dcac9e405fd953f3f7c594df254b
Size

211KB
MD5

6f62339690231b707cfc20c653791b27
SHA1

e4ab2c0d33b560111afcf2b3c649c0036488aad1
SHA256

4da2e14ac63d77b1d3acbe96b9faf7039ba5dcac9e405fd953f3f7c594df254b
SHA512

72d5ba3f4f36f45674809000c0f3c18d0002f45b5cadd33db038f3768a489daaa7b28c466433de6f35c67ec7843d367f58a75799ec0d74db05640f5329f051ea
SSDEEP

3072:oliU7zPz2GnvcYMMPmuipHYhxZKKR4CIZOIZNLUCFiom:olXPz2Gd7P2itKpHiom

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4da2e14ac63d77b1d3acbe96b9faf7039ba5dcac9e405fd953f3f7c594df254b

Files

4da2e14ac63d77b1d3acbe96b9faf7039ba5dcac9e405fd953f3f7c594df254b
.exe windows:5 windows x86 arch:x86

690b9eede0620c9f716451d8e6a6ce1f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Tools\jenkins_home\workspace\PCTouch_Production\pospal-pos-pctouch\PospalBasePlatform\Release\InstallPackageGuard.pdb

Imports

kernel32

GetLastError
CreateMutexW
OpenProcess
WaitForSingleObject
GetExitCodeProcess
MoveFileW
CloseHandle
LocalFree
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetFileAttributesW
DeleteFileW
GetProcAddress
GetModuleHandleW
GetCurrentProcess
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
EnterCriticalSection
WriteFile
GetPrivateProfileIntW
InterlockedDecrement
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
CreateFileW
GetCurrentThreadId
RaiseException
GetLocalTime
DecodePointer
DeleteCriticalSection
GetCurrentProcessId
WideCharToMultiByte
InterlockedIncrement
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetStringTypeW
SetStdHandle
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
SetLastError
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
GetACP
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW

shell32

CommandLineToArgvW
SHFileOperationW

Exports

Exports

Initialize
_Initialize@0

Sections

.text
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

690b9eede0620c9f716451d8e6a6ce1f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

Exports

Exports

Sections

.text Size: 79KB - Virtual size: 79KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 2KB - Virtual size: 5KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 512B - Virtual size: 248B

.rsrc Size: 92KB - Virtual size: 91KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 79KB - Virtual size: 79KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 2KB - Virtual size: 5KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 248B

.rsrc
Size: 92KB - Virtual size: 91KB

.reloc
Size: 5KB - Virtual size: 4KB