aed1c41650123ecdd4ea2dfa0e227a564d49ba8e00f2dd972c96a0b7d2952587

Sharing

Copy URL Twitter E-mail

General

Target

aed1c41650123ecdd4ea2dfa0e227a564d49ba8e00f2dd972c96a0b7d2952587
Size

1.6MB
MD5

e2e95f6edb5589696ee06d1754b113a0
SHA1

0adc13a4df905ff2f8d6bdd260943350b384eb09
SHA256

aed1c41650123ecdd4ea2dfa0e227a564d49ba8e00f2dd972c96a0b7d2952587
SHA512

ea10a7323bacbeaa6393ceacce172f3b6f1d793194ccd0b953718a5befc03adb0f7b234c9b42dd8baa9c1b09360b46bd2694667e6b0404fe679a8cad270d7001
SSDEEP

24576:HpAgq8HmTj6sAESQXO2yROr5jDBM/cTKcdG2u:JAgqTvSbvROrhDBUcTddG2u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aed1c41650123ecdd4ea2dfa0e227a564d49ba8e00f2dd972c96a0b7d2952587

Files

aed1c41650123ecdd4ea2dfa0e227a564d49ba8e00f2dd972c96a0b7d2952587
.exe windows:6 windows x86 arch:x86

ea92b11ecc74c5753779da72b1599805

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Jenkins\.jenkins\workspace\group_clean\desktop_quick\desktop_quick\Release\desktop_quick_ui.pdb

Imports

kernel32

ReleaseSemaphore
GetExitCodeProcess
GetPrivateProfileStringW
FindCloseChangeNotification
FindFirstChangeNotificationW
UnregisterWaitEx
RegisterWaitForSingleObject
GlobalAddAtomW
GlobalFindAtomW
SetEvent
SetLastError
CreateDirectoryW
GetCommandLineW
IsBadReadPtr
GetModuleHandleW
GetModuleFileNameW
FindResourceExW
VirtualProtect
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
HeapSetInformation
SetErrorMode
SetUnhandledExceptionFilter
CloseHandle
MultiByteToWideChar
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetProcAddress
FreeLibrary
GlobalMemoryStatusEx
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
CreateFileA
GetSystemDirectoryW
lstrcmpiA
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetStdHandle
RaiseException
DecodePointer
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
GetFileType
GetConsoleMode
GetConsoleOutputCP
ExitProcess
ExitThread
RtlUnwind
QueryDepthSList
InterlockedFlushSList
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
lstrcmpA
DeviceIoControl
GetSystemWindowsDirectoryW
GetLogicalDrives
GetFileAttributesExW
GetFileAttributesW
GetDriveTypeW
GetDiskFreeSpaceExW
FindNextFileW
FreeResource
CreateSemaphoreW
WaitForMultipleObjectsEx
FindFirstFileW
FindClose
WaitNamedPipeW
CopyFileW
WritePrivateProfileStringW
WideCharToMultiByte
GetStringTypeW
FormatMessageW
EncodePointer
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentThread
GetNativeSystemInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
LocalFree
TerminateProcess
CreateThread
SetThreadPriority
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ResumeThread
IsDebuggerPresent
ReleaseMutex
GetFileSizeEx
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFilePointerEx
CreateMutexW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
CreateProcessW
OutputDebugStringA
CreateFileW
DeleteFileW
GetVersionExW
AssignProcessToJobObject
OutputDebugStringW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
UnhandledExceptionFilter
GetStartupInfoW
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
InterlockedIncrement
InterlockedDecrement
MapViewOfFileEx
lstrcmpiW

user32

PostMessageW
CallWindowProcW
ShowWindow
DestroyWindow
GetSystemMetrics
DefWindowProcW
SetWindowLongW
MonitorFromWindow
GetIconInfo
PostQuitMessage
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
DestroyIcon
FindWindowExW
SendMessageW
UnregisterClassW
OpenClipboard
CloseClipboard
RegisterWindowMessageW
FindWindowW
ReleaseDC
TranslateMessage
DispatchMessageW
PeekMessageW
WaitMessage
CallMsgFilterW
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
wsprintfW
LoadCursorW
CharNextW
GetDC
EmptyClipboard
GetWindowLongW
SendMessageTimeoutW
SystemParametersInfoW
UnregisterHotKey
RegisterHotKey
SetClipboardData

gdi32

GetDeviceCaps
DeleteObject
GetObjectW

comdlg32

GetOpenFileNameW

shell32

ShellExecuteW
SHCreateDirectoryExW
SHGetFileInfoW
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetFolderPathW
SHAppBarMessage
SHFileOperationW

ole32

CoCreateGuid
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx
CoInitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

SHGetValueW
PathAppendW
PathRemoveFileSpecW
SHSetValueA
SHGetValueA
StrCmpIW
StrTrimA
StrCmpNIW
PathIsDirectoryW
PathCombineW
StrStrIA
StrStrIW
PathFileExistsW

comctl32

InitCommonControlsEx

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

gdiplus

GdipDisposeImage
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromHICON
GdiplusShutdown
GdiplusStartup
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToFile
GdipFree
GdipCloneImage
GdipGetImageEncoders

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

advapi32

RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegGetValueW
OpenProcessToken
GetTokenInformation
CreateProcessAsUserW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW

Sections

.text
Size: 899KB - Virtual size: 898KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 424KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea92b11ecc74c5753779da72b1599805

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

shell32

ole32

oleaut32

shlwapi

comctl32

urlmon

version

gdiplus

winmm

userenv

crypt32

wintrust

wininet

iphlpapi

advapi32

Sections

.text Size: 899KB - Virtual size: 898KB

.rdata Size: 191KB - Virtual size: 190KB

.data Size: 30KB - Virtual size: 43KB

.rsrc Size: 424KB - Virtual size: 424KB

.reloc Size: 43KB - Virtual size: 43KB

.text
Size: 899KB - Virtual size: 898KB

.rdata
Size: 191KB - Virtual size: 190KB

.data
Size: 30KB - Virtual size: 43KB

.rsrc
Size: 424KB - Virtual size: 424KB

.reloc
Size: 43KB - Virtual size: 43KB