d71a5178e739ce3c79064ec4067c55afc29bbc5656b05ca3da660f487a0408c1

Sharing

Copy URL Twitter E-mail

General

Target

d71a5178e739ce3c79064ec4067c55afc29bbc5656b05ca3da660f487a0408c1
Size

577KB
MD5

87c5bcd93f4dad53cd61aacf9e969d8d
SHA1

38b45a1989ec706f2155ab3873716fd8e0cfdc98
SHA256

d71a5178e739ce3c79064ec4067c55afc29bbc5656b05ca3da660f487a0408c1
SHA512

76cf59e30cf7832d84c2e4158d0aba59c6dbac7114b9d480b2fa60f4c8ff65af80b62f6a40c1aa525407be750f45bfbec268f926a86b8a1d1f57c3c107247096
SSDEEP

6144:HTXL60iqAFkUjgm+2r9tuDDqselrSRPjPNIxROCOZGDakpOuA3q2LCzCodlRWyN:FMnM26FelKPZI3PNOuA3qfRWyN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d71a5178e739ce3c79064ec4067c55afc29bbc5656b05ca3da660f487a0408c1

Files

d71a5178e739ce3c79064ec4067c55afc29bbc5656b05ca3da660f487a0408c1
.exe windows:6 windows x86 arch:x86

a5d36944278451d50f55e8c3e8404747

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\dev\projs\processsupervisor\output\TweakScheduler.pdb

Imports

comctl32

InitCommonControlsEx

kernel32

GetActiveProcessorGroupCount
GetNumaHighestNodeNumber
OutputDebugStringW
GetVersionExW
GetCurrentProcess
GetExitCodeProcess
GetFileTime
GetSystemTimeAsFileTime
CloseHandle
MultiByteToWideChar
GetFileAttributesW
CreateFileW
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
ExitProcess
LoadLibraryW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
GetSystemInfo
HeapReAlloc
LockResource
GetLastError
HeapSize
InitializeCriticalSectionEx
GetLogicalProcessorInformationEx
HeapFree
IsBadWritePtr
SizeofResource
GetActiveProcessorCount
WriteConsoleW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FreeLibrary
GetUserDefaultUILanguage
VerSetConditionMask
CreateDirectoryW
DeleteFileW
GetFileSize
GetLongPathNameW
GetShortPathNameW
RemoveDirectoryW
GetVolumeNameForVolumeMountPointW
SetLastError
OpenEventW
GetCurrentProcessId
CreateProcessW
GetStartupInfoW
ProcessIdToSessionId
OpenProcess
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetModuleFileNameW
GetProcAddress
GlobalAlloc
GlobalUnlock
GlobalLock
LocalFree
WinExec
FormatMessageW
CopyFileW
MoveFileW
VerifyVersionInfoW
WideCharToMultiByte
ReadFile
GetHandleInformation
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
WaitForMultipleObjects
Sleep
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RaiseException
TryAcquireSRWLockExclusive
QueryPerformanceFrequency
FormatMessageA
SetFileInformationByHandle
GetTempPathW
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
GetLocaleInfoEx
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetModuleHandleExW
GetStdHandle
WriteFile
GetCurrentThread
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
SetStdHandle
GetStringTypeW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers

user32

FindWindowW
GetWindowThreadProcessId
GetIconInfo
GetSystemMetrics
UnregisterClassW
LoadStringW
MessageBoxW
GetDlgItem
OpenClipboard
CloseClipboard
SetWindowLongW
GetWindowLongW
SetClipboardData
EmptyClipboard
GetWindowTextW
InvalidateRect
GetDC
PostMessageW
EndDialog
SetWindowTextW
ShowWindow
wvsprintfW
ExitWindowsEx
SetDlgItemTextW
IsDlgButtonChecked
CheckDlgButton
DialogBoxParamW
EnableWindow
CreateWindowExW
SendMessageW
GetClientRect
ReleaseDC

advapi32

OpenProcessToken
QueryServiceStatus
ConvertStringSidToSidW
QueryServiceConfigW
OpenServiceW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
CreateProcessAsUserW
DuplicateTokenEx
GetLengthSid
GetSidSubAuthority
GetSidSubAuthorityCount
OpenSCManagerW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
StartServiceW
RegOpenKeyExW
RegQueryValueExW
GetTokenInformation
SetTokenInformation
GetUserNameW
RegEnumKeyW
RegEnumValueW
ChangeServiceConfigW
CloseServiceHandle
ControlService
EnumServicesStatusExW
NotifyBootConfigStatus

shell32

SHGetKnownFolderPath
SHChangeNotify
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHGetStockIconInfo
ShellExecuteExW
ShellExecuteW

ole32

CLSIDFromString
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString

wininet

InternetReadFile
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetCanonicalizeUrlW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

shlwapi

SHDeleteKeyW

gdi32

GetTextExtentPoint32W
SelectObject
GetObjectW
DeleteObject

Sections

.text
Size: 464KB - Virtual size: 464KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5d36944278451d50f55e8c3e8404747

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

advapi32

shell32

ole32

oleaut32

wininet

wtsapi32

shlwapi

gdi32

Sections

.text Size: 464KB - Virtual size: 464KB

.rdata Size: 77KB - Virtual size: 76KB

.data Size: 15KB - Virtual size: 22KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 464KB - Virtual size: 464KB

.rdata
Size: 77KB - Virtual size: 76KB

.data
Size: 15KB - Virtual size: 22KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 17KB