d40007c972abec04b2780044e4029fabbb72873c4833ba9834fd10830f52e065

Sharing

Copy URL Twitter E-mail

General

Target

d40007c972abec04b2780044e4029fabbb72873c4833ba9834fd10830f52e065
Size

7.5MB
MD5

8c1ce6ea17bee2bca8e32d7ab88bfe40
SHA1

396dbfe9b73bf0e7789471b1a1bda0c9f707bc41
SHA256

d40007c972abec04b2780044e4029fabbb72873c4833ba9834fd10830f52e065
SHA512

0a0e6589005b6a5acf0aa6b46bed8c8741b7f8cba1709c2b610ab1e04adf801a49fa1a6ec779bda01c431086004ef2527e1ca42a1ddc9625747b95238e64fed5
SSDEEP

49152:nHDk7feFN7TGF5Aiy1aiAAHUSOf3Ew9X/CxtKyCGiApXr1VLqjLra7RXwPNVNsy8:IKT4AFUFPu0IGsdHf8cC0sHD527BWG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d40007c972abec04b2780044e4029fabbb72873c4833ba9834fd10830f52e065

Files

d40007c972abec04b2780044e4029fabbb72873c4833ba9834fd10830f52e065
.exe windows:6 windows x64 arch:x64

3bd34ad10222e027ad5742b425749609

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\T\BuildResults\bin\Release_x64\AdobeCollabSync.pdb

Imports

shlwapi

UrlIsW
PathCreateFromUrlW
PathRemoveFileSpecW
PathStripPathW
UrlCanonicalizeA
StrCmpNA
StrCmpNW

kernel32

GetCurrentProcess
CreateThread
CreateProcessW
GetThreadId
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateDirectoryW
ProcessIdToSessionId
IsProcessInJob
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
QueryInformationJobObject
VerifyVersionInfoA
GetFileType
OpenEventA
SystemTimeToTzSpecificLocalTime
GetProcessTimes
K32GetProcessMemoryInfo
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
WaitForThreadpoolWorkCallbacks
CreateThreadpool
CloseThreadpool
QueueUserWorkItem
AreFileApisANSI
GetWindowsDirectoryW
GetTempPathW
GetProcAddress
GetModuleHandleW
OpenProcess
GetExitCodeProcess
WaitNamedPipeW
WaitForMultipleObjects
GetOverlappedResult
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
ResumeThread
TerminateProcess
GetCurrentProcessId
ResetEvent
HeapSetInformation
GetProcessHeap
VerSetConditionMask
FindResourceA
SizeofResource
LockResource
LoadResource
GetModuleHandleExA
WideCharToMultiByte
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
DuplicateHandle
SetWaitableTimer
GetCurrentDirectoryW
GetEnvironmentVariableW
CreateWaitableTimerA
QueryDosDeviceW
GetThreadErrorMode
FormatMessageW
FormatMessageA
LocalFree
LoadLibraryW
GetModuleHandleExW
GetModuleFileNameW
CreateEventA
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
SetLastError
RaiseException
DecodePointer
DeviceIoControl
SetThreadErrorMode
InitOnceBeginInitialize
GetCurrentThreadId
VerifyVersionInfoW
GetCommandLineW
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
OutputDebugStringA
ReleaseSemaphore
WaitForSingleObject
SwitchToThread
DeleteFileW
FindClose
FindFirstFileW
FlushFileBuffers
GetDriveTypeW
GetFileInformationByHandle
GetFullPathNameW
SetEndOfFile
SetFilePointer
MoveFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LocalAlloc
CreateSemaphoreA
GetSystemTimeAsFileTime
GetLocalTime
FileTimeToSystemTime
FindNextFileW
RemoveDirectoryW
MultiByteToWideChar
GetFileAttributesW
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
lstrlenA
InitializeCriticalSectionAndSpinCount
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
GetDriveTypeA
HeapAlloc
HeapFree
WaitForSingleObjectEx
PeekNamedPipe
CancelIoEx
WaitForMultipleObjectsEx
CreateNamedPipeA
LoadLibraryExW
GetUserDefaultLCID
QueryPerformanceCounter
QueryPerformanceFrequency
GetExitCodeThread
GetNativeSystemInfo
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
EncodePointer
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
InitOnceComplete
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
RtlPcToFileHeader
RtlUnwindEx
InterlockedPushEntrySList
ExitThread
FreeLibraryAndExitThread
GetStdHandle
WriteConsoleW
ExitProcess
GetCurrentThread
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
SetEnvironmentVariableW
SetStdHandle
HeapSize
GetFileSize
GetFileAttributesExW
CreateWaitableTimerW
CreateIoCompletionPort
SleepEx
PostQueuedCompletionStatus
GetQueuedCompletionStatus
QueueUserAPC
TerminateThread
SetFileAttributesW
GlobalFree
GlobalAlloc
lstrlenW
GetTickCount
Sleep
OpenMutexW
SetNamedPipeHandleState
GetLastError
CloseHandle
WriteFile
RtlUnwind
ReadFile
GetVolumeInformationW
CreateFileW
LoadLibraryExA
CloseThreadpoolWork

user32

FindWindowW
PostMessageW
GetClassNameA
FindWindowA
IsHungAppWindow
LoadImageW
GetCursorPos
GetPropW
SetPropW
SetForegroundWindow
InsertMenuItemW
TrackPopupMenu
InsertMenuW
DestroyMenu
CreatePopupMenu
GetSystemMetrics
DestroyWindow
CreateWindowExW
RegisterClassW
CallWindowProcA
PostQuitMessage
DefWindowProcA
PostMessageA
GetMessageA
LoadStringW
MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
TranslateMessage
GetActiveWindow
GetWindowThreadProcessId
GetForegroundWindow

advapi32

RegSetValueExW
CryptSetHashParam
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
OpenThreadToken
GetTokenInformation
ConvertSidToStringSidA
RegOpenKeyW
RegOpenKeyA
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
SetTokenInformation
GetLengthSid
DuplicateTokenEx
OpenProcessToken
RegDeleteTreeW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorA
TreeSetNamedSecurityInfoW
GetNamedSecurityInfoW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityDescriptorSacl
GetAclInformation
GetAce
CreateProcessAsUserW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptImportKey

shell32

SHCreateDirectoryExW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
Shell_NotifyIconW
SHQueryUserNotificationState
SHGetKnownFolderPath
SHFileOperationA
ShellExecuteA

ole32

CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoUninitialize

sensapi

IsNetworkAlive

ws2_32

GetAddrInfoW
socket
shutdown
WSAStartup
select
recv
listen
WSACleanup
WSAGetLastError
FreeAddrInfoW
connect
closesocket
send
WSACreateEvent
WSAEventSelect
WSAIoctl
WSASocketA
__WSAFDIsSet
accept
bind

wininet

InternetSetCookieExA
DetectAutoProxyUrl
InternetReadFile
InternetWriteFile
InternetSetOptionA
HttpSendRequestExA
InternetCloseHandle
HttpAddRequestHeadersA
HttpQueryInfoA
HttpOpenRequestA
InternetConnectA
HttpSendRequestA
InternetOpenA
InternetCrackUrlA
HttpEndRequestA

mpr

WNetCancelConnection2W
WNetAddConnection2W
WNetGetResourceInformationW
WNetGetConnectionW

crypt32

CryptProtectData
CryptUnprotectData

oleaut32

SysFreeString
SafeArrayCreateVector
SafeArrayUnaccessData
SysAllocString
SafeArrayAccessData
SafeArrayDestroy

netapi32

NetShareGetInfo

winhttp

WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpSetCredentials
WinHttpSetStatusCallback
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpSetOption
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpReadData
WinHttpWriteData
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpReceiveResponse
WinHttpGetIEProxyConfigForCurrentUser

Exports

Exports

gudeCancel
gudeClearCache
gudeCreate
gudeDestroy
gudeDownload
gudeDownloadRangeToMemory
gudeDownloadToMemory
gudeErrorString
gudeHTTPStatusString
gudePause
gudeRegisterAddChunkHeaderCallback
gudeRegisterAddHeaderCallback
gudeRegisterAddParametersCallback
gudeRegisterCancellationCallback
gudeRegisterChunkErrorRetryCallback
gudeRegisterCompletionCallback
gudeRegisterErrorCallback
gudeRegisterLoggingCallback
gudeRegisterMonitorCallback
gudeRegisterPausedCallback
gudeRegisterProgressCallback
gudeRegisterRequestBodyCallback
gudeRegisterResponseBodyCallback
gudeRegisterResponseHeaderCallback
gudeRegisterSSLCertificatePolicyCallback
gudeRegisterSetServerTypeCallback
gudeRegisterSetTimeoutCallback
gudeRegisterStatusLineCallback
gudeResume
gudeSendRequest
gudeSetLogLevel
gudeSetMultipartUploadThreshold
gudeSetSystemProxyCredentials
gudeSetTargetDataRates
gudeSetWorkerPoolUpperLimit
gudeUpload
gudeUploadFromMemory
gudeVersion

Sections

.text
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 334KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 279KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 604KB - Virtual size: 608KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3bd34ad10222e027ad5742b425749609

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

advapi32

shell32

ole32

sensapi

ws2_32

wininet

mpr

crypt32

oleaut32

netapi32

winhttp

Exports

Exports

Sections

.text Size: 5.1MB - Virtual size: 5.1MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 334KB - Virtual size: 365KB

.pdata Size: 279KB - Virtual size: 278KB

.didat Size: 512B - Virtual size: 408B

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 18KB - Virtual size: 17KB

.reloc Size: 604KB - Virtual size: 608KB

.text
Size: 5.1MB - Virtual size: 5.1MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 334KB - Virtual size: 365KB

.pdata
Size: 279KB - Virtual size: 278KB

.didat
Size: 512B - Virtual size: 408B

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 18KB - Virtual size: 17KB

.reloc
Size: 604KB - Virtual size: 608KB