28b2c304a006ef100168ea0f53a86c6cf2bce2155f5128cf0998f07624303a59

Sharing

Copy URL Twitter E-mail

General

Target

28b2c304a006ef100168ea0f53a86c6cf2bce2155f5128cf0998f07624303a59
Size

579KB
MD5

0ea73b66fffbee6173740921d92a0881
SHA1

75e7b7a1d094452708e9b4ece2e4b14472f93a1a
SHA256

28b2c304a006ef100168ea0f53a86c6cf2bce2155f5128cf0998f07624303a59
SHA512

8235c43125654a27c0f34ed7e3f36de9830904691be03a63031d685186045fdca4432999473757a281b9b77d98fb77b129fe90c7697ab90ab5e35883bf4fb7af
SSDEEP

6144:RYaTPmKOdZEy21tdm+TE1GaakjelsD7rPTQTrFpv5IDaj1Bu2WeHX09rwiC:RTjxnTCelErbQ/kKBu2We0rxC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28b2c304a006ef100168ea0f53a86c6cf2bce2155f5128cf0998f07624303a59

Files

28b2c304a006ef100168ea0f53a86c6cf2bce2155f5128cf0998f07624303a59
.exe windows:6 windows x86 arch:x86

a5d36944278451d50f55e8c3e8404747

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\dev\projs\processsupervisor\output\TweakScheduler.pdb

Imports

comctl32

InitCommonControlsEx

kernel32

GetActiveProcessorGroupCount
GetNumaHighestNodeNumber
OutputDebugStringW
GetVersionExW
GetCurrentProcess
GetExitCodeProcess
GetFileTime
GetSystemTimeAsFileTime
CloseHandle
MultiByteToWideChar
GetFileAttributesW
CreateFileW
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
ExitProcess
LoadLibraryW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
GetSystemInfo
HeapReAlloc
LockResource
GetLastError
HeapSize
InitializeCriticalSectionEx
GetLogicalProcessorInformationEx
HeapFree
IsBadWritePtr
SizeofResource
GetActiveProcessorCount
WriteConsoleW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FreeLibrary
GetUserDefaultUILanguage
VerSetConditionMask
CreateDirectoryW
DeleteFileW
GetFileSize
GetLongPathNameW
GetShortPathNameW
RemoveDirectoryW
GetVolumeNameForVolumeMountPointW
SetLastError
OpenEventW
GetCurrentProcessId
CreateProcessW
GetStartupInfoW
ProcessIdToSessionId
OpenProcess
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetModuleFileNameW
GetProcAddress
GlobalAlloc
GlobalUnlock
GlobalLock
LocalFree
WinExec
FormatMessageW
CopyFileW
MoveFileW
VerifyVersionInfoW
WideCharToMultiByte
ReadFile
GetHandleInformation
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
WaitForMultipleObjects
Sleep
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RaiseException
TryAcquireSRWLockExclusive
QueryPerformanceFrequency
FormatMessageA
SetFileInformationByHandle
GetTempPathW
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
GetLocaleInfoEx
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetModuleHandleExW
GetStdHandle
WriteFile
GetCurrentThread
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
SetStdHandle
GetStringTypeW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers

user32

FindWindowW
GetWindowThreadProcessId
GetIconInfo
GetSystemMetrics
UnregisterClassW
LoadStringW
MessageBoxW
GetDlgItem
OpenClipboard
CloseClipboard
SetWindowLongW
GetWindowLongW
SetClipboardData
EmptyClipboard
GetWindowTextW
InvalidateRect
GetDC
PostMessageW
EndDialog
SetWindowTextW
ShowWindow
wvsprintfW
ExitWindowsEx
SetDlgItemTextW
IsDlgButtonChecked
CheckDlgButton
DialogBoxParamW
EnableWindow
CreateWindowExW
SendMessageW
GetClientRect
ReleaseDC

advapi32

OpenProcessToken
QueryServiceStatus
ConvertStringSidToSidW
QueryServiceConfigW
OpenServiceW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
CreateProcessAsUserW
DuplicateTokenEx
GetLengthSid
GetSidSubAuthority
GetSidSubAuthorityCount
OpenSCManagerW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
StartServiceW
RegOpenKeyExW
RegQueryValueExW
GetTokenInformation
SetTokenInformation
GetUserNameW
RegEnumKeyW
RegEnumValueW
ChangeServiceConfigW
CloseServiceHandle
ControlService
EnumServicesStatusExW
NotifyBootConfigStatus

shell32

SHGetKnownFolderPath
SHChangeNotify
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHGetStockIconInfo
ShellExecuteExW
ShellExecuteW

ole32

CLSIDFromString
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString

wininet

InternetReadFile
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetCanonicalizeUrlW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

shlwapi

SHDeleteKeyW

gdi32

GetTextExtentPoint32W
SelectObject
GetObjectW
DeleteObject

Sections

.text
Size: 466KB - Virtual size: 465KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5d36944278451d50f55e8c3e8404747

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

advapi32

shell32

ole32

oleaut32

wininet

wtsapi32

shlwapi

gdi32

Sections

.text Size: 466KB - Virtual size: 465KB

.rdata Size: 77KB - Virtual size: 76KB

.data Size: 15KB - Virtual size: 22KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 466KB - Virtual size: 465KB

.rdata
Size: 77KB - Virtual size: 76KB

.data
Size: 15KB - Virtual size: 22KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 17KB