4fc3e05b2915265189db28178e0f6660aa3983cb7f111802be359f8d566fb85b

Sharing

Copy URL Twitter E-mail

General

Target

4fc3e05b2915265189db28178e0f6660aa3983cb7f111802be359f8d566fb85b
Size

801KB
MD5

d8d914edc5d53672cf8807f6f94ef626
SHA1

4ac390647d8b3450e4bb6134d39668ce692a1067
SHA256

4fc3e05b2915265189db28178e0f6660aa3983cb7f111802be359f8d566fb85b
SHA512

66f50821fb6c74305197dbac3939d128d710cdf2d00fc0f8e55e9cb6096b458a41b1372dfccba0ae8c6cc8b1047a36671c9853b4c5db22ec85958698e8bd7df6
SSDEEP

12288:+x4UBmwT1/GX1q9pT3OufmLSzL+o8f5/I83cVn0oLu5BdRa1mSusu9xn7eR5+nz0:FUBmwh/GX1q9pT3O+AB/FCn0ba0l2b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4fc3e05b2915265189db28178e0f6660aa3983cb7f111802be359f8d566fb85b

Files

4fc3e05b2915265189db28178e0f6660aa3983cb7f111802be359f8d566fb85b
.exe windows:6 windows x86 arch:x86

49eb294d365139fe4fe372bb93153588

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Code\xl_browser_component\pdb\ProductRelease\xlbrowsershell.pdb

Imports

shlwapi

PathRemoveFileSpecW

kernel32

CreateIoCompletionPort
CreateEventW
CreateThread
SetLastError
ResetEvent
GetQueuedCompletionStatus
UnregisterWait
SetEvent
RegisterWaitForSingleObject
TerminateJobObject
PostQueuedCompletionStatus
WaitForSingleObject
DuplicateHandle
SetInformationJobObject
GetCurrentThreadId
TerminateProcess
GetUserDefaultLangID
GetUserDefaultLCID
GetUserDefaultLocaleName
EnumSystemLocalesEx
HeapDestroy
GetTickCount
GetVersionExW
GetProductInfo
GetNativeSystemInfo
IsWow64Process
LocalFree
GetCurrentProcessId
ProcessIdToSessionId
Sleep
IsDebuggerPresent
GetModuleHandleW
RaiseException
GetThreadId
SetThreadPriority
GetThreadPriority
OutputDebugStringA
WriteFile
GetCurrentDirectoryW
GetLocalTime
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetFileType
SetHandleInformation
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
UnregisterWaitEx
AssignProcessToJobObject
WriteProcessMemory
CreateFileMappingW
MapViewOfFile
GetCurrentProcessorNumber
SetThreadAffinityMask
GetProcessHandleCount
GetProcessHeaps
SignalObjectAndWait
ExpandEnvironmentStringsW
GetFileAttributesW
QueryDosDeviceW
GetLongPathNameW
VirtualProtectEx
VirtualFreeEx
ReadProcessMemory
LoadLibraryW
LoadLibraryExW
FreeLibrary
GetModuleHandleExW
ReleaseSRWLockExclusive
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
QueryThreadCycleTime
GetCommandLineW
CreateNamedPipeW
CreateProcessW
CreateRemoteThread
CreateJobObjectW
CreateMutexW
UnmapViewOfFile
VirtualQueryEx
SetCurrentDirectoryW
TlsGetValue
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
SetUnhandledExceptionFilter
RtlCaptureStackBackTrace
SearchPathW
lstrlenW
DebugBreak
SetFilePointerEx
GetFileSizeEx
GetCurrentThread
FindClose
FindNextFileW
FindFirstFileExW
TlsAlloc
TlsFree
TlsSetValue
K32QueryWorkingSetEx
WideCharToMultiByte
VirtualQuery
SwitchToThread
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwind
GetConsoleCP
GetConsoleMode
ExitProcess
SetStdHandle
GetProcessHeap
GetStdHandle
HeapFree
HeapAlloc
IsValidLocale
EnumSystemLocalesW
ReadConsoleW
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
HeapSize
SetProcessDEPPolicy
HeapSetInformation
GetLastError
GetModuleHandleA
VirtualAllocEx
GetProcessTimes
GetCurrentProcess
GetFileSize
GetProcAddress
CloseHandle
LoadLibraryA
CreateFileW
GetModuleFileNameW
VirtualAlloc
VirtualFree
ReadFile
FlushFileBuffers

winmm

timeGetTime

dbghelp

SymGetSearchPathW
SymSetSearchPathW
SymCleanup
SymInitialize
SymSetOptions
SymGetLineFromAddr64
SymFromAddr

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

user32

CreateDesktopW
SetProcessWindowStation
CreateWindowStationW
GetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CloseDesktop
GetUserObjectInformationW

advapi32

RevertToSelf
RegDisablePredefinedCache
DuplicateTokenEx
ConvertSidToStringSidW
SystemFunction036
FreeSid
ImpersonateLoggedOnUser
MapGenericMask
GetNamedSecurityInfoW
IsValidSid
EqualSid
AccessCheck
CreateProcessAsUserW
GetTokenInformation
RegOpenKeyExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
ConvertStringSidToSidW
GetLengthSid
SetTokenInformation
OpenProcessToken
GetAce
SetThreadToken
EventWriteTransfer
EventUnregister
EventRegister
SetEntriesInAclW
GetSecurityInfo
GetSidSubAuthority
InitializeSid
CreateWellKnownSid
CopySid
LookupPrivilegeValueW
DuplicateToken
CreateRestrictedToken
RegCreateKeyExW
RegQueryValueExW
SetKernelObjectSecurity
GetKernelObjectSecurity

ole32

CoTaskMemFree

Exports

Exports

GetHandleVerifier
IsSandboxedProcess

Sections

.text
Size: 501KB - Virtual size: 500KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49eb294d365139fe4fe372bb93153588

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

winmm

dbghelp

version

user32

advapi32

ole32

Exports

Exports

Sections

.text Size: 501KB - Virtual size: 500KB

.rdata Size: 174KB - Virtual size: 174KB

.data Size: 7KB - Virtual size: 16KB

.rsrc Size: 95KB - Virtual size: 95KB

.reloc Size: 22KB - Virtual size: 21KB

.text
Size: 501KB - Virtual size: 500KB

.rdata
Size: 174KB - Virtual size: 174KB

.data
Size: 7KB - Virtual size: 16KB

.rsrc
Size: 95KB - Virtual size: 95KB

.reloc
Size: 22KB - Virtual size: 21KB