38e171e23ff49b852f9b0446b62e644abfa0a43f05d4d70aeb70b8b669cf5a5e

Sharing

Copy URL Twitter E-mail

General

Target

38e171e23ff49b852f9b0446b62e644abfa0a43f05d4d70aeb70b8b669cf5a5e
Size

1.7MB
MD5

05ec5ca6890f4fb668dd644bb2ac6eb4
SHA1

b4041a024549375d3bdd8abb438b898313933cc5
SHA256

38e171e23ff49b852f9b0446b62e644abfa0a43f05d4d70aeb70b8b669cf5a5e
SHA512

2ec0df02b8bdba2ca1f139372169809988f762bdb47ef54b9682dc8c0cf99b7f4288dfb228a30cbc6b197d589d49202b50edfefe28dc28a2025f69cb83223fe8
SSDEEP

49152:7ovpFYoVIUAUZBV87qAZpHyZrUrLVdAZ39TkL9zGbk:kR2aIUVZBVxAZpSZrSVd+39TkL9ok

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2345softmgr.exe

Files

38e171e23ff49b852f9b0446b62e644abfa0a43f05d4d70aeb70b8b669cf5a5e
.zip
2345softmgr.exe
.exe windows:5 windows x86 arch:x86

4a0398e4346b7b53919527ec295446cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\jenkins\workspace\pc-2345softmgr-build\SoftMgr\main\bin\Win32\release\pdb\2345SoftMgr.pdb

Imports

crypt32

CryptMsgClose
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptDecodeObject

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

VirtualFree
VirtualProtect
VirtualQuery
GetThreadContext
SetThreadContext
SuspendThread
ResumeThread
SetLastError
WaitForMultipleObjects
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
ReadFile
SetEndOfFile
GetFileSize
GetComputerNameW
GetTickCount
WaitForSingleObject
SetEvent
GetACP
GlobalMemoryStatusEx
InterlockedExchange
InterlockedExchangeAdd
lstrlenW
GetPrivateProfileStringW
GetModuleHandleW
GetVersionExW
GetFileAttributesW
OpenEventW
WTSGetActiveConsoleSessionId
OpenMutexW
UnmapViewOfFile
CreateEventW
CreateFileMappingW
VirtualAlloc
OpenFileMappingW
HeapCompact
DeleteFileA
GetVersionExA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnlockFileEx
GetFullPathNameA
LockFile
HeapCreate
AreFileApisANSI
FlushInstructionCache
InterlockedCompareExchange
GetLogicalDriveStringsW
GetDiskFreeSpaceW
GetVolumeInformationW
GetCurrentThread
GetDriveTypeW
GetVersion
DeviceIoControl
ExpandEnvironmentStringsW
GetCurrentProcess
DeleteFileW
lstrcpyW
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcmpA
LocalAlloc
GetProcessHeap
LocalFree
HeapAlloc
GlobalFree
GlobalAlloc
OpenProcess
HeapFree
GetLocalTime
GetCurrentThreadId
CreateFileW
SetFilePointer
WriteFile
GetProcAddress
GetWindowsDirectoryW
CreateDirectoryW
GetEnvironmentVariableW
SetEnvironmentVariableW
FreeLibrary
DeleteCriticalSection
DecodePointer
LoadLibraryW
RaiseException
Sleep
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
MoveFileExW
CloseHandle
GetLastError
CreateMutexW
GetModuleFileNameW
HeapDestroy
UnlockFile
CreateFileMappingA
EnumResourceNamesW
SizeofResource
GetUserDefaultLangID
IsWow64Process
ReadProcessMemory
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
WriteConsoleW
HeapSize
SetStdHandle
OutputDebugStringA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
LockFileEx
MapViewOfFile
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
HeapReAlloc
SetConsoleCtrlHandler
GetModuleFileNameA
ExitProcess
ExitThread
RtlUnwind
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
SetProcessAffinityMask
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
WritePrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileSectionW
GetSystemDirectoryW
FindFirstFileW
FindNextFileW
FindClose
CreateProcessW
QueryInformationJobObject
WriteProcessMemory
AssignProcessToJobObject
CreateJobObjectW
IsProcessInJob
GetModuleHandleA
VirtualAllocEx
CreateRemoteThread
TerminateJobObject
GetExitCodeProcess
GetLongPathNameW
GetShortPathNameW
GetFileAttributesExW
SearchPathW
MultiByteToWideChar
WideCharToMultiByte
QueryDosDeviceW
TerminateProcess
LoadLibraryA
LockResource
GetSystemInfo
LoadResource
FindResourceW
lstrcmpiW
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
ReleaseMutex
LoadLibraryExW
ResetEvent
SetFileTime
GetFileTime
GetComputerNameExW
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTime
DosDateTimeToFileTime
FileTimeToDosDateTime
GetFullPathNameW
RemoveDirectoryW
GetTempPathW
SetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
CopyFileW
GetTempFileNameW
MoveFileW
lstrcatW
GetFileSizeEx
FormatMessageW
GetStringTypeW
EncodePointer
RtlCaptureStackBackTrace
IsProcessorFeaturePresent
QueueUserWorkItem
GetModuleHandleExW
GetCPInfo
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
DuplicateHandle
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
CompareStringW
LCMapStringW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
RtlCaptureContext
ReleaseSemaphore
InterlockedDecrement
GetProcessId
TerminateThread
CreateThread
CreateSemaphoreW
InterlockedIncrement
OpenThread
VirtualQueryEx
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
GetStdHandle
GetFileType
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
FormatMessageA

user32

PostQuitMessage
DefWindowProcW
GetMessageW
DestroyWindow
CreateWindowExW
RegisterClassExW
DispatchMessageW
TranslateMessage
GetWindowLongW
GetWindow
SendMessageTimeoutW
FindWindowW
SetWindowLongW
GetWindowThreadProcessId
CreateIconFromResourceEx
PrivateExtractIconsW
DestroyIcon
LoadCursorW
FindWindowExW
IsWindowVisible
SendMessageW
ShowWindow
IsWindow
SetForegroundWindow
SystemParametersInfoW
GetActiveWindow
UnregisterClassW
PostMessageW
GetIconInfo
OpenDesktopW
CloseDesktop
GetWindowTextW
ReleaseDC
GetDesktopWindow
EnumDesktopWindows
EnumChildWindows
GetDC
GetWindowTextLengthW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
GetParent
EnumDisplaySettingsW
IsZoomed
GetClassNameW
SetFocus
GetForegroundWindow
AttachThreadInput
GetMonitorInfoW
WindowFromPoint
GetShellWindow
GetSystemMetrics
MonitorFromWindow
SetWindowPos
GetFocus
GetWindowRect
LoadImageW
LookupIconIdFromDirectoryEx

gdi32

CreateCompatibleDC
GetStockObject
GetObjectW
GetTextExtentPointW
GetTextExtentExPointW
SelectObject
DeleteDC
GetDIBits
DeleteObject
CreateFontIndirectW

advapi32

LookupPrivilegeValueW
RegisterEventSourceW
DeregisterEventSource
SetEntriesInAclW
SetNamedSecurityInfoW
IsValidSid
OpenServiceW
StartServiceW
OpenSCManagerW
CloseServiceHandle
GetTokenInformation
GetLengthSid
ConvertSidToStringSidW
SetTokenInformation
CreateProcessAsUserW
DuplicateTokenEx
CreateServiceW
QueryServiceStatus
ChangeServiceConfig2W
DeleteService
ControlService
SystemFunction036
CheckTokenMembership
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
RegEnumValueW
ReportEventW
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueExW
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid

shell32

ShellExecuteExW
ExtractIconExW
SHGetDesktopFolder
SHFileOperationW
SHGetFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetFileInfoW
SHGetMalloc
ord727
DuplicateIcon
ShellExecuteW
SHGetSpecialFolderPathW
SHChangeNotify

ole32

OleInitialize
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
OleUninitialize
CoTaskMemFree

oleaut32

VariantClear
SysFreeString
SysAllocString

shlwapi

PathFileExistsW
SHDeleteKeyW
PathRemoveFileSpecW

wininet

InternetGetConnectedState
InternetCheckConnectionW

iphlpapi

GetAdaptersInfo

imagehlp

ImageEnumerateCertificates
ImageRemoveCertificate

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

gdiplus

GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipSaveImageToFile
GdipGetImageWidth
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateHICONFromBitmap
GdipLoadImageFromFile
GdipGetImageRawFormat
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipLoadImageFromFileICM
GdipGetImageHeight

Exports

Exports

CheckSignerInfo
ExportFunc01
ExportFunc02
IsNetConnect

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 587KB - Virtual size: 586KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a0398e4346b7b53919527ec295446cf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

iphlpapi

imagehlp

wtsapi32

userenv

gdiplus

Exports

Exports

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 587KB - Virtual size: 586KB

.data Size: 33KB - Virtual size: 43KB

.rsrc Size: 60KB - Virtual size: 60KB

.reloc Size: 136KB - Virtual size: 136KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 587KB - Virtual size: 586KB

.data
Size: 33KB - Virtual size: 43KB

.rsrc
Size: 60KB - Virtual size: 60KB

.reloc
Size: 136KB - Virtual size: 136KB