b48c1cd9f6f359adb8b0f14de16985d11bca51aaa265213d17ad3ec046785bd3

Sharing

Copy URL Twitter E-mail

General

Target

b48c1cd9f6f359adb8b0f14de16985d11bca51aaa265213d17ad3ec046785bd3
Size

579KB
MD5

fb62a5438fca7b2d190e178947bfa631
SHA1

f8c0a765dbe4b6a42f29bf1357324fad2b16cca1
SHA256

b48c1cd9f6f359adb8b0f14de16985d11bca51aaa265213d17ad3ec046785bd3
SHA512

ad2678fdab7a596c4b7bcbbac7049c40ca016bfce591add574f5ce615603803d910e5415a3c1794d32f680fe75341e24415d98e33bf8b6804df6e40dfe95db2d
SSDEEP

6144:q9TcMxraEGu3fv0SJBLm+iGD+ZQelk4xbiS9x/VJlbh5FeaA4Pu2WPcppdelHCX4:q5GoMS3iAelksiSD/TCOPu2WielQ6F9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b48c1cd9f6f359adb8b0f14de16985d11bca51aaa265213d17ad3ec046785bd3

Files

b48c1cd9f6f359adb8b0f14de16985d11bca51aaa265213d17ad3ec046785bd3
.exe windows:6 windows x86 arch:x86

a5d36944278451d50f55e8c3e8404747

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\dev\projs\processsupervisor\output\TweakScheduler.pdb

Imports

comctl32

InitCommonControlsEx

kernel32

GetActiveProcessorGroupCount
GetNumaHighestNodeNumber
OutputDebugStringW
GetVersionExW
GetCurrentProcess
GetExitCodeProcess
GetFileTime
GetSystemTimeAsFileTime
CloseHandle
MultiByteToWideChar
GetFileAttributesW
CreateFileW
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
ExitProcess
LoadLibraryW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
GetSystemInfo
HeapReAlloc
LockResource
GetLastError
HeapSize
InitializeCriticalSectionEx
GetLogicalProcessorInformationEx
HeapFree
IsBadWritePtr
SizeofResource
GetActiveProcessorCount
WriteConsoleW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FreeLibrary
GetUserDefaultUILanguage
VerSetConditionMask
CreateDirectoryW
DeleteFileW
GetFileSize
GetLongPathNameW
GetShortPathNameW
RemoveDirectoryW
GetVolumeNameForVolumeMountPointW
SetLastError
OpenEventW
GetCurrentProcessId
CreateProcessW
GetStartupInfoW
ProcessIdToSessionId
OpenProcess
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetModuleFileNameW
GetProcAddress
GlobalAlloc
GlobalUnlock
GlobalLock
LocalFree
WinExec
FormatMessageW
CopyFileW
MoveFileW
VerifyVersionInfoW
WideCharToMultiByte
ReadFile
GetHandleInformation
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
WaitForMultipleObjects
Sleep
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RaiseException
TryAcquireSRWLockExclusive
QueryPerformanceFrequency
FormatMessageA
SetFileInformationByHandle
GetTempPathW
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
GetLocaleInfoEx
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetModuleHandleExW
GetStdHandle
WriteFile
GetCurrentThread
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
SetStdHandle
GetStringTypeW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers

user32

FindWindowW
GetWindowThreadProcessId
GetIconInfo
GetSystemMetrics
UnregisterClassW
LoadStringW
MessageBoxW
GetDlgItem
OpenClipboard
CloseClipboard
SetWindowLongW
GetWindowLongW
SetClipboardData
EmptyClipboard
GetWindowTextW
InvalidateRect
GetDC
PostMessageW
EndDialog
SetWindowTextW
ShowWindow
wvsprintfW
ExitWindowsEx
SetDlgItemTextW
IsDlgButtonChecked
CheckDlgButton
DialogBoxParamW
EnableWindow
CreateWindowExW
SendMessageW
GetClientRect
ReleaseDC

advapi32

OpenProcessToken
QueryServiceStatus
ConvertStringSidToSidW
QueryServiceConfigW
OpenServiceW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
CreateProcessAsUserW
DuplicateTokenEx
GetLengthSid
GetSidSubAuthority
GetSidSubAuthorityCount
OpenSCManagerW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
StartServiceW
RegOpenKeyExW
RegQueryValueExW
GetTokenInformation
SetTokenInformation
GetUserNameW
RegEnumKeyW
RegEnumValueW
ChangeServiceConfigW
CloseServiceHandle
ControlService
EnumServicesStatusExW
NotifyBootConfigStatus

shell32

SHGetKnownFolderPath
SHChangeNotify
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHGetStockIconInfo
ShellExecuteExW
ShellExecuteW

ole32

CLSIDFromString
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString

wininet

InternetReadFile
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetCanonicalizeUrlW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

shlwapi

SHDeleteKeyW

gdi32

GetTextExtentPoint32W
SelectObject
GetObjectW
DeleteObject

Sections

.text
Size: 466KB - Virtual size: 466KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5d36944278451d50f55e8c3e8404747

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

advapi32

shell32

ole32

oleaut32

wininet

wtsapi32

shlwapi

gdi32

Sections

.text Size: 466KB - Virtual size: 466KB

.rdata Size: 77KB - Virtual size: 76KB

.data Size: 15KB - Virtual size: 22KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 466KB - Virtual size: 466KB

.rdata
Size: 77KB - Virtual size: 76KB

.data
Size: 15KB - Virtual size: 22KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 17KB