ab3c26cc294b90791a8cb1646c1940ecb2a38b66e6d18882a8af1f04c221cc12

Sharing

Copy URL Twitter E-mail

General

Target

ab3c26cc294b90791a8cb1646c1940ecb2a38b66e6d18882a8af1f04c221cc12
Size

789KB
MD5

f6483c085d92f6b884820bf7fcdfef26
SHA1

9bc92e3c83772daa233a800d8173d0b2e16cda67
SHA256

ab3c26cc294b90791a8cb1646c1940ecb2a38b66e6d18882a8af1f04c221cc12
SHA512

9982922d85b8da15a877bee4ab31af6fa81c01eafaef48f4d48693935b0e1a9226c29f0f9acfb04831a2585297b84e63d33deae20a2def5e4a90679adba83983
SSDEEP

12288:D1ZB2XlSgJvn9pfNxgJD+toXPDAdrOq3u35x5vj2dX0cN6a+YVWLgMXPRQVP:D1Z/kgx+toXPDAtl3ivC4a+YV45u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab3c26cc294b90791a8cb1646c1940ecb2a38b66e6d18882a8af1f04c221cc12

Files

ab3c26cc294b90791a8cb1646c1940ecb2a38b66e6d18882a8af1f04c221cc12
.exe windows:6 windows x86 arch:x86

f8b1ec8438877ac6a38c10b750ab29d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\.conan\UWSTServiceWin\2.2.13\screenshare\stable\build\0ef6be5a0ae63c347584d761972daa1a53bf7589\Release\UWSTService.pdb

Imports

kernel32

VerifyVersionInfoW
TlsGetValue
TlsFree
FormatMessageA
CreateIoCompletionPort
GetTickCount
GetModuleFileNameW
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
GetCommandLineW
SetErrorMode
CreateMutexW
WideCharToMultiByte
OpenProcess
SetFileAttributesW
CopyFileW
CreateProcessA
PostQueuedCompletionStatus
WaitForSingleObject
GetQueuedCompletionStatus
LeaveCriticalSection
GetProcessId
WaitForMultipleObjects
EnterCriticalSection
CreateProcessW
SetEndOfFile
CreateFileW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetLastError
GetOEMCP
GetACP
IsValidCodePage
GetCurrentProcessId
FindFirstFileExW
CreateDirectoryW
GetTimeZoneInformation
ReadConsoleW
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
ExitProcess
GetModuleHandleExW
ExitThread
GetFileType
SetStdHandle
GetFileAttributesExW
RtlUnwind
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
VirtualProtect
GetVersionExW
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
VerSetConditionMask
WTSGetActiveConsoleSessionId
LocalFree
QueueUserAPC
CloseHandle
DeleteFileW
TlsAlloc
TerminateThread
Sleep
FindNextFileW
ProcessIdToSessionId
TlsSetValue
SetWaitableTimer
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
GetCommandLineA
InitializeCriticalSectionAndSpinCount
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
SetEvent
HeapReAlloc
HeapSize
GlobalFree
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleHandleW
CreateEventW
QueryPerformanceFrequency
QueryPerformanceCounter
GetExitCodeThread
GetCurrentThread
SwitchToThread
WaitForSingleObjectEx
DuplicateHandle
TryEnterCriticalSection
GetStringTypeW
FormatMessageW
GetProcAddress
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetProcessHeap
HeapFree
HeapAlloc
EncodePointer
OutputDebugStringW
IsDebuggerPresent
WriteConsoleW
WriteConsoleA
GetConsoleMode
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteFile
GetStdHandle
GetDynamicTimeZoneInformation
GetFileAttributesA
MultiByteToWideChar
GetModuleFileNameA
OutputDebugStringA
FindClose
FindFirstFileA
FindNextFileA
GetSystemTimeAsFileTime

user32

RegisterClassExW
CreateWindowExW
AllowSetForegroundWindow
PostMessageW
FindWindowW
wsprintfW
GetWindowThreadProcessId
GetMessageW
DispatchMessageW
TranslateMessage
PostQuitMessage
DefWindowProcW

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
GetUserNameW

shell32

ord165
CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitialize

ws2_32

ioctlsocket
htonl
htons
ntohl
select
setsockopt
closesocket
WSAGetLastError
WSASend
WSASendTo
WSASocketW
WSAStringToAddressW
WSACleanup
WSAStartup
WSASetLastError

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

Sections

.text
Size: 596KB - Virtual size: 596KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f8b1ec8438877ac6a38c10b750ab29d2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

ws2_32

version

wtsapi32

Sections

.text Size: 596KB - Virtual size: 596KB

.rdata Size: 133KB - Virtual size: 132KB

.data Size: 23KB - Virtual size: 28KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 32KB - Virtual size: 32KB

.text
Size: 596KB - Virtual size: 596KB

.rdata
Size: 133KB - Virtual size: 132KB

.data
Size: 23KB - Virtual size: 28KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 32KB - Virtual size: 32KB