92a8170681479ee8c639a848123ac0a61149493668ae6db33c5d5e62496f40a5

Sharing

Copy URL

Twitter E-mail

General

Target

92a8170681479ee8c639a848123ac0a61149493668ae6db33c5d5e62496f40a5
Size

228KB
MD5

18d6ee1e7eb33a39b497dfc89c6c2edf
SHA1

3bb52ad4a7d29a70ec47c2b5d090f7216f969aee
SHA256

92a8170681479ee8c639a848123ac0a61149493668ae6db33c5d5e62496f40a5
SHA512

7c76c2e5a92230fd8240a35ae379659e6d770ad161b47e0fbf179f3ae9f16109049c825af1af68eead87eb65bfe4dbd44af83935ad1ff46e2893c57ac58cf1b7
SSDEEP

6144:JAA6i7B0yW55EMovzjBdloygu+MVWTBvkV:JDda55EDmy2MVWTZa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
92a8170681479ee8c639a848123ac0a61149493668ae6db33c5d5e62496f40a5

Files

92a8170681479ee8c639a848123ac0a61149493668ae6db33c5d5e62496f40a5
.exe windows:4 windows x86 arch:x86

48ebc8434e9e0eb56ebde04044c51b12

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\SVNCode\Branches\20220520_6.0.6039.2722.R001.SP1_AntiThreeToOne\asm_14_agent\Bin\IsaSetup.pdb

Imports

kernel32

GetFileAttributesA
WaitForSingleObject
GetExitCodeProcess
GetProcAddress
GetLastError
CreateEventA
GetModuleFileNameA
SetCurrentDirectoryA
Sleep
TerminateThread
OpenEventA
MultiByteToWideChar
GetEnvironmentVariableA
FreeLibrary
MoveFileExA
GetCommandLineA
WritePrivateProfileStringA
CreateThread
DeleteFileA
GetSystemDirectoryA
GetTempPathA
CreateProcessA
OpenMutexA
GetTickCount
LoadLibraryA
CloseHandle
GetLocalTime
SetDllDirectoryA
ResetEvent
SetEvent
GetTempFileNameA
GetCurrentProcessId
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FlushFileBuffers
GetFileAttributesExA
FormatMessageA
WriteFile
CreateFileA
GetFileSize
SetFilePointer
GetCurrentThreadId
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
Process32Next
GetCurrentProcess
QueryDosDeviceA
Process32First
TerminateProcess
ReadFile
GetModuleHandleA
GetWindowsDirectoryA
CreateMutexA
GetCurrentDirectoryA
GetStdHandle
CreateToolhelp32Snapshot
OpenProcess
SetLastError
ReleaseMutex
GetVersion
SetFileTime
RemoveDirectoryA
CopyFileA
LocalFileTimeToFileTime
SetFileAttributesA
SetEndOfFile
FindClose
CreateFileMappingA
SystemTimeToFileTime
MoveFileA
FindNextFileA
CreateDirectoryA
GetFileTime
FindFirstFileA
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetPrivateProfileStringA
GetVersionExA
GetSystemInfo
HeapAlloc
HeapFree
GetProcessHeap
HeapReAlloc
HeapSize
DosDateTimeToFileTime
GetSystemTimeAsFileTime
GetStartupInfoA
InterlockedIncrement
InterlockedDecrement
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetEnvironmentVariableA
SetEnvironmentVariableW
ExitProcess
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
FreeEnvironmentStringsA

user32

SetWindowTextA
EndDialog
GetSystemMetrics
SendDlgItemMessageA
ExitWindowsEx
MessageBoxA
MessageBoxExA
DialogBoxParamA
GetDlgItemTextA

advapi32

SetSecurityDescriptorDacl
LookupPrivilegeValueA
FreeSid
GetTokenInformation
OpenProcessToken
CheckTokenMembership
GetSidSubAuthority
CreateProcessWithLogonW
AdjustTokenPrivileges
AllocateAndInitializeSid
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteValueA
RegSetValueExA
QueryServiceStatus
DeleteService
ChangeServiceConfigA
StartServiceA
CreateServiceA
ControlService
QueryServiceConfigA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatusEx
InitializeSecurityDescriptor
RegEnumKeyExA
RegDeleteKeyA
RegQueryValueExA

psapi

GetModuleFileNameExA

ws2_32

recvfrom
sendto
WSASetLastError
htons
ntohs
ntohl
bind
socket
select
__WSAFDIsSet
gethostbyname
connect
setsockopt
WSAStartup
inet_addr
WSAGetLastError
htonl
closesocket

wininet

InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetOpenA
HttpSendRequestA
InternetQueryDataAvailable
InternetConnectA
HttpQueryInfoA
HttpOpenRequestA
InternetCloseHandle

ole32

CoCreateInstance
CoUninitialize
CoInitialize

Sections

.text
Size: 160KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48ebc8434e9e0eb56ebde04044c51b12

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

psapi

ws2_32

wininet

ole32

Sections

.text Size: 160KB - Virtual size: 156KB

.rdata Size: 40KB - Virtual size: 38KB

.data Size: 16KB - Virtual size: 46KB

.rsrc Size: 8KB - Virtual size: 6KB

.text
Size: 160KB - Virtual size: 156KB

.rdata
Size: 40KB - Virtual size: 38KB

.data
Size: 16KB - Virtual size: 46KB

.rsrc
Size: 8KB - Virtual size: 6KB