SHCORE[.]hta | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

SHCORE.hta
Size

4.4MB
MD5

b73cace3090effff6a7c1de437e07303
SHA1

d222c57dfdc89367278a1b1b3b2c999299ab6b81
SHA256

2220882880358cf636d7e4f459344b45481497f12a1e2d0032e7a2f3c3838033
SHA512

9bdecd6e2ea120f67103e46a42352f3466d8588f0ea902ad5373f0b91d590b16aec91ca96cc14c03eedcc7f5ac0c91d62a872672b1cb2b469c24e1641914efbd
SSDEEP

49152:0DWNeRXeygWDWNeRXeygRDWNeRXeygbDWNeRXeygA:DNeRuygFNeRuygkNeRuygmNeRuygA

Score

1^/10

Malware Config

Signatures

Files

SHCORE.hta
.exe windows:10 windows x86 arch:x86

a5b342876de608c0620c29896bcc1908

Code Sign

6b:93:ac:64:d8:b7:61:47:b0:31:38:9d:7d:8b:04:79
Certificate

Issuer

CN=Nthouner DI

Not Before

31-12-2018 21:00

Not After

31-12-2098 21:00

Subject

CN=Nthouner DI

Extended Key Usages

ExtKeyUsageCodeSigning

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07-11-2023 17:13

Not After

09-12-2034 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10-12-2014 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8e:cb:40:65:24:36:b9:2e:32:e4:3a:f7:98:46:23:80:a1:13:38:5c:b8:80:c8:f7:97:9b:12:6b:ef:10:5a:a1:33:99:33:c1:e5:ce:c5:a3:0b:88:28:64:56:e1:7b:a4:62:e0:de:59:34:4e:de:b3:06:6c:57:51:17:bd:60:c3
Signer

Actual PE Digest

8e:cb:40:65:24:36:b9:2e:32:e4:3a:f7:98:46:23:80:a1:13:38:5c:b8:80:c8:f7:97:9b:12:6b:ef:10:5a:a1:33:99:33:c1:e5:ce:c5:a3:0b:88:28:64:56:e1:7b:a4:62:e0:de:59:34:4e:de:b3:06:6c:57:51:17:bd:60:c3

Digest Algorithm

sha512

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mstsc.pdb

Imports

user32

IsRectEmpty
PtInRect
GetClassInfoW
DefDlgProcW
RegisterClassW
MessageBoxW
GetMenuItemCount
InsertMenuItemW
AllowSetForegroundWindow
CreateDialogParamW
DialogBoxParamW
CharNextW
LoadAcceleratorsW
MsgWaitForMultipleObjectsEx
PeekMessageW
MonitorFromWindow
SystemParametersInfoW
LoadStringW
SetProcessDPIAware
GetKeyboardLayout
CharLowerW
EnumDisplayDevicesW
FillRect
CheckRadioButton
DrawIconEx
GetWindow
MapDialogRect
ScreenToClient
SubtractRect
GetMonitorInfoW
GetWindowDC
GetFocus
DrawTextW
EnumDisplayMonitors
IsDlgButtonChecked
GetDlgItemTextW
CreateDialogIndirectParamW
EndPaint
DrawIcon
BeginPaint
SendDlgItemMessageW
MapWindowPoints
ReleaseDC
GetDC
IsWindowEnabled
UnregisterClassA
SetTimer
GetMenu
KillTimer
ShowWindowAsync
AdjustWindowRectEx
EnumDisplaySettingsExW
GetCursorPos
GetTitleBarInfo
SendInput
EqualRect
EnableWindow
IsWindowVisible
SetWindowRgn
LockWindowUpdate
UpdateWindow
InvalidateRect
SetWindowTextW
EnableMenuItem
CheckMenuItem
SetMenuItemInfoW
UnregisterClassW
GetClassInfoExW
ShowWindow
MoveWindow
GetClientRect
SetWindowPlacement
IsZoomed
LoadCursorW
SetCursor
ModifyMenuW
GetSystemMenu
GetMenuItemInfoW
DeleteMenu
CreateMenu
InsertMenuW
AppendMenuW
PostQuitMessage
IsWindow
DestroyIcon
LoadImageW
RegisterWindowMessageW
SetRect
CopyRect
GetDesktopWindow
SetWindowPos
IntersectRect
OffsetRect
SystemParametersInfoA
GetWindowRect
GetWindowPlacement
IsIconic
GetSystemMetrics
LoadIconW
SetForegroundWindow
DefWindowProcW
GetWindowLongW
SetWindowLongW
RegisterClassExW
IsChild
CreateWindowExW
DestroyWindow
GetDlgItem
SetFocus
SetDlgItemTextW
EndDialog
CheckDlgButton
SendMessageW
PostMessageW
PostThreadMessageW
IsDialogMessageW
TranslateAcceleratorW
DispatchMessageW
TranslateMessage
GetMessageW
CharUpperW
RedrawWindow

msvcrt

?terminate@@YAXXZ
wcstok
realloc
_errno
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_acmdln
_initterm
__setusermatherr
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
memcmp
__p__commode
_controlfp
calloc
_callnewh
iswdigit
_ltow_s
__CxxFrameHandler3
_wcslwr_s
towlower
wcstol
iswspace
toupper
wcstombs_s
_itow_s
wcstoul
towupper
wcschr
_wcsnicmp
_vsnprintf
swscanf_s
_ftol2_sse
_ftol2
wcsstr
_wtoi
memcpy
memmove
_amsg_exit
wcsrchr
wcsncmp
_wtol
wcstok_s
_wcsicmp
_purecall
wcscat_s
wcscpy_s
free
malloc
wcsncpy_s
memcpy_s
_vsnwprintf
_XcptFilter
wcsncat_s
time
gmtime
wcsftime
_CIpow
memset

shlwapi

PathFindFileNameW
StrStrIW
PathFindExtensionW
PathStripPathW
PathRemoveFileSpecW
PathAppendW
ShellMessageBoxW

ntdll

VerSetConditionMask
RtlInitString
RtlNtStatusToDosError

api-ms-win-core-featurestaging-l1-1-0

RecordFeatureUsage
GetFeatureEnabledState
SubscribeFeatureStateChangeNotification
UnsubscribeFeatureStateChangeNotification

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

shcore

SHStrDupW
SHCreateMemStream

dwmapi

DwmGetWindowAttribute

wtsapi32

WTSQuerySessionInformationW
WTSOpenServerW
WTSFreeMemory
WTSCloseServer

kernel32

FreeLibrary
TrySubmitThreadpoolCallback
CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CreateThreadpool
InitializeCriticalSectionAndSpinCount
FindResourceW
LoadLibraryA
GetProcessId
TerminateThread
ProcessIdToSessionId
GetComputerNameW
InitOnceExecuteOnce
ExpandEnvironmentStringsW
LockResource
GetOverlappedResult
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
DisconnectNamedPipe
CreateThreadpoolIo
CancelThreadpoolIo
StartThreadpoolIo
CloseThreadpoolIo
WaitForThreadpoolIoCallbacks
QueueUserWorkItem
ResetEvent
CreateSemaphoreW
FreeLibraryAndExitThread
GetExitCodeThread
WaitForMultipleObjects
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerExW
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
WideCharToMultiByte
K32GetModuleFileNameExW
Sleep
HeapSetInformation
GetSystemDirectoryW
CreateProcessW
GetCurrentThread
GetTickCount64
WriteFile
VerifyVersionInfoW
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesExW
GetTempPathW
CompareStringW
SetFilePointer
GetACP
GetFullPathNameW
CreateThreadpoolTimer
CompareStringOrdinal
GetFileAttributesW
LocalAlloc
CreateDirectoryW
SearchPathW
GetCurrentDirectoryW
LocalFree
LoadLibraryW
GetCurrentProcess
TerminateProcess
GetStartupInfoA
MulDiv
lstrcmpW
GetVersionExA
GetVersionExW
ReadFile
GetFileSize
CreateFileW
GetDateFormatW
GetTimeFormatW
GetLocalTime
DeleteFileW
CreateThread
CreateEventW
DeleteCriticalSection
SetEvent
LeaveCriticalSection
EnterCriticalSection
SystemTimeToFileTime
MapViewOfFile
CreateFileMappingW
LCIDToLocaleName
UnmapViewOfFile
GetLocaleInfoW
GetUserDefaultUILanguage
GetLocaleInfoEx
GetSystemDefaultUILanguage
DelayLoadFailureHook
ResolveDelayLoadedAPI
InitializeCriticalSection
GetCommandLineW
GetModuleHandleExA
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
LoadLibraryExW
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
GetProcAddress
HeapAlloc
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
QueryPerformanceFrequency
TlsSetValue
OpenThread
TlsFree
TlsGetValue
SwitchToThread
GetSystemInfo
TlsAlloc
GetSystemTime

normaliz

IdnToAscii

api-ms-win-core-path-l1-1-0

PathCchRemoveExtension
PathAllocCombine

Sections

.text
Size: 1016KB - Virtual size: 1016KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5b342876de608c0620c29896bcc1908

Code Sign

6b:93:ac:64:d8:b7:61:47:b0:31:38:9d:7d:8b:04:79Certificate

Extended Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

8e:cb:40:65:24:36:b9:2e:32:e4:3a:f7:98:46:23:80:a1:13:38:5c:b8:80:c8:f7:97:9b:12:6b:ef:10:5a:a1:33:99:33:c1:e5:ce:c5:a3:0b:88:28:64:56:e1:7b:a4:62:e0:de:59:34:4e:de:b3:06:6c:57:51:17:bd:60:c3Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

msvcrt

shlwapi

ntdll

api-ms-win-core-featurestaging-l1-1-0

version

shcore

dwmapi

wtsapi32

kernel32

normaliz

api-ms-win-core-path-l1-1-0

Sections

.text Size: 1016KB - Virtual size: 1016KB

.data Size: 3KB - Virtual size: 9KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 1KB - Virtual size: 1KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 76KB - Virtual size: 75KB

6b:93:ac:64:d8:b7:61:47:b0:31:38:9d:7d:8b:04:79
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

8e:cb:40:65:24:36:b9:2e:32:e4:3a:f7:98:46:23:80:a1:13:38:5c:b8:80:c8:f7:97:9b:12:6b:ef:10:5a:a1:33:99:33:c1:e5:ce:c5:a3:0b:88:28:64:56:e1:7b:a4:62:e0:de:59:34:4e:de:b3:06:6c:57:51:17:bd:60:c3
Signer

.text
Size: 1016KB - Virtual size: 1016KB

.data
Size: 3KB - Virtual size: 9KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 76KB - Virtual size: 75KB