ToDeSK_X64_4[.]7[.]4[.]7[.]exe[.]v

General

Target
ToDeSK_X64_4.7.4.7.exe.v
Size 56.3MB
Sample240915-vpe5asteph
SHA256 0e494e451e402ab67b754b81a933600fe49c71a780c9aebb85153708938ba3b2
MD5 9909bb084a348057725ad3e8ddb0a0e5
SHA1 ccb9413442b58b3d34ac9299a82cd721c1acea29
SHA512 a7fc3a92a65f3b4f2d86138960ccaef2b9d1d44a02e0bf18a1d07f9687e15bcf390e3eb966fcfcbe7b940d60e455488f3e01d344fd7f3672d258e45db12ec404
SSDEEP 786432:MF0RxYqkGWDfPUzHixmoxlKG/zUmKGCM5jz44CrM9qAG9uE0wj0YM2xmoxsfrXC2:A6kGMsH8m+ZKHMdC4989OwjEznjXDn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ToDeSK_X64_4.7.4.7.exe.v

File Explorer

ToDeSK_X64_4.7.4.7.exe.v

.exe 56.3MB

ToDeSK_X64_4.7.4.7.exe.v

IMPHASH d25b29054fccfd62c3ed5a8a3d014883
SHA256 0e494e451e402ab67b754b81a933600fe49c71a780c9aebb85153708938ba3b2
MD5 9909bb084a348057725ad3e8ddb0a0e5
SHA1 ccb9413442b58b3d34ac9299a82cd721c1acea29
SHA512 a7fc3a92a65f3b4f2d86138960ccaef2b9d1d44a02e0bf18a1d07f9687e15bcf390e3eb966fcfcbe7b940d60e455488f3e01d344fd7f3672d258e45db12ec404
SSDEEP 786432:MF0RxYqkGWDfPUzHixmoxlKG/zUmKGCM5jz44CrM9qAG9uE0wj0YM2xmoxsfrXC2:A6kGMsH8m+ZKHMdC4989OwjEznjXDn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1186773

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW GetLastError SizeofResource LockResource LoadResource FindResourceW FindResourceExW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap InterlockedDecrement InterlockedIncrement EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW SetEvent InitializeCriticalSection lstrcpynW WaitForSingleObject CreateThread GetProcAddress LoadLibraryExW DecodePointer Sleep GetDiskFreeSpaceExW GetExitCodeThread GetCurrentProcessId CreateDirectoryW FreeLibrary GetSystemDirectoryW lstrlenW GetVersionExW lstrcmpiW GetModuleHandleW LoadLibraryW GetDriveTypeW CompareStringW GetTempPathW GetSystemTime SystemTimeToFileTime GetTempFileNameW FindFirstFileW RemoveDirectoryW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW SetFileAttributesW GetFileTime CopyFileW ReadFile FindClose MultiByteToWideChar WideCharToMultiByte InterlockedExchange GetCurrentProcess GetSystemInfo WaitForMultipleObjects WriteConsoleW VirtualProtect VirtualQuery LoadLibraryExA GetShortPathNameW GetStringTypeW SetUnhandledExceptionFilter FormatMessageW GetEnvironmentVariableW GetEnvironmentStringsW LocalFree LoadLibraryA GetModuleFileNameA GetFullPathNameW GetCurrentThread SetFilePointer FlushFileBuffers SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW CreateProcessW GetExitCodeProcess GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultLangID GetWindowsDirectoryW FileTimeToSystemTime CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent MoveFileW GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetLocalTime CreateNamedPipeW ConnectNamedPipe TerminateThread LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetCPInfo LCMapStringW WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW QueryPerformanceCounter RtlUnwind QueryPerformanceFrequency GetACP ExitProcess GetModuleHandleExW GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode IsValidCodePage GetOEMCP SetFilePointerEx FindFirstFileExW GetCommandLineA FreeEnvironmentStringsW SetStdHandle ReadConsoleW

Sharing