20240930a4d322325d0dc32fb25c92d786d63b6bicedid

Sharing

Copy URL Twitter E-mail

General

Target

20240930a4d322325d0dc32fb25c92d786d63b6bicedid
Size

2.9MB
MD5

a4d322325d0dc32fb25c92d786d63b6b
SHA1

04aec3a599c0ec0d34e8d27b63095fd8edd273ae
SHA256

604d40f18b58165bb9e31f28ba3829c7e27b45a72942ffd0dc5c7cff812c3307
SHA512

1a64822d6bb081b35be5598d62d10083c75609a6769657275ec9348ffdee2dc5b459b51e363fdf42ebfece7ecd818ad62f1cda8f739c977abd6be7d105f9f203
SSDEEP

49152:naUgqPncwB8Lwh7egA/ZBEqNoe41GesIXO58Eyzj0WsPTg/HIW:nazqkwph7et/Z3Noe47sbSqmIW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20240930a4d322325d0dc32fb25c92d786d63b6bicedid

Files

20240930a4d322325d0dc32fb25c92d786d63b6bicedid
.exe windows:4 windows x86 arch:x86

395b580d5d21c00adaf5373cbb12e691

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\depot\ghost\gsstrunk\ghost\explorer\vs2005\win32\release\enterprise\GhostExp.pdb

Imports

kernel32

BackupSeek
BackupRead
FindNextFileA
IsValidCodePage
IsDBCSLeadByteEx
GetConsoleCP
GetConsoleOutputCP
GetACP
GetSystemTimeAsFileTime
VirtualFree
CreateFileW
ResetEvent
GetLogicalDrives
DefineDosDeviceW
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
VirtualProtect
GetCommandLineA
GetStartupInfoA
ExitProcess
ExitThread
SetHandleCount
GetStdHandle
GetFileType
GetTimeFormatA
GetDateFormatA
LCMapStringA
LCMapStringW
GetFileAttributesW
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
FatalAppExitA
SetConsoleCtrlHandler
GetTimeZoneInformation
GetConsoleMode
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
WriteConsoleA
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
GetDiskFreeSpaceW
GetFileInformationByHandle
GetBinaryTypeA
RemoveDirectoryA
ExpandEnvironmentStringsW
GetTempPathA
CreateDirectoryA
GetTempFileNameA
lstrcpyA
GetDriveTypeA
GetLogicalDriveStringsA
GetExitCodeThread
TerminateThread
IsBadWritePtr
GlobalMemoryStatus
GetProcessHeap
HeapAlloc
HeapFree
DeviceIoControl
GetLocaleInfoW
GetSystemTime
GetLocalTime
VirtualProtectEx
GetVersionExW
GetStringTypeA
VirtualQuery
GetThreadContext
FindResourceExA
Sleep
CreateThread
OutputDebugStringA
GetOverlappedResult
VirtualUnlock
GetProcessWorkingSetSize
SetProcessWorkingSetSize
VirtualLock
GetWindowsDirectoryA
GetSystemDirectoryA
WaitForMultipleObjects
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
GetProfileIntA
InterlockedCompareExchange
SetCurrentDirectoryW
CreateEventW
GetSystemInfo
VirtualAlloc
InitializeCriticalSectionAndSpinCount
DebugBreak
IsDebuggerPresent
GetFileTime
GetFileAttributesA
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
SetErrorMode
SystemTimeToFileTime
FileTimeToSystemTime
GetCurrentDirectoryA
GetAtomNameA
GetOEMCP
GetCPInfo
GlobalFlags
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetTickCount
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
CreateFileA
GetShortPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
DeleteFileA
MoveFileA
GetCurrentProcessId
CreateEventA
SuspendThread
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
GetVersionExA
FreeLibrary
InterlockedDecrement
GetModuleFileNameW
GlobalFree
CopyFileA
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
MulDiv
SetLastError
SetProcessAffinityMask
GetModuleHandleA
GetModuleFileNameA
GetFullPathNameA
SetCurrentDirectoryA
GetLongPathNameA
LoadLibraryA
GetProcAddress
GetDiskFreeSpaceA
GetStringTypeExW
GetStringTypeExA
GetEnvironmentVariableW
GetEnvironmentVariableA
lstrlenA
lstrcmpiW
lstrcmpiA
CompareStringW
CompareStringA
lstrlenW
GetCurrentThread
GetCurrentProcess
CloseHandle
ReadProcessMemory
GetVersion
FindResourceA
LoadResource
LockResource
SizeofResource
GetLastError
WideCharToMultiByte
MultiByteToWideChar
FreeEnvironmentStringsA
InterlockedExchange

user32

CheckMenuItem
GetWindowThreadProcessId
SetRectEmpty
IsZoomed
GetDesktopWindow
CreateDialogIndirectParamA
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetMessageA
TranslateMessage
GetActiveWindow
GetCursorPos
ValidateRect
PostQuitMessage
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
SetFocus
GetWindowTextLengthA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EnableMenuItem
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
IsDialogMessageA
SetWindowTextA
MoveWindow
ModifyMenuA
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
ShowWindow
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
EnableWindow
SetForegroundWindow
ShowScrollBar
IsWindowVisible
GetMenu
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
GetParent
EqualRect
DeferWindowPos
CopyRect
GetScrollInfo
SetScrollInfo
PtInRect
SetWindowPlacement
GetDlgCtrlID
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
SetCursor
ShowOwnedPopups
RegisterClipboardFormatA
GetSysColorBrush
LoadCursorA
UnregisterClassA
CheckDlgButton
CheckRadioButton
GetDlgItemInt
GetDlgItemTextA
SetDlgItemInt
SetDlgItemTextA
EndDeferWindowPos
IsDlgButtonChecked
GetClientRect
GetDC
ReleaseDC
UpdateWindow
MessageBoxA
CharLowerA
CharLowerW
CharUpperA
CharUpperW
SendMessageA
GetWindowTextA
EnumWindows
RemoveMenu
GetSubMenu
GetMenuItemCount
InsertMenuA
LoadMenuA
GetMenuItemID
AppendMenuA
GetMenuStringA
GetMenuState
UnhookWindowsHookEx
FillRect
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
ScreenToClient
ClientToScreen
GetWindowDC
BeginPaint
EndPaint
ScrollWindowEx
InflateRect
GetMenuItemInfoA
DestroyMenu
DeleteMenu
GetDialogBaseUnits
TranslateAcceleratorA
SetMenu
BringWindowToTop
CreatePopupMenu
InsertMenuItemA
InvalidateRect
LoadAcceleratorsA
ReleaseCapture
ReuseDDElParam
UnpackDDElParam
SetRect
SetTimer
KillTimer
WindowFromPoint
DestroyIcon
SetCapture
WaitMessage
PostThreadMessageA
MessageBeep
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
RegisterDeviceNotificationA
LockWindowUpdate
GetDCEx
UnionRect
SetParent
GetSystemMenu
IsRectEmpty
MapVirtualKeyA
GetKeyState
GetKeyNameTextA
SendNotifyMessageA
GetTabbedTextExtentA
CreateMenu
CopyAcceleratorTableA
DefWindowProcA
CallWindowProcA
GetWindowLongA
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetWindow
GetSysColor
DialogBoxParamA
LoadStringA
wsprintfA
RedrawWindow
SetCursorPos
DestroyCursor
IsClipboardFormatAvailable
MsgWaitForMultipleObjects
FindWindowA
DrawIcon
SetWindowRgn
InSendMessage
WindowFromDC

gdi32

RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreateDIBPatternBrushPt
CreatePatternBrush
CreateBitmap
CreateCompatibleDC
PtVisible
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
GetDCOrgEx
GetPixel
CreateFontIndirectA
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
CreateCompatibleBitmap
GetBkColor
GetCharWidthA
CreateFontA
StretchDIBits
GetStockObject
StartDocA
BitBlt
GetWindowExtEx
GetViewportExtEx
GetObjectA
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetTextColor
SetStretchBltMode
SetROP2
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetViewportOrgEx
Rectangle
CreateEllipticRgn
LPtoDP
Ellipse
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextColor
GetTextAlign
GetTextFaceA
GetWindowOrgEx
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
GetTextMetricsA
GetTextExtentPoint32A
GetDeviceCaps

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter
GetJobA

advapi32

CreateServiceA
StartServiceA
OpenSCManagerA
OpenServiceA
DeleteService
CloseServiceHandle
GetFileSecurityA
SetFileSecurityA
SetFileSecurityW
GetFileSecurityW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA
RegSetValueA
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
ControlService

shell32

ShellExecuteA
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFolderLocation
SHGetFileInfoA
DragFinish
DragQueryFileA
ShellExecuteExA
ExtractIconA
FindExecutableA

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathAddBackslashA
PathRemoveExtensionA
PathFindExtensionA

ole32

OleRun
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
CLSIDFromString
StringFromGUID2
CoDisconnectObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CLSIDFromProgID
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CreateStreamOnHGlobal
OleGetClipboard
DoDragDrop
RegisterDragDrop
CoUninitialize
RevokeDragDrop
OleRegEnumVerbs
OleRegGetMiscStatus
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleSave
WriteClassStm
OleSaveToStream
OleLockRunning
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreate
OleLoad
StgOpenStorageOnILockBytes
GetHGlobalFromILockBytes
OleSetContainedObject
OleCreateFromFile
OleCreateLinkToFile
OleGetIconOfClass
CreateItemMoniker
CreateGenericComposite
OleIsRunning
GetRunningObjectTable
CreateFileMoniker
CoGetMalloc
StgCreateDocfile
StgOpenStorage
StgIsStorageFile
CreateOleAdviseHolder
CreateDataAdviseHolder
OleSetMenuDescriptor
OleQueryCreateFromData
OleQueryLinkFromData
CoInitialize
CoLockObjectExternal
CoCreateInstance

oleaut32

SysAllocString
VarBstrFromDate
VarCyFromStr
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarDateFromStr
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
LoadTypeLi
GetErrorInfo
SetErrorInfo
CreateErrorInfo

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 468KB - Virtual size: 467KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 64KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

395b580d5d21c00adaf5373cbb12e691

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

version

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 468KB - Virtual size: 467KB

.data Size: 64KB - Virtual size: 118KB

.rsrc Size: 280KB - Virtual size: 280KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 468KB - Virtual size: 467KB

.data
Size: 64KB - Virtual size: 118KB

.rsrc
Size: 280KB - Virtual size: 280KB