a650302a9baa54881262776a4e8780941eb37f605aae0f15d162cc6ccddc9f73N

Sharing

Copy URL

Twitter E-mail

General

Target

a650302a9baa54881262776a4e8780941eb37f605aae0f15d162cc6ccddc9f73N
Size

1.1MB
MD5

dec567b88d27f23db2fcebd3e6048570
SHA1

11778e0b6d7b4b9dba43cdc181f709b651ee535b
SHA256

a650302a9baa54881262776a4e8780941eb37f605aae0f15d162cc6ccddc9f73
SHA512

872144d6a8b00482f90d605a83e88b1878ac01ed3c31e87f00b9cb450f6e6d8181786cea7253462efb910e4006707940101a4776c8f6df63b6c5705a6377c8a6
SSDEEP

12288:66DmZMBAyF9iwO9+BOsg1ZMBXps5n3B1CGeQf:Dm+B9FJZFpI3vbeQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a650302a9baa54881262776a4e8780941eb37f605aae0f15d162cc6ccddc9f73N

Files

a650302a9baa54881262776a4e8780941eb37f605aae0f15d162cc6ccddc9f73N
.exe windows:5 windows x86 arch:x86

ebcbd8efe4d8d9ac94df2b1bd490f5da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\projects\ProcessHacker2\bin\Release32\ProcessHacker.pdb

Imports

ntdll

NtAllocateVirtualMemory
RtlInterlockedFlushSList
RtlInitializeSListHead
RtlFreeHeap
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteN
RtlInterlockedPopEntrySList
RtlUnicodeToMultiByteSize
RtlInterlockedPushEntrySList
RtlReAllocateHeap
RtlAllocateHeap
RtlRaiseStatus
RtlSubAuthorityCountSid
RtlIdentifierAuthoritySid
NtDebugActiveProcess
NtCreateDebugObject
NtCreateJobObject
NtPowerInformation
NtIsProcessInJob
RtlTimeToSecondsSince1980
RtlQueryDepthSList
RtlSecondsSince1980ToTime
NtAcceptConnectPort
NtReplyWaitReceivePort
NtCreatePort
NtCompleteConnectPort
RtlLengthRequiredSid
NtRequestWaitReplyPort
NtConnectPort
NtResetEvent
NtQueryMutant
NtSetLowEventPair
NtPulseEvent
NtQuerySemaphore
NtSetHighEventPair
NtQueryEvent
NtQueryTimer
NtQuerySection
NtCancelTimer
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlSecondsSince1970ToTime
RtlDestroyHeap
NtProtectVirtualMemory
NtSetSystemInformation
NtCreateMutant
NtTerminateJobObject
NtAssignProcessToJobObject
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlDestroyQueryDebugBuffer
RtlInitializeCriticalSection
NtQueryPerformanceCounter
RtlDeleteCriticalSection
RtlSetHeapInformation
RtlQueryEnvironmentVariable_U
RtlGUIDFromString
RtlDetermineDosPathNameType_U
NtDeleteValueKey
NtWaitForMultipleObjects
NtInitiatePowerAction
NtDelayExecution
NtSetInformationDebugObject
NtRemoveProcessDebug
RtlCreateSecurityDescriptor
RtlCreateProcessParameters
RtlGetFullPathName_U
NtFilterToken
NtQueryValueKey
NtDuplicateToken
RtlInitializeSid
RtlRandomEx
RtlDestroyProcessParameters
RtlFreeUnicodeString
RtlAddAccessAllowedAce
RtlFindMessage
RtlSetDaclSecurityDescriptor
RtlCreateAcl
RtlAddAce
NtQueryAttributesFile
RtlCreateUserProcess
RtlExpandEnvironmentStrings_U
RtlStringFromGUID
RtlGetAce
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlLengthSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
NtReleaseKeyedEvent
RtlLeaveCriticalSection
NtWaitForKeyedEvent
NtCreateKeyedEvent
RtlEnterCriticalSection
NtSetTimer
NtAlertThread
NtCreateTimer
RtlCreateUserThread
NtSuspendThread
NtAdjustPrivilegesToken
NtOpenProcess
NtGetContextThread
NtQueryInformationJobObject
NtQueryVirtualMemory
NtOpenProcessToken
NtSetInformationProcess
NtOpenDirectoryObject
NtReadVirtualMemory
NtResumeProcess
RtlPrefixUnicodeString
NtQueryDirectoryObject
NtOpenSection
NtSetInformationToken
NtOpenThread
NtSetInformationThread
NtQueryDirectoryFile
RtlEqualUnicodeString
NtQuerySymbolicLinkObject
NtCreateKey
NtOpenSymbolicLinkObject
NtOpenThreadToken
NtWriteVirtualMemory
NtTerminateProcess
NtUnloadDriver
NtOpenKey
NtSetContextThread
RtlMultiByteToUnicodeN
RtlUpcaseUnicodeChar
RtlValidSid
RtlNtStatusToDosError
NtAddAtom
NtSuspendProcess
NtResumeThread
RtlUnwind
RtlSubAuthoritySid
RtlLengthSid
RtlConvertSidToUnicodeString
RtlDoesFileExists_U
NtDeleteKey
NtSetValueKey
NtSetInformationObject
NtDeviceIoControlFile
RtlDosPathNameToNtPathName_U
NtReadFile
NtQueryFullAttributesFile
NtOpenFile
RtlFreeAnsiString
NtFlushBuffersFile
NtCreateFile
NtUnlockFile
NtQueryInformationFile
RtlUnicodeStringToAnsiString
NtFsControlFile
NtLockFile
NtWriteFile
NtDuplicateObject
NtQueryObject
NtSetSecurityObject
NtCreateEvent
NtQueryInformationProcess
NtQueryInformationThread
NtTerminateThread
NtQuerySecurityObject
NtSetEvent
NtQueryInformationToken
RtlGetVersion
NtQuerySystemInformation
RtlCreateHeap
NtCreateSection
NtUnmapViewOfSection
NtSetInformationFile
NtMapViewOfSection
NtCreateSemaphore
NtClose
NtWaitForSingleObject
NtReleaseSemaphore
NtFreeVirtualMemory

winsta

WinStationConnectW
WinStationDisconnect
WinStationRegisterConsoleNotification
WinStationReset
WinStationFreeMemory
WinStationQueryInformationW
WinStationFreeGAPMemory
WinStationGetAllProcesses
WinStationShadow
WinStationSendMessageW
WinStationEnumerateW

comctl32

ImageList_SetImageCount
InitCommonControlsEx
CreatePropertySheetPageW
PropertySheetW
ImageList_Remove
ImageList_Create
ImageList_Replace
ImageList_Destroy
ImageList_ReplaceIcon

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

Sleep
GetCurrentProcess
TerminateProcess
TlsFree
GetStartupInfoW
WideCharToMultiByte
GetStdHandle
GetFileType
GetModuleHandleExW
AreFileApisANSI
CloseHandle
GetProcessHeap
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
SetFilePointerEx
HeapReAlloc
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetConsoleCtrlHandler
MulDiv
SetProcessShutdownParameters
FreeLibrary
GetThreadPriority
GetComputerNameW
FindResourceW
LoadResource
SizeofResource
LockResource
MultiByteToWideChar
RaiseException
GetACP
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
HeapFree
HeapAlloc
GetCommandLineW
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
IsValidCodePage
GetOEMCP
GetCPInfo
GetCurrentThreadId
GetConsoleWindow
FreeConsole
AllocConsole
FileTimeToLocalFileTime
FileTimeToSystemTime
SetThreadPriority
SetLastError
GetNumberFormatW
GetTimeFormatW
GetSystemDirectoryW
GetUserDefaultLangID
CreateProcessW
SearchPathW
GetDateFormatW
GetSystemDefaultLangID
LocalFree
LocalAlloc
TlsAlloc
TlsSetValue
TlsGetValue
CreateRemoteThread
GetLastError
ExitThread
ExitProcess
DeleteFiber
GetTickCount
ConvertThreadToFiber
GlobalSize
GlobalFree
GetProcAddress
GlobalUnlock
LoadLibraryW
GlobalAlloc
GetModuleHandleW
GetLocaleInfoW
GlobalLock
CreateThread
LoadLibraryExW
SetStdHandle
OutputDebugStringW
ReadFile
ReadConsoleW
WriteConsoleW
HeapSize
CreateFileW
SetEndOfFile
DeleteCriticalSection

user32

ClientToScreen
SetWindowTextW
DestroyIcon
MapDialogRect
BringWindowToTop
DeleteMenu
GetSystemMenu
IsWindowVisible
CreateDialogParamW
SetDlgItemInt
SendMessageTimeoutW
IsDialogMessageW
LoadAcceleratorsW
IsChild
GetMessageW
TranslateAcceleratorW
SetMenuInfo
DrawMenuBar
GetDlgItem
AppendMenuW
ShowWindowAsync
PostQuitMessage
CreateIconIndirect
IsWindowEnabled
GetDlgItemInt
GetGuiResources
IsHungAppWindow
OpenWindowStationW
GetUserObjectInformationW
CloseDesktop
EnumDesktopsW
OpenDesktopW
GetProcessWindowStation
CloseWindowStation
CreateDialogIndirectParamW
EnumWindows
GetGUIThreadInfo
GetWindowThreadProcessId
GetClassNameW
MonitorFromRect
IsIconic
PostMessageW
SetForegroundWindow
GetMenu
FindWindowW
GetWindowPlacement
SetLayeredWindowAttributes
FindWindowExW
DefWindowProcW
SetWindowLongW
GetWindowLongW
InvalidateRect
RegisterClassExW
BeginPaint
GetClientRect
LoadCursorW
TrackMouseEvent
EndPaint
SendMessageW
RegisterClipboardFormatW
DestroyMenu
GetMenuItemCount
CreatePopupMenu
LoadMenuW
InsertMenuItemW
GetMenuItemInfoW
GetSubMenu
TrackPopupMenu
CallWindowProcW
GetPropW
SetWindowPos
SetPropW
RemovePropW
SetCursor
CreateWindowExW
FrameRect
GetCursorPos
ReleaseDC
GetDCEx
GetDC
GetParent
DrawTextW
FillRect
ScreenToClient
DestroyWindow
SetMenuItemInfoW
EndDeferWindowPos
SetClipboardData
MapWindowPoints
BeginDeferWindowPos
DeferWindowPos
OpenClipboard
EmptyClipboard
EnableMenuItem
GetWindowTextW
LoadIconW
LoadImageW
GetWindowRect
CloseClipboard
GetWindowTextLengthW
SetScrollInfo
SetCaretPos
ReleaseCapture
CreateCaret
EnableScrollBar
GetSysColor
DestroyCaret
RedrawWindow
SetScrollPos
SystemParametersInfoW
GetClipboardData
GetScrollInfo
DragDetect
PtInRect
ShowCaret
SetFocus
GetKeyState
SetCapture
GetIconInfo
DrawIconEx
DispatchMessageW
MoveWindow
GetMonitorInfoW
MessageBoxW
MonitorFromWindow
PeekMessageW
TranslateMessage
MsgWaitForMultipleObjects
GetMessagePos
GetMessageTime
UpdateWindow
GetSystemMetrics
ScrollWindowEx
IsWindow
GetSysColorBrush
ShowWindow
SetCursorPos
GetAsyncKeyState
DrawFocusRect
GetCapture
GetUpdateRect
WaitMessage
MessageBeep
InvalidateRgn
KillTimer
SetTimer
GetUpdateRgn
SetDlgItemTextW
EndDialog
DialogBoxParamW
ExitWindowsEx
LockWorkStation
EnableWindow

gdi32

SetDCBrushColor
DeleteObject
Polyline
GdiAlphaBlend
CreateCompatibleDC
SetBkMode
CreateDIBSection
Polygon
DeleteDC
SetTextColor
GetTextExtentPoint32W
BitBlt
TextOutW
SetBoundsRect
CreateFontW
SelectObject
GetCharWidthW
GetDIBits
RestoreDC
IntersectClipRect
CreateRectRgn
SaveDC
CombineRgn
SetBkColor
ExcludeClipRect
CreateFontIndirectW
GetTextMetricsW
GetClipRgn
GetObjectW
GetDeviceCaps
Rectangle
SetDCPenColor
GetStockObject
CreateCompatibleBitmap
SelectClipRgn

comdlg32

GetSaveFileNameW
GetOpenFileNameW
ChooseColorW
ChooseFontW

advapi32

LsaLookupPrivilegeValue
LsaEnumerateAccounts
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
ChangeServiceConfigW
LsaAddAccountRights
EnumServicesStatusExW
QueryServiceConfigW
ChangeServiceConfig2W
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
OpenServiceW
StartServiceW
ControlService
LsaLookupSids
LsaOpenPolicy
QueryServiceConfig2W
LsaLookupPrivilegeDisplayName
LsaLookupNames2
LsaClose
LsaLookupPrivilegeName
LsaFreeMemory
GetSecurityInfo
SetSecurityInfo
CreateProcessWithLogonW
LogonUserW
LsaEnumeratePrivilegesOfAccount
CreateProcessAsUserW
LsaOpenAccount

shell32

Shell_NotifyIconW
SHGetFolderPathW
ShellExecuteExW
ExtractIconExW
SHGetFileInfoW
DuplicateIcon
SHCreateDirectoryExW

ole32

CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

SysFreeString

Sections

.text
Size: 740KB - Virtual size: 740KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ebcbd8efe4d8d9ac94df2b1bd490f5da

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

winsta

comctl32

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 740KB - Virtual size: 740KB

.rdata Size: 153KB - Virtual size: 152KB

.data Size: 19KB - Virtual size: 37KB

.rsrc Size: 181KB - Virtual size: 181KB

.reloc Size: 45KB - Virtual size: 44KB

.text
Size: 740KB - Virtual size: 740KB

.rdata
Size: 153KB - Virtual size: 152KB

.data
Size: 19KB - Virtual size: 37KB

.rsrc
Size: 181KB - Virtual size: 181KB

.reloc
Size: 45KB - Virtual size: 44KB