abf2821fb07af7aba3dd4339a899b5dc163ac1dc3e14204a9679bdd393b5d6a3

Sharing

Copy URL Twitter E-mail

General

Target
abf2821fb07af7aba3dd4339a899b5dc163ac1dc3e14204a9679bdd393b5d6a3
Size 4.8MB
Sample241017-fpkmfstbjh
SHA256 abf2821fb07af7aba3dd4339a899b5dc163ac1dc3e14204a9679bdd393b5d6a3
MD5 0dda3ccc5394836cac94dde09d6e9175
SHA1 967a5befbd27d194a4650a7349f80c7cbb27e8ca
SHA512 7de174bed24779ccaacfde11c8d9fdd3c1864f4415b8a9566233df54dc06ad5389b6fc2ac3b34673178a64598bcf4bcf38be9b1f580b3ee3006a8b06a422491d
SSDEEP 98304:gVeM4VwHuokyfC8PGcx2HynIiprw0F80XZrjnJ:GAVwykx2SnIe84XnJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
abf2821fb07af7aba3dd4339a899b5dc163ac1dc3e14204a9679bdd393b5d6a3

File Explorer

abf2821fb07af7aba3dd4339a899b5dc163ac1dc3e14204a9679bdd393b5d6a3

.exe 4.8MB

abf2821fb07af7aba3dd4339a899b5dc163ac1dc3e14204a9679bdd393b5d6a3

IMPHASH a52b0d6e68a672369339ad8663ac1b80
SHA256 abf2821fb07af7aba3dd4339a899b5dc163ac1dc3e14204a9679bdd393b5d6a3
MD5 0dda3ccc5394836cac94dde09d6e9175
SHA1 967a5befbd27d194a4650a7349f80c7cbb27e8ca
SHA512 7de174bed24779ccaacfde11c8d9fdd3c1864f4415b8a9566233df54dc06ad5389b6fc2ac3b34673178a64598bcf4bcf38be9b1f580b3ee3006a8b06a422491d
SSDEEP 98304:gVeM4VwHuokyfC8PGcx2HynIiprw0F80XZrjnJ:GAVwykx2SnIe84XnJ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

650276

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\install_project\install_main\install_and_uninstall\Release\Install.pdb

kernel32

GetStartupInfoW GetVersion GetPrivateProfileStringW GetPrivateProfileIntW OpenEventW GlobalAddAtomW GetFileSizeEx GetCommandLineW DecodePointer LoadLibraryExW lstrcmpiW LoadLibraryA CopyFileW VirtualAllocEx VirtualFreeEx ReadProcessMemory CreateProcessW OutputDebugStringA ResetEvent GetSystemInfo GetLongPathNameW GlobalFree GlobalUnlock GlobalLock GlobalAlloc WaitForMultipleObjects CreateDirectoryW GetShortPathNameW FormatMessageW GetEnvironmentVariableW IsDebuggerPresent EncodePointer InitializeSListHead WriteProcessMemory GetTempFileNameW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetSystemDirectoryW GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceExW WideCharToMultiByte MoveFileW lstrlenW GetWindowsDirectoryW SetLastError GetTempPathW SetFileAttributesW RemoveDirectoryW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateEventW LocalAlloc GetTickCount Sleep GetLastError WritePrivateProfileStringW WriteConsoleW ReadConsoleW SetStdHandle WaitForSingleObjectEx SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCurrentThread GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetACP GetModuleFileNameA GetCurrentDirectoryW SetCurrentDirectoryW GetExitCodeProcess TerminateProcess GetCurrentProcess GetCurrentThreadId InitializeCriticalSectionEx RaiseException MultiByteToWideChar UnlockFile LockFile GetFileSize MulDiv Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalFindAtomW GlobalDeleteAtom OpenProcess GetCurrentProcessId MoveFileExW FindResourceW SizeofResource LockResource LoadResource GetModuleHandleW GetModuleFileNameW FreeLibrary FindResourceExW GetVersionExW DeviceIoControl UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileAttributesExW CreateFileW LoadLibraryW DosDateTimeToFileTime GetProcAddress GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy OutputDebugStringW SetFilePointer ReadFile LocalFileTimeToFileTime GetTempFileNameA GetTempPathA CloseHandle InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent CreateMutexW WaitForSingleObject LocalFree SetEvent VirtualAlloc VirtualFree LoadLibraryExA GetStringTypeW InitializeCriticalSectionAndSpinCount SwitchToThread ExitProcess GetTimeZoneInformation GetModuleHandleExW TlsAlloc FreeLibraryAndExitThread ResumeThread ExitThread CreateThread InterlockedFlushSList RtlUnwind FileTimeToDosDateTime TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo OpenFileMappingW UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter FlushFileBuffers SetFileTime SearchPathW FindFirstChangeNotificationW FindCloseChangeNotification CompareFileTime GetFileInformationByHandle SetEndOfFile GetStdHandle InterlockedCompareExchange FreeResource GetSystemWindowsDirectoryW lstrcmpA lstrcmpiA FileTimeToLocalFileTime WriteFile DeleteFileA CreateFileA SystemTimeToFileTime GetSystemTime GetFileTime ReleaseMutex FindNextFileA FindFirstFileA GetLocalTime

user32

UnhookWinEvent SetWinEventHook wsprintfW SetTimer KillTimer DrawTextW GetWindowTextLengthW GetMessageW TranslateMessage DispatchMessageW PeekMessageW GetDC ReleaseDC SendMessageW ShowWindow IsWindowVisible IsIconic SetForegroundWindow FindWindowExW GetWindowThreadProcessId PostMessageW IsWindow SetCursor SetRect OffsetRect LoadCursorW ScreenToClient PtInRect CopyRect DrawFocusRect BeginPaint EndPaint IsRectEmpty DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW InvalidateRect GetClientRect GetWindowRect GetWindowLongW SetWindowLongW GetParent UpdateLayeredWindow SetWindowPos SetWindowRgn SystemParametersInfoW WaitForInputIdle GetSystemMetrics GetShellWindow MonitorFromWindow UnregisterClassA SendNotifyMessageW SendMessageTimeoutW RegisterWindowMessageW MessageBoxW IsDialogMessageW EndDialog DialogBoxParamW DestroyWindow EnableWindow FindWindowW RedrawWindow GetMonitorInfoW LoadImageW GetWindow MapWindowPoints SetWindowTextW BringWindowToTop MoveWindow PostQuitMessage ExitWindowsEx SetProcessDPIAware CharNextW GetWindowTextW

gdi32

SaveDC RestoreDC SetTextColor SetBkMode CreateRectRgn CombineRgn SetViewportOrgEx CreateCompatibleDC CreateCompatibleBitmap BitBlt ExtTextOutW SetBkColor DeleteDC SelectObject GetTextExtentPoint32W GetDeviceCaps CreateFontIndirectW EnumFontFamiliesW DeleteObject CreateFontW

advapi32

BuildExplicitAccessWithNameW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegSetValueExW RegQueryInfoKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegEnumValueW DuplicateTokenEx RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken UnlockServiceDatabase StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceLockStatusW QueryServiceConfig2W QueryServiceConfigW OpenServiceW OpenSCManagerW LockServiceDatabase DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW GetUserNameW AllocateAndInitializeSid CheckTokenMembership FreeSid DeleteAce EqualSid LookupAccountSidW LookupAccountNameW SetEntriesInAclW GetExplicitEntriesFromAclW GetNamedSecurityInfoW SetNamedSecurityInfoW GetTokenInformation GetTrusteeNameW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt CryptDecrypt CryptContextAddRef RegGetValueW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW SHGetPathFromIDListW SHFileOperationW ord165 SHCreateDirectoryExW SHGetSpecialFolderLocation SHBrowseForFolderW SHLoadInProc ShellExecuteW ShellExecuteExW SHChangeNotify SHGetDesktopFolder

ole32

CoCreateGuid CoInitializeSecurity CoSetProxyBlanket CoInitialize CoTaskMemRealloc CoTaskMemAlloc CoUninitialize StringFromGUID2 CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance CoInitializeEx OleRun

oleaut32

VariantCopy CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo VariantInit SysStringLen VariantClear SysAllocStringByteLen SysStringByteLen SysFreeString SysAllocString VarUI4FromStr

shlwapi

PathAppendA PathFindFileNameA PathRenameExtensionA PathAppendW PathCombineW PathFileExistsW PathRemoveFileSpecW PathFindExtensionW wnsprintfW StrCmpW PathFindFileNameW SHGetValueW PathUnquoteSpacesW SHSetValueW PathIsPrefixW PathIsRelativeW PathIsRootW SHSetValueA AssocQueryStringW StrStrIW SHDeleteValueW StrStrIA StrCmpNIW StrTrimA StrCmpIW StrToIntExW SHGetValueA PathIsDirectoryW SHDeleteKeyW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipCreateSolidFill GdipGraphicsClear GdipDrawImagePointRectI GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipMeasureString GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageRectRect GdipDrawImageRectRectI GdipCloneBrush GdipDeleteBrush GdipDrawString GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipSetTextRenderingHint GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipFillRectangleI

cabinet

ord23 ord20 ord22

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW EnumProcesses

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

secur32

GetUserNameExW

crypt32

CryptBinaryToStringW CryptBinaryToStringA CertGetNameStringW CryptStringToBinaryW CryptStringToBinaryA

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

generic

count=18, id=241, version=40116,

count=174, id=243, version=40116,

count=31, id=242, version=40116,

count=6, id=261, version=27031,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=21, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=261, version=27032,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=35, id=260, version=26706,

count=78, id=261, version=26706,

count=4, id=206, version=65501,

count=3, id=208, version=65501,

count=41, id=203, version=65501,

count=487, id=1, productName=Unmarked objects,

count=1, id=260, version=27051,

count=100, id=261, version=27051,

count=1, id=256, version=27051,

count=1, id=255, version=27051,

count=2, id=151,

count=1, id=258, version=27051,