6635ea634f2a2ed37a108e5ab3f97363b7c4001a0193c533b620dd697ad4459d

Sharing

Copy URL Twitter E-mail

General

Target
6635ea634f2a2ed37a108e5ab3f97363b7c4001a0193c533b620dd697ad4459d
Size 4.8MB
Sample241019-slw8assene
SHA256 6635ea634f2a2ed37a108e5ab3f97363b7c4001a0193c533b620dd697ad4459d
MD5 424b94bfe19b5daadb5b801eeaee21d7
SHA1 02c54fff5196e96e4e3c8b7f61d79f65482008d3
SHA512 cb5b65b41a79a6d4f2ac528bb6314651479a954e47a5c14384c8ea008eb5b89be8f346ce9e65b2a79ecda128202559137f366a4aea2db04dcee46502552df7d3
SSDEEP 98304:5VeM4VwHuokyfC8PGcx2HynIiprw0F80XZ4rA/:PAVwykx2SnIe846A/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6635ea634f2a2ed37a108e5ab3f97363b7c4001a0193c533b620dd697ad4459d

File Explorer

6635ea634f2a2ed37a108e5ab3f97363b7c4001a0193c533b620dd697ad4459d

.exe 4.8MB

6635ea634f2a2ed37a108e5ab3f97363b7c4001a0193c533b620dd697ad4459d

IMPHASH a52b0d6e68a672369339ad8663ac1b80
SHA256 6635ea634f2a2ed37a108e5ab3f97363b7c4001a0193c533b620dd697ad4459d
MD5 424b94bfe19b5daadb5b801eeaee21d7
SHA1 02c54fff5196e96e4e3c8b7f61d79f65482008d3
SHA512 cb5b65b41a79a6d4f2ac528bb6314651479a954e47a5c14384c8ea008eb5b89be8f346ce9e65b2a79ecda128202559137f366a4aea2db04dcee46502552df7d3
SSDEEP 98304:5VeM4VwHuokyfC8PGcx2HynIiprw0F80XZ4rA/:PAVwykx2SnIe846A/
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

650276

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\install_project\install_main\install_and_uninstall\Release\Install.pdb

kernel32

GetStartupInfoW GetVersion GetPrivateProfileStringW GetPrivateProfileIntW OpenEventW GlobalAddAtomW GetFileSizeEx GetCommandLineW DecodePointer LoadLibraryExW lstrcmpiW LoadLibraryA CopyFileW VirtualAllocEx VirtualFreeEx ReadProcessMemory CreateProcessW OutputDebugStringA ResetEvent GetSystemInfo GetLongPathNameW GlobalFree GlobalUnlock GlobalLock GlobalAlloc WaitForMultipleObjects CreateDirectoryW GetShortPathNameW FormatMessageW GetEnvironmentVariableW IsDebuggerPresent EncodePointer InitializeSListHead WriteProcessMemory GetTempFileNameW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetSystemDirectoryW GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceExW WideCharToMultiByte MoveFileW lstrlenW GetWindowsDirectoryW SetLastError GetTempPathW SetFileAttributesW RemoveDirectoryW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateEventW LocalAlloc GetTickCount Sleep GetLastError WritePrivateProfileStringW WriteConsoleW ReadConsoleW SetStdHandle WaitForSingleObjectEx SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCurrentThread GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetACP GetModuleFileNameA GetCurrentDirectoryW SetCurrentDirectoryW GetExitCodeProcess TerminateProcess GetCurrentProcess GetCurrentThreadId InitializeCriticalSectionEx RaiseException MultiByteToWideChar UnlockFile LockFile GetFileSize MulDiv Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalFindAtomW GlobalDeleteAtom OpenProcess GetCurrentProcessId MoveFileExW FindResourceW SizeofResource LockResource LoadResource GetModuleHandleW GetModuleFileNameW FreeLibrary FindResourceExW GetVersionExW DeviceIoControl UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileAttributesExW CreateFileW LoadLibraryW DosDateTimeToFileTime GetProcAddress GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy OutputDebugStringW SetFilePointer ReadFile LocalFileTimeToFileTime GetTempFileNameA GetTempPathA CloseHandle InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent CreateMutexW WaitForSingleObject LocalFree SetEvent VirtualAlloc VirtualFree LoadLibraryExA GetStringTypeW InitializeCriticalSectionAndSpinCount SwitchToThread ExitProcess GetTimeZoneInformation GetModuleHandleExW TlsAlloc FreeLibraryAndExitThread ResumeThread ExitThread CreateThread InterlockedFlushSList RtlUnwind FileTimeToDosDateTime TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo OpenFileMappingW UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter FlushFileBuffers SetFileTime SearchPathW FindFirstChangeNotificationW FindCloseChangeNotification CompareFileTime GetFileInformationByHandle SetEndOfFile GetStdHandle InterlockedCompareExchange FreeResource GetSystemWindowsDirectoryW lstrcmpA lstrcmpiA FileTimeToLocalFileTime WriteFile DeleteFileA CreateFileA SystemTimeToFileTime GetSystemTime GetFileTime ReleaseMutex FindNextFileA FindFirstFileA GetLocalTime

user32

UnhookWinEvent SetWinEventHook wsprintfW SetTimer KillTimer DrawTextW GetWindowTextLengthW GetMessageW TranslateMessage DispatchMessageW PeekMessageW GetDC ReleaseDC SendMessageW ShowWindow IsWindowVisible IsIconic SetForegroundWindow FindWindowExW GetWindowThreadProcessId PostMessageW IsWindow SetCursor SetRect OffsetRect LoadCursorW ScreenToClient PtInRect CopyRect DrawFocusRect BeginPaint EndPaint IsRectEmpty DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW InvalidateRect GetClientRect GetWindowRect GetWindowLongW SetWindowLongW GetParent UpdateLayeredWindow SetWindowPos SetWindowRgn SystemParametersInfoW WaitForInputIdle GetSystemMetrics GetShellWindow MonitorFromWindow UnregisterClassA SendNotifyMessageW SendMessageTimeoutW RegisterWindowMessageW MessageBoxW IsDialogMessageW EndDialog DialogBoxParamW DestroyWindow EnableWindow FindWindowW RedrawWindow GetMonitorInfoW LoadImageW GetWindow MapWindowPoints SetWindowTextW BringWindowToTop MoveWindow PostQuitMessage ExitWindowsEx SetProcessDPIAware CharNextW GetWindowTextW

gdi32

SaveDC RestoreDC SetTextColor SetBkMode CreateRectRgn CombineRgn SetViewportOrgEx CreateCompatibleDC CreateCompatibleBitmap BitBlt ExtTextOutW SetBkColor DeleteDC SelectObject GetTextExtentPoint32W GetDeviceCaps CreateFontIndirectW EnumFontFamiliesW DeleteObject CreateFontW

advapi32

BuildExplicitAccessWithNameW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegSetValueExW RegQueryInfoKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegEnumValueW DuplicateTokenEx RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken UnlockServiceDatabase StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceLockStatusW QueryServiceConfig2W QueryServiceConfigW OpenServiceW OpenSCManagerW LockServiceDatabase DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW GetUserNameW AllocateAndInitializeSid CheckTokenMembership FreeSid DeleteAce EqualSid LookupAccountSidW LookupAccountNameW SetEntriesInAclW GetExplicitEntriesFromAclW GetNamedSecurityInfoW SetNamedSecurityInfoW GetTokenInformation GetTrusteeNameW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt CryptDecrypt CryptContextAddRef RegGetValueW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW SHGetPathFromIDListW SHFileOperationW ord165 SHCreateDirectoryExW SHGetSpecialFolderLocation SHBrowseForFolderW SHLoadInProc ShellExecuteW ShellExecuteExW SHChangeNotify SHGetDesktopFolder

ole32

CoCreateGuid CoInitializeSecurity CoSetProxyBlanket CoInitialize CoTaskMemRealloc CoTaskMemAlloc CoUninitialize StringFromGUID2 CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance CoInitializeEx OleRun

oleaut32

VariantCopy CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo VariantInit SysStringLen VariantClear SysAllocStringByteLen SysStringByteLen SysFreeString SysAllocString VarUI4FromStr

shlwapi

PathAppendA PathFindFileNameA PathRenameExtensionA PathAppendW PathCombineW PathFileExistsW PathRemoveFileSpecW PathFindExtensionW wnsprintfW StrCmpW PathFindFileNameW SHGetValueW PathUnquoteSpacesW SHSetValueW PathIsPrefixW PathIsRelativeW PathIsRootW SHSetValueA AssocQueryStringW StrStrIW SHDeleteValueW StrStrIA StrCmpNIW StrTrimA StrCmpIW StrToIntExW SHGetValueA PathIsDirectoryW SHDeleteKeyW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipCreateSolidFill GdipGraphicsClear GdipDrawImagePointRectI GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipMeasureString GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageRectRect GdipDrawImageRectRectI GdipCloneBrush GdipDeleteBrush GdipDrawString GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipSetTextRenderingHint GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipFillRectangleI

cabinet

ord23 ord20 ord22

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW EnumProcesses

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

secur32

GetUserNameExW

crypt32

CryptBinaryToStringW CryptBinaryToStringA CertGetNameStringW CryptStringToBinaryW CryptStringToBinaryA

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

generic

count=18, id=241, version=40116,

count=174, id=243, version=40116,

count=31, id=242, version=40116,

count=6, id=261, version=27031,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=21, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=261, version=27032,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=35, id=260, version=26706,

count=78, id=261, version=26706,

count=4, id=206, version=65501,

count=3, id=208, version=65501,

count=41, id=203, version=65501,

count=487, id=1, productName=Unmarked objects,

count=1, id=260, version=27051,

count=100, id=261, version=27051,

count=1, id=256, version=27051,

count=1, id=255, version=27051,

count=2, id=151,

count=1, id=258, version=27051,