d92d2226353a9477ada5c0119427c1730ca469ba792736302ce789bac44446bf

Sharing

Copy URL Twitter E-mail

General

Target
d92d2226353a9477ada5c0119427c1730ca469ba792736302ce789bac44446bf
Size 4.8MB
Sample241110-lpbbnsxmdm
SHA256 d92d2226353a9477ada5c0119427c1730ca469ba792736302ce789bac44446bf
MD5 656db360f77930954f74ab52e617bfc2
SHA1 da33de13505008b19f89a6281957dd50bd05e79d
SHA512 eea19d2456f30c0d6b941d805505eb0cffb864ee495d80447cf2734469bfe4717caa6e02639e47d1fb036ac6cf463d87f618891714dc38b5e344171856bb38e7
SSDEEP 98304:AVeM4VwHuokyft8PGcx2HynIiprw0F80XZNf/:mAVwdkx2SnIe84Nf/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d92d2226353a9477ada5c0119427c1730ca469ba792736302ce789bac44446bf

File Explorer

d92d2226353a9477ada5c0119427c1730ca469ba792736302ce789bac44446bf

.exe 4.8MB

d92d2226353a9477ada5c0119427c1730ca469ba792736302ce789bac44446bf

IMPHASH a52b0d6e68a672369339ad8663ac1b80
SHA256 d92d2226353a9477ada5c0119427c1730ca469ba792736302ce789bac44446bf
MD5 656db360f77930954f74ab52e617bfc2
SHA1 da33de13505008b19f89a6281957dd50bd05e79d
SHA512 eea19d2456f30c0d6b941d805505eb0cffb864ee495d80447cf2734469bfe4717caa6e02639e47d1fb036ac6cf463d87f618891714dc38b5e344171856bb38e7
SSDEEP 98304:AVeM4VwHuokyft8PGcx2HynIiprw0F80XZNf/:mAVwdkx2SnIe84Nf/
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

650276

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\install_project\install_main\install_and_uninstall\Release\Install.pdb

kernel32

GetStartupInfoW GetVersion GetPrivateProfileStringW GetPrivateProfileIntW OpenEventW GlobalAddAtomW GetFileSizeEx GetCommandLineW DecodePointer LoadLibraryExW lstrcmpiW LoadLibraryA CopyFileW VirtualAllocEx VirtualFreeEx ReadProcessMemory CreateProcessW OutputDebugStringA ResetEvent GetSystemInfo GetLongPathNameW GlobalFree GlobalUnlock GlobalLock GlobalAlloc WaitForMultipleObjects CreateDirectoryW GetShortPathNameW FormatMessageW GetEnvironmentVariableW IsDebuggerPresent EncodePointer InitializeSListHead WriteProcessMemory GetTempFileNameW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetSystemDirectoryW GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceExW WideCharToMultiByte MoveFileW lstrlenW GetWindowsDirectoryW SetLastError GetTempPathW SetFileAttributesW RemoveDirectoryW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateEventW LocalAlloc GetTickCount Sleep GetLastError WritePrivateProfileStringW WriteConsoleW ReadConsoleW SetStdHandle WaitForSingleObjectEx SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCurrentThread GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetACP GetModuleFileNameA GetCurrentDirectoryW SetCurrentDirectoryW GetExitCodeProcess TerminateProcess GetCurrentProcess GetCurrentThreadId InitializeCriticalSectionEx RaiseException MultiByteToWideChar UnlockFile LockFile GetFileSize MulDiv Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalFindAtomW GlobalDeleteAtom OpenProcess GetCurrentProcessId MoveFileExW FindResourceW SizeofResource LockResource LoadResource GetModuleHandleW GetModuleFileNameW FreeLibrary FindResourceExW GetVersionExW DeviceIoControl UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileAttributesExW CreateFileW LoadLibraryW DosDateTimeToFileTime GetProcAddress GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy OutputDebugStringW SetFilePointer ReadFile LocalFileTimeToFileTime GetTempFileNameA GetTempPathA CloseHandle InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent CreateMutexW WaitForSingleObject LocalFree SetEvent VirtualAlloc VirtualFree LoadLibraryExA GetStringTypeW InitializeCriticalSectionAndSpinCount SwitchToThread ExitProcess GetTimeZoneInformation GetModuleHandleExW TlsAlloc FreeLibraryAndExitThread ResumeThread ExitThread CreateThread InterlockedFlushSList RtlUnwind FileTimeToDosDateTime TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo OpenFileMappingW UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter FlushFileBuffers SetFileTime SearchPathW FindFirstChangeNotificationW FindCloseChangeNotification CompareFileTime GetFileInformationByHandle SetEndOfFile GetStdHandle InterlockedCompareExchange FreeResource GetSystemWindowsDirectoryW lstrcmpA lstrcmpiA FileTimeToLocalFileTime WriteFile DeleteFileA CreateFileA SystemTimeToFileTime GetSystemTime GetFileTime ReleaseMutex FindNextFileA FindFirstFileA GetLocalTime

user32

UnhookWinEvent SetWinEventHook wsprintfW SetTimer KillTimer DrawTextW GetWindowTextLengthW GetMessageW TranslateMessage DispatchMessageW PeekMessageW GetDC ReleaseDC SendMessageW ShowWindow IsWindowVisible IsIconic SetForegroundWindow FindWindowExW GetWindowThreadProcessId PostMessageW IsWindow SetCursor SetRect OffsetRect LoadCursorW ScreenToClient PtInRect CopyRect DrawFocusRect BeginPaint EndPaint IsRectEmpty DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW InvalidateRect GetClientRect GetWindowRect GetWindowLongW SetWindowLongW GetParent UpdateLayeredWindow SetWindowPos SetWindowRgn SystemParametersInfoW WaitForInputIdle GetSystemMetrics GetShellWindow MonitorFromWindow UnregisterClassA SendNotifyMessageW SendMessageTimeoutW RegisterWindowMessageW MessageBoxW IsDialogMessageW EndDialog DialogBoxParamW DestroyWindow EnableWindow FindWindowW RedrawWindow GetMonitorInfoW LoadImageW GetWindow MapWindowPoints SetWindowTextW BringWindowToTop MoveWindow PostQuitMessage ExitWindowsEx SetProcessDPIAware CharNextW GetWindowTextW

gdi32

SaveDC RestoreDC SetTextColor SetBkMode CreateRectRgn CombineRgn SetViewportOrgEx CreateCompatibleDC CreateCompatibleBitmap BitBlt ExtTextOutW SetBkColor DeleteDC SelectObject GetTextExtentPoint32W GetDeviceCaps CreateFontIndirectW EnumFontFamiliesW DeleteObject CreateFontW

advapi32

BuildExplicitAccessWithNameW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegSetValueExW RegQueryInfoKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegEnumValueW DuplicateTokenEx RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken UnlockServiceDatabase StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceLockStatusW QueryServiceConfig2W QueryServiceConfigW OpenServiceW OpenSCManagerW LockServiceDatabase DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW GetUserNameW AllocateAndInitializeSid CheckTokenMembership FreeSid DeleteAce EqualSid LookupAccountSidW LookupAccountNameW SetEntriesInAclW GetExplicitEntriesFromAclW GetNamedSecurityInfoW SetNamedSecurityInfoW GetTokenInformation GetTrusteeNameW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt CryptDecrypt CryptContextAddRef RegGetValueW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW SHGetPathFromIDListW SHFileOperationW ord165 SHCreateDirectoryExW SHGetSpecialFolderLocation SHBrowseForFolderW SHLoadInProc ShellExecuteW ShellExecuteExW SHChangeNotify SHGetDesktopFolder

ole32

CoCreateGuid CoInitializeSecurity CoSetProxyBlanket CoInitialize CoTaskMemRealloc CoTaskMemAlloc CoUninitialize StringFromGUID2 CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance CoInitializeEx OleRun

oleaut32

VariantCopy CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo VariantInit SysStringLen VariantClear SysAllocStringByteLen SysStringByteLen SysFreeString SysAllocString VarUI4FromStr

shlwapi

PathAppendA PathFindFileNameA PathRenameExtensionA PathAppendW PathCombineW PathFileExistsW PathRemoveFileSpecW PathFindExtensionW wnsprintfW StrCmpW PathFindFileNameW SHGetValueW PathUnquoteSpacesW SHSetValueW PathIsPrefixW PathIsRelativeW PathIsRootW SHSetValueA AssocQueryStringW StrStrIW SHDeleteValueW StrStrIA StrCmpNIW StrTrimA StrCmpIW StrToIntExW SHGetValueA PathIsDirectoryW SHDeleteKeyW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipCreateSolidFill GdipGraphicsClear GdipDrawImagePointRectI GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipMeasureString GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageRectRect GdipDrawImageRectRectI GdipCloneBrush GdipDeleteBrush GdipDrawString GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipSetTextRenderingHint GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipFillRectangleI

cabinet

ord23 ord20 ord22

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW EnumProcesses

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

secur32

GetUserNameExW

crypt32

CryptBinaryToStringW CryptBinaryToStringA CertGetNameStringW CryptStringToBinaryW CryptStringToBinaryA

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

generic

count=18, id=241, version=40116,

count=174, id=243, version=40116,

count=31, id=242, version=40116,

count=6, id=261, version=27031,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=21, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=261, version=27032,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=35, id=260, version=26706,

count=78, id=261, version=26706,

count=4, id=206, version=65501,

count=3, id=208, version=65501,

count=41, id=203, version=65501,

count=487, id=1, productName=Unmarked objects,

count=1, id=260, version=27051,

count=100, id=261, version=27051,

count=1, id=256, version=27051,

count=1, id=255, version=27051,

count=2, id=151,

count=1, id=258, version=27051,