17fa737843384c9d5696cd310710fb4b1a6831c75528675f71797ec2f937abfa

Sharing

Copy URL Twitter E-mail

General

Target
17fa737843384c9d5696cd310710fb4b1a6831c75528675f71797ec2f937abfa
Size 4.8MB
Sample241112-dnbxtatdpp
SHA256 17fa737843384c9d5696cd310710fb4b1a6831c75528675f71797ec2f937abfa
MD5 13659379be0e1e0f33723ebb3d3d8b05
SHA1 b934de85b3c9afe51ea7be7e0e53a7f609b79e41
SHA512 6103fe6d47617dc2b4acbb2f82f70d87eb23c208e0de25730f313badc4846415f1417145cbc1b1f88e2179ec212aa08525e9878f33271bbc5055c17ad114f8a6
SSDEEP 98304:AVeM4VwHuokyft8PGcx2HynIiprw0F80XZNfZ:mAVwdkx2SnIe84NfZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17fa737843384c9d5696cd310710fb4b1a6831c75528675f71797ec2f937abfa

File Explorer

17fa737843384c9d5696cd310710fb4b1a6831c75528675f71797ec2f937abfa

.exe 4.8MB

17fa737843384c9d5696cd310710fb4b1a6831c75528675f71797ec2f937abfa

IMPHASH a52b0d6e68a672369339ad8663ac1b80
SHA256 17fa737843384c9d5696cd310710fb4b1a6831c75528675f71797ec2f937abfa
MD5 13659379be0e1e0f33723ebb3d3d8b05
SHA1 b934de85b3c9afe51ea7be7e0e53a7f609b79e41
SHA512 6103fe6d47617dc2b4acbb2f82f70d87eb23c208e0de25730f313badc4846415f1417145cbc1b1f88e2179ec212aa08525e9878f33271bbc5055c17ad114f8a6
SSDEEP 98304:AVeM4VwHuokyft8PGcx2HynIiprw0F80XZNfZ:mAVwdkx2SnIe84NfZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

650276

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\install_project\install_main\install_and_uninstall\Release\Install.pdb

kernel32

GetStartupInfoW GetVersion GetPrivateProfileStringW GetPrivateProfileIntW OpenEventW GlobalAddAtomW GetFileSizeEx GetCommandLineW DecodePointer LoadLibraryExW lstrcmpiW LoadLibraryA CopyFileW VirtualAllocEx VirtualFreeEx ReadProcessMemory CreateProcessW OutputDebugStringA ResetEvent GetSystemInfo GetLongPathNameW GlobalFree GlobalUnlock GlobalLock GlobalAlloc WaitForMultipleObjects CreateDirectoryW GetShortPathNameW FormatMessageW GetEnvironmentVariableW IsDebuggerPresent EncodePointer InitializeSListHead WriteProcessMemory GetTempFileNameW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetSystemDirectoryW GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceExW WideCharToMultiByte MoveFileW lstrlenW GetWindowsDirectoryW SetLastError GetTempPathW SetFileAttributesW RemoveDirectoryW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateEventW LocalAlloc GetTickCount Sleep GetLastError WritePrivateProfileStringW WriteConsoleW ReadConsoleW SetStdHandle WaitForSingleObjectEx SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCurrentThread GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetACP GetModuleFileNameA GetCurrentDirectoryW SetCurrentDirectoryW GetExitCodeProcess TerminateProcess GetCurrentProcess GetCurrentThreadId InitializeCriticalSectionEx RaiseException MultiByteToWideChar UnlockFile LockFile GetFileSize MulDiv Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalFindAtomW GlobalDeleteAtom OpenProcess GetCurrentProcessId MoveFileExW FindResourceW SizeofResource LockResource LoadResource GetModuleHandleW GetModuleFileNameW FreeLibrary FindResourceExW GetVersionExW DeviceIoControl UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileAttributesExW CreateFileW LoadLibraryW DosDateTimeToFileTime GetProcAddress GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy OutputDebugStringW SetFilePointer ReadFile LocalFileTimeToFileTime GetTempFileNameA GetTempPathA CloseHandle InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent CreateMutexW WaitForSingleObject LocalFree SetEvent VirtualAlloc VirtualFree LoadLibraryExA GetStringTypeW InitializeCriticalSectionAndSpinCount SwitchToThread ExitProcess GetTimeZoneInformation GetModuleHandleExW TlsAlloc FreeLibraryAndExitThread ResumeThread ExitThread CreateThread InterlockedFlushSList RtlUnwind FileTimeToDosDateTime TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo OpenFileMappingW UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter FlushFileBuffers SetFileTime SearchPathW FindFirstChangeNotificationW FindCloseChangeNotification CompareFileTime GetFileInformationByHandle SetEndOfFile GetStdHandle InterlockedCompareExchange FreeResource GetSystemWindowsDirectoryW lstrcmpA lstrcmpiA FileTimeToLocalFileTime WriteFile DeleteFileA CreateFileA SystemTimeToFileTime GetSystemTime GetFileTime ReleaseMutex FindNextFileA FindFirstFileA GetLocalTime

user32

UnhookWinEvent SetWinEventHook wsprintfW SetTimer KillTimer DrawTextW GetWindowTextLengthW GetMessageW TranslateMessage DispatchMessageW PeekMessageW GetDC ReleaseDC SendMessageW ShowWindow IsWindowVisible IsIconic SetForegroundWindow FindWindowExW GetWindowThreadProcessId PostMessageW IsWindow SetCursor SetRect OffsetRect LoadCursorW ScreenToClient PtInRect CopyRect DrawFocusRect BeginPaint EndPaint IsRectEmpty DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW InvalidateRect GetClientRect GetWindowRect GetWindowLongW SetWindowLongW GetParent UpdateLayeredWindow SetWindowPos SetWindowRgn SystemParametersInfoW WaitForInputIdle GetSystemMetrics GetShellWindow MonitorFromWindow UnregisterClassA SendNotifyMessageW SendMessageTimeoutW RegisterWindowMessageW MessageBoxW IsDialogMessageW EndDialog DialogBoxParamW DestroyWindow EnableWindow FindWindowW RedrawWindow GetMonitorInfoW LoadImageW GetWindow MapWindowPoints SetWindowTextW BringWindowToTop MoveWindow PostQuitMessage ExitWindowsEx SetProcessDPIAware CharNextW GetWindowTextW

gdi32

SaveDC RestoreDC SetTextColor SetBkMode CreateRectRgn CombineRgn SetViewportOrgEx CreateCompatibleDC CreateCompatibleBitmap BitBlt ExtTextOutW SetBkColor DeleteDC SelectObject GetTextExtentPoint32W GetDeviceCaps CreateFontIndirectW EnumFontFamiliesW DeleteObject CreateFontW

advapi32

BuildExplicitAccessWithNameW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegSetValueExW RegQueryInfoKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegEnumValueW DuplicateTokenEx RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken UnlockServiceDatabase StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceLockStatusW QueryServiceConfig2W QueryServiceConfigW OpenServiceW OpenSCManagerW LockServiceDatabase DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW GetUserNameW AllocateAndInitializeSid CheckTokenMembership FreeSid DeleteAce EqualSid LookupAccountSidW LookupAccountNameW SetEntriesInAclW GetExplicitEntriesFromAclW GetNamedSecurityInfoW SetNamedSecurityInfoW GetTokenInformation GetTrusteeNameW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt CryptDecrypt CryptContextAddRef RegGetValueW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW SHGetPathFromIDListW SHFileOperationW ord165 SHCreateDirectoryExW SHGetSpecialFolderLocation SHBrowseForFolderW SHLoadInProc ShellExecuteW ShellExecuteExW SHChangeNotify SHGetDesktopFolder

ole32

CoCreateGuid CoInitializeSecurity CoSetProxyBlanket CoInitialize CoTaskMemRealloc CoTaskMemAlloc CoUninitialize StringFromGUID2 CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance CoInitializeEx OleRun

oleaut32

VariantCopy CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo VariantInit SysStringLen VariantClear SysAllocStringByteLen SysStringByteLen SysFreeString SysAllocString VarUI4FromStr

shlwapi

PathAppendA PathFindFileNameA PathRenameExtensionA PathAppendW PathCombineW PathFileExistsW PathRemoveFileSpecW PathFindExtensionW wnsprintfW StrCmpW PathFindFileNameW SHGetValueW PathUnquoteSpacesW SHSetValueW PathIsPrefixW PathIsRelativeW PathIsRootW SHSetValueA AssocQueryStringW StrStrIW SHDeleteValueW StrStrIA StrCmpNIW StrTrimA StrCmpIW StrToIntExW SHGetValueA PathIsDirectoryW SHDeleteKeyW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipCreateSolidFill GdipGraphicsClear GdipDrawImagePointRectI GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipMeasureString GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageRectRect GdipDrawImageRectRectI GdipCloneBrush GdipDeleteBrush GdipDrawString GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipSetTextRenderingHint GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipFillRectangleI

cabinet

ord23 ord20 ord22

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW EnumProcesses

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

secur32

GetUserNameExW

crypt32

CryptBinaryToStringW CryptBinaryToStringA CertGetNameStringW CryptStringToBinaryW CryptStringToBinaryA

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

generic

count=18, id=241, version=40116,

count=174, id=243, version=40116,

count=31, id=242, version=40116,

count=6, id=261, version=27031,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=21, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=261, version=27032,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=35, id=260, version=26706,

count=78, id=261, version=26706,

count=4, id=206, version=65501,

count=3, id=208, version=65501,

count=41, id=203, version=65501,

count=487, id=1, productName=Unmarked objects,

count=1, id=260, version=27051,

count=100, id=261, version=27051,

count=1, id=256, version=27051,

count=1, id=255, version=27051,

count=2, id=151,

count=1, id=258, version=27051,