600765788bb1c6f1add66b67ea9c4f59aa3581ff523f7c770d346b979c775fd5

Sharing

Copy URL Twitter E-mail

General

Target
600765788bb1c6f1add66b67ea9c4f59aa3581ff523f7c770d346b979c775fd5
Size 3.9MB
Sample241113-txchpsvhnr
SHA256 600765788bb1c6f1add66b67ea9c4f59aa3581ff523f7c770d346b979c775fd5
MD5 1404f2388f8ca0854e000a25fbc3a299
SHA1 9c214975f687b76bf68fef7d41233a4cd13779d3
SHA512 5b53142670ad00b9cfae0583859af2e675b172d418221da271e60bdac014465147bde70c4d6cffc86f1b57a863a3f090f195f8ebd3f36c17f5930672e3a3ce7d
SSDEEP 98304:L/YUKJXNQTZ6byC1k9/Vr6MERWxkTx5jfpSBndLy:F1Pw+EWiSBRy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
600765788bb1c6f1add66b67ea9c4f59aa3581ff523f7c770d346b979c775fd5

File Explorer

600765788bb1c6f1add66b67ea9c4f59aa3581ff523f7c770d346b979c775fd5

.exe 3.9MB

600765788bb1c6f1add66b67ea9c4f59aa3581ff523f7c770d346b979c775fd5

IMPHASH f1eb906ef6872c60ad516980411475f7
SHA256 600765788bb1c6f1add66b67ea9c4f59aa3581ff523f7c770d346b979c775fd5
MD5 1404f2388f8ca0854e000a25fbc3a299
SHA1 9c214975f687b76bf68fef7d41233a4cd13779d3
SHA512 5b53142670ad00b9cfae0583859af2e675b172d418221da271e60bdac014465147bde70c4d6cffc86f1b57a863a3f090f195f8ebd3f36c17f5930672e3a3ce7d
SSDEEP 98304:L/YUKJXNQTZ6byC1k9/Vr6MERWxkTx5jfpSBndLy:F1Pw+EWiSBRy
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

352697

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Work\SourceCode\OnlineInstall\branches\XYInstaller\Release\XYInstaller.pdb

kernel32

lstrlenW lstrlenA SetLastError GetModuleFileNameW RemoveDirectoryW Sleep DeviceIoControl GetLogicalDriveStringsW FlushInstructionCache RaiseException GetVersionExW GetExitCodeThread WriteFile SetFilePointer InterlockedCompareExchange WaitForSingleObject SetEvent CreateEventW FlushFileBuffers MoveFileExW ReadFile FreeResource SetEnvironmentVariableW GetTempPathW GetFileSize InterlockedIncrement InterlockedDecrement GetTempFileNameW CreateMutexW GetCurrentProcessId ResetEvent WaitForMultipleObjects CreateThread CopyFileW GetPrivateProfileStringW GetPrivateProfileSectionNamesW GetCommandLineW GetCurrentThread lstrcmpiW SetConsoleTextAttribute ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock OutputDebugStringW SetFilePointerEx SystemTimeToFileTime CreateFileW CompareStringW CompareStringA GlobalAlloc SetEndOfFile IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetLocaleInfoA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation InitializeCriticalSectionAndSpinCount IsValidCodePage GetOEMCP GetACP GetModuleFileNameA HeapCreate CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetStartupInfoA GetFileType SetHandleCount TlsFree GetModuleHandleA GetCPInfo LCMapStringW LCMapStringA GetStartupInfoW GetDateFormatA GetTimeFormatA GetSystemTimeAsFileTime ExitThread ExitProcess VirtualQuery GetSystemInfo VirtualProtect IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetConsoleMode GetConsoleCP RtlUnwind VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GlobalFree GlobalLock GlobalUnlock LoadLibraryW DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime CloseHandle SetFileAttributesW GetTickCount GetCurrentProcess OpenProcess GetFileSizeEx GetDriveTypeW GetDiskFreeSpaceExW DeleteCriticalSection InitializeCriticalSection InterlockedExchange EnterCriticalSection LeaveCriticalSection TlsAlloc GetWindowsDirectoryW DeleteFileW FreeLibrary FormatMessageW CreateDirectoryW GetLastError GetModuleHandleW GetProcAddress LoadLibraryExW GetLocaleInfoW GetStdHandle TlsSetValue TlsGetValue GetCurrentThreadId FindResourceExW FindResourceW WideCharToMultiByte LoadResource LockResource SizeofResource GetFileAttributesW MultiByteToWideChar SetEnvironmentVariableA

user32

CheckRadioButton GetSystemMetrics SetWindowPos GetShellWindow GetWindowThreadProcessId UnregisterClassA GetDC PostQuitMessage LoadImageW DialogBoxParamW IsDlgButtonChecked SetForegroundWindow GetFocus IsIconic ShowWindow IsWindowVisible GetIconInfo MessageBoxW GetActiveWindow DrawIconEx FillRect EndDialog GetWindowLongW MoveWindow GetWindowRect GetClientRect ScreenToClient GetDlgItem MapWindowPoints GetMonitorInfoW MonitorFromWindow GetWindow GetParent ReleaseDC SetWindowLongW GetWindowTextW EnableWindow SetWindowTextW RegisterClassW GetClassInfoW PostMessageW SendMessageW SetFocus ScrollWindow RedrawWindow IsWindow DefWindowProcW BeginPaint EndPaint UpdateWindow InvalidateRect CallWindowProcW GetWindowTextLengthW SetCursor LoadCursorW IsDialogMessageW CreateDialogParamW DestroyWindow PtInRect CreateWindowExW IsWindowEnabled GetCursorPos ClientToScreen GetClassInfoExW UpdateLayeredWindow RegisterClassExW CopyRect SetTimer KillTimer SetWindowRgn AnimateWindow CharNextW BringWindowToTop PeekMessageW GetMessageW TranslateMessage DispatchMessageW FindWindowExW SystemParametersInfoW SendMessageTimeoutW

gdi32

GetObjectA SetBoundsRect CreateFontW BitBlt CreateCompatibleBitmap SetViewportOrgEx SetBkColor ExtTextOutW CreateRoundRectRgn CreateDIBSection SelectObject DeleteDC CreateCompatibleDC DeleteObject CreateSolidBrush GetObjectW CreateRectRgn CombineRgn GetStockObject GetTextExtentPoint32W SetTextColor

advapi32

AdjustTokenPrivileges OpenThreadToken ImpersonateSelf RegSetValueExW OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW RegOpenKeyExW RegQueryValueExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegQueryInfoKeyW RegEnumKeyExW InitiateSystemShutdownW RegQueryValueExA

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHFileOperationW CommandLineToArgvW ShellExecuteExW SHGetSpecialFolderPathW ExtractIconExW ShellExecuteW ord165 SHCreateDirectoryExW

ole32

CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoInitialize CoUninitialize CoCreateGuid CreateStreamOnHGlobal

oleaut32

VarUI4FromStr SysStringByteLen SysAllocStringByteLen VariantClear VariantInit SysFreeString SysStringLen SysAllocString

shlwapi

PathQuoteSpacesW StrCmpNIW PathFindFileNameW PathRemoveExtensionW PathAddBackslashW PathUnquoteSpacesW PathIsDirectoryEmptyW StrCmpIW StrCpyW PathFileExistsW SHGetValueW PathCombineW PathRemoveFileSpecW PathAppendW AssocQueryStringW PathFindExtensionW PathIsRelativeW StrStrIW PathCompactPathExW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipDrawImageRectRectI GdipDrawImagePointRectI GdipDrawImageRectRect GdipLoadImageFromFile GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawString GdipSetTextRenderingHint GdipReleaseDC GdipCreateFromHDC GdipSetStringFormatLineAlign GdipCreateSolidFill GdipDeleteFont GdipDeleteGraphics GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteBrush GdipCloneImage GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipSaveImageToFile GdipDisposeImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipAlloc GdipFree GdiplusShutdown GdipSetStringFormatAlign

wininet

InternetConnectW HttpOpenRequestW HttpSendRequestW HttpQueryInfoW InternetOpenW InternetCloseHandle InternetCheckConnectionW

version

VerQueryValueW GetFileVersionInfoW

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

600765788bb1c6f1add66b67ea9c4f59aa3581ff523f7c770d346b979c775fd5

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

wininet

version

wintrust

generic