051c00ab3f4813f84c1e44fe9849771a475cbaf07f2d4ab46070256373066ab0

Sharing

Copy URL

Twitter E-mail

General

Target

051c00ab3f4813f84c1e44fe9849771a475cbaf07f2d4ab46070256373066ab0
Size

1.9MB
MD5

18b14e2c7f00211fc1f0754e8a7ffaaa
SHA1

76427d23956181faa779af76b5a4865b1c67a37d
SHA256

051c00ab3f4813f84c1e44fe9849771a475cbaf07f2d4ab46070256373066ab0
SHA512

1cd41010883f87297de7d64428fa555a291fdec9ac55c3d90b764394f7f503e72fae6f9617a158c6b8399df77f17ce97e048107bd24b55077c5410263377429f
SSDEEP

49152:1Y0DiBirYhIstmZrbQhrHqxZrbQhrHqYlMgI4nrgMYNuopxNXUXua67o+:1Y0DqtmZrbQhrHqxZrbQhrHqesNZai/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
051c00ab3f4813f84c1e44fe9849771a475cbaf07f2d4ab46070256373066ab0

Files

051c00ab3f4813f84c1e44fe9849771a475cbaf07f2d4ab46070256373066ab0
.exe windows:6 windows x86 arch:x86

2faddcf21ecbc6ccdd4042d2ada77dd0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\jenkins-slave\workspace\unifab_win_x86_vs2019_build_release_newClient\dtshdprocess_bin\x86\DtshdProcess.pdb

Imports

kernel32

SwitchToThread
DuplicateHandle
CreateSemaphoreA
MapViewOfFileEx
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
WriteFile
OutputDebugStringA
GetStdHandle
AllocConsole
VirtualQuery
VirtualFree
VirtualAlloc
SetLastError
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
CopyFileW
GetFileAttributesW
CreateFileW
CreateDirectoryW
lstrlenA
IsDBCSLeadByte
GlobalLock
GlobalUnlock
LoadLibraryW
GetNativeSystemInfo
GetVersionExA
CreateProcessA
GetExitCodeProcess
GetDiskFreeSpaceExA
VirtualLock
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
MoveFileExW
MoveFileExA
MoveFileW
MoveFileA
CopyFileA
QueryDosDeviceA
GetShortPathNameA
GetModuleFileNameA
GetWindowsDirectoryA
GetTickCount
DeviceIoControl
FreeConsole
GetTempPathA
GetTempPathW
SetFilePointer
SetFileAttributesW
SetFileAttributesA
RemoveDirectoryW
RemoveDirectoryA
GetVolumeInformationW
GetFileSize
GetFileAttributesA
GetDriveTypeA
GetDiskFreeSpaceA
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
DeleteFileW
DeleteFileA
CreateFileA
GetSystemInfo
WaitForSingleObject
OpenProcess
GetLastError
ResetEvent
GetCurrentProcessId
CreateProcessW
TerminateProcess
Sleep
HeapFree
QueryPerformanceFrequency
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
OutputDebugStringW
GetSystemDirectoryA
lstrcpyA
LoadLibraryA
GetProcAddress
FreeLibrary
LocalAlloc
LocalFree
GetModuleHandleA
GetModuleFileNameW
FormatMessageA
ReleaseSemaphore
WaitForSingleObjectEx
WaitForMultipleObjectsEx
OpenEventA
SetWaitableTimer
GetCurrentThreadId
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateWaitableTimerA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
GetModuleHandleW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
WideCharToMultiByte
IsValidCodePage
IsDBCSLeadByteEx
SetConsoleTitleA
CreateEventA
SetEvent
CreateDirectoryA
GetProcessTimes
GetVolumeInformationA
CloseHandle

crypt32

CertGetNameStringA
CertFreeCertificateContext
CryptMsgClose
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertCloseStore

user32

GetForegroundWindow
CharNextA
SystemParametersInfoA
ExitWindowsEx
CloseDesktop
EnumDesktopWindows
OpenDesktopA
GetSystemMetrics
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
OpenClipboard
wvsprintfW
IsWindowVisible
SetWindowPos
GetDesktopWindow
PostMessageA

advapi32

ReadEventLogA
RegEnumKeyA
SetSecurityDescriptorDacl
CloseEventLog
OpenEventLogA
InitializeSecurityDescriptor
RegEnumKeyExA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegOpenKeyExA
RegSetValueExA
RegSetValueA
RegQueryValueA
RegQueryInfoKeyA

iphlpapi

GetAdaptersInfo

oleaut32

VariantClear
SysFreeString
SysAllocString

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize

shell32

SHGetSpecialFolderLocation
SHGetFolderPathW
ShellExecuteA
ShellExecuteExA
SHGetPathFromIDListA

Exports

Exports

?get_lock@singleton_module@serialization@boost@@CAAA_NXZ
?is_locked@singleton_module@serialization@boost@@SA_NXZ
?lock@?1??get_lock@singleton_module@serialization@boost@@CAAA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@SAXXZ
?unlock@singleton_module@serialization@boost@@SAXXZ

Sections

.text
Size: 279KB - Virtual size: 279KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2faddcf21ecbc6ccdd4042d2ada77dd0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

crypt32

user32

advapi32

iphlpapi

oleaut32

version

ole32

shell32

Exports

Exports

Sections

.text Size: 279KB - Virtual size: 279KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

.text
Size: 279KB - Virtual size: 279KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB