934b249c120eb22a571c044da5b78cb5d108df8c55d3df1478b7b4952537b923[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
934b249c120eb22a571c044da5b78cb5d108df8c55d3df1478b7b4952537b923.exe
Size 623KB
Sample241205-baqgyawkcr
SHA256 934b249c120eb22a571c044da5b78cb5d108df8c55d3df1478b7b4952537b923
MD5 569476655dbe26c2425b7b52632a002c
SHA1 c1e7ccbfc7dd7d820ea17e20af63499a460faa9a
SHA512 09d9b865bf03f0be25b80f0e3bec0332ee1249c8b3c50190462d830a565ca9a9556e54a98d5c2308f35069408a739f98a12b62abcb1a36c336ae68a6a49b1559
SSDEEP 12288:RXhOqySkMyvKNprvA2ymfK5ZlSMDyS1CAz1fXhUZ2Ls3d+jZjIvQJwCMtXjDnSBf:RX8qyFMWuprXOSMDJwcA39C
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
934b249c120eb22a571c044da5b78cb5d108df8c55d3df1478b7b4952537b923.exe

File Explorer

934b249c120eb22a571c044da5b78cb5d108df8c55d3df1478b7b4952537b923.exe

.exe 623KB

934b249c120eb22a571c044da5b78cb5d108df8c55d3df1478b7b4952537b923.exe

IMPHASH cd33652638a31682ec422c6504fc5182
SHA256 934b249c120eb22a571c044da5b78cb5d108df8c55d3df1478b7b4952537b923
MD5 569476655dbe26c2425b7b52632a002c
SHA1 c1e7ccbfc7dd7d820ea17e20af63499a460faa9a
SHA512 09d9b865bf03f0be25b80f0e3bec0332ee1249c8b3c50190462d830a565ca9a9556e54a98d5c2308f35069408a739f98a12b62abcb1a36c336ae68a6a49b1559
SSDEEP 12288:RXhOqySkMyvKNprvA2ymfK5ZlSMDyS1CAz1fXhUZ2Ls3d+jZjIvQJwCMtXjDnSBf:RX8qyFMWuprXOSMDJwcA39C
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

WmiApSrv.pdb

msvcrt

_wcsicmp wcsrchr _CxxThrowException _wtol realloc _vsnwprintf _wtoi wcslen ?terminate@@YAXXZ _controlfp _onexit __dllonexit ??1type_info@@UAE@XZ _except_handler3 __set_app_type __p__fmode wcscmp wcschr __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs wcscspn wcsspn iswdigit vswprintf memmove _wcsrev _wcslwr _wcsupr wcsstr wcspbrk mbstowcs wcscoll _acmdln exit _cexit _XcptFilter _exit _c_exit memset free memcpy __CxxFrameHandler ??2@YAPAXI@Z ??3@YAXPAX@Z malloc

advapi32

RegCreateKeyExA RegSetValueExA RegQueryValueExA RegDeleteValueA RegDeleteKeyA RegOpenKeyExA RegQueryInfoKeyA RegQueryInfoKeyW RegEnumKeyA RegEnumKeyW RegEnumValueA RegOpenCurrentUser RegCloseKey RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegSetValueExW RegCreateKeyExW CopySid GetLengthSid IsValidSid GetTokenInformation OpenProcessToken RegisterEventSourceW DeregisterEventSource CloseServiceHandle QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid SetSecurityDescriptorDacl SetEntriesInAclW SetServiceStatus RegisterServiceCtrlHandlerW DeleteService ControlService StartServiceCtrlDispatcherW ChangeServiceConfig2W CreateServiceW RegEnumValueW RegOpenKeyW RegQueryValueExW

kernel32

lstrlenW lstrcatW lstrcpyW ReleaseSemaphore WaitForSingleObject SwitchToThread GetCurrentProcess InterlockedIncrement TryEnterCriticalSection InterlockedDecrement InitializeCriticalSection SetEvent ResetEvent EnterCriticalSection LocalFree LocalAlloc lstrcmpiW GetCommandLineW CreateMutexW CreateEventW LoadLibraryW DeleteCriticalSection FreeLibrary ReleaseMutex InterlockedCompareExchange GetModuleHandleW GetModuleFileNameW Sleep WaitForMultipleObjects UnmapViewOfFile lstrcmpW MapViewOfFile CreateFileMappingW FlushViewOfFile GetExitCodeProcess QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleHandleA GetStartupInfoA GetLocaleInfoW MoveFileExW FormatMessageW FormatMessageA lstrlenA LeaveCriticalSection CloseHandle DeleteFileW CreateDirectoryW CreateFileW WriteFile WideCharToMultiByte GetVersionExA MultiByteToWideChar GetVersionExW CreateSemaphoreW GetLastError ExpandEnvironmentStringsW GetProcAddress OpenProcess SetLastError OpenEventW GetSystemDefaultLCID

user32

wsprintfW CharNextW LoadStringW

ntdll

NtQueryObject atol iswspace

oleaut32

SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SysAllocStringLen SysFreeString SysAllocString VariantChangeType SysStringLen VariantClear SafeArrayDestroy

ole32

CoInitializeEx CoUninitialize CoInitializeSecurity CoCreateInstance CoFreeUnusedLibraries CoSetProxyBlanket

loadperf

LoadPerfCounterTextStringsW UnloadPerfCounterTextStringsW

wbemcomn

?Throttle@@YGJKKKKK@Z

??0CHPtrArray@@QAE@XZ ??0CHString@@QAE@ABV0@@Z ??0CHString@@QAE@GH@Z ??0CHString@@QAE@PBD@Z ??0CHString@@QAE@PBE@Z ??0CHString@@QAE@PBG@Z ??0CHString@@QAE@PBGH@Z ??0CHString@@QAE@XZ ??0CHStringArray@@QAE@XZ ??0CRegistry@@QAE@ABV0@@Z ??0CRegistry@@QAE@XZ ??0CRegistrySearch@@QAE@ABV0@@Z ??0CRegistrySearch@@QAE@XZ ??1CHPtrArray@@QAE@XZ ??1CHString@@QAE@XZ ??1CHStringArray@@QAE@XZ ??1CRegistry@@QAE@XZ ??1CRegistrySearch@@QAE@XZ ??4CHPtrArray@@QAEAAV0@ABV0@@Z ??4CHString@@QAEABV0@ABV0@@Z ??4CHString@@QAEABV0@D@Z ??4CHString@@QAEABV0@G@Z ??4CHString@@QAEABV0@PAV0@@Z ??4CHString@@QAEABV0@PBD@Z ??4CHString@@QAEABV0@PBE@Z ??4CHString@@QAEABV0@PBG@Z ??4CHStringArray@@QAEAAV0@ABV0@@Z ??4CRegistry@@QAEAAV0@ABV0@@Z ??4CRegistrySearch@@QAEAAV0@ABV0@@Z ??ACHPtrArray@@QAEAAPAXH@Z ??ACHPtrArray@@QBEPAXH@Z ??ACHString@@QBEGH@Z ??ACHStringArray@@QAEAAVCHString@@H@Z ??ACHStringArray@@QBE?AVCHString@@H@Z ??BCHString@@QBEPBGXZ ??H@YG?AVCHString@@ABV0@0@Z ??H@YG?AVCHString@@ABV0@G@Z ??H@YG?AVCHString@@ABV0@PBG@Z ??H@YG?AVCHString@@GABV0@@Z ??H@YG?AVCHString@@PBGABV0@@Z ??YCHString@@QAEABV0@ABV0@@Z ??YCHString@@QAEABV0@D@Z ??YCHString@@QAEABV0@G@Z ??YCHString@@QAEABV0@PBG@Z ?Add@CHPtrArray@@QAEHPAX@Z ?Add@CHStringArray@@QAEHPBG@Z ?AllocBeforeWrite@CHString@@IAEXH@Z ?AllocBuffer@CHString@@IAEXH@Z ?AllocCopy@CHString@@IBEXAAV1@HHH@Z ?AllocSysString@CHString@@QBEPAGXZ ?Append@CHPtrArray@@QAEHABV1@@Z ?Append@CHStringArray@@QAEHABV1@@Z ?AssignCopy@CHString@@IAEXHPBG@Z ?CheckAndAddToList@CRegistrySearch@@AAEXPAVCRegistry@@VCHString@@1AAVCHPtrArray@@11H@Z ?Close@CRegistry@@QAEXXZ ?CloseSubKey@CRegistry@@AAEXXZ ?Collate@CHString@@QBEHPBG@Z ?Compare@CHString@@QBEHPBG@Z ?CompareNoCase@CHString@@QBEHPBG@Z ?ConcatCopy@CHString@@IAEXHPBGH0@Z ?ConcatInPlace@CHString@@IAEXHPBG@Z ?Copy@CHPtrArray@@QAEXABV1@@Z ?Copy@CHStringArray@@QAEXABV1@@Z ?CopyBeforeWrite@CHString@@IAEXXZ ?CreateOpen@CRegistry@@QAEJPAUHKEY__@@PBGPAGKKPAU_SECURITY_ATTRIBUTES@@PAK@Z ?DeleteCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBG@Z ?DeleteCurrentKeyValue@CRegistry@@QAEKPBG@Z ?DeleteKey@CRegistry@@QAEJPAVCHString@@@Z ?DeleteValue@CRegistry@@QAEJPBG@Z ?ElementAt@CHPtrArray@@QAEAAPAXH@Z ?ElementAt@CHStringArray@@QAEAAVCHString@@H@Z ?Empty@CHString@@QAEXXZ ?EnumerateAndGetValues@CRegistry@@QAEJAAKAAPAGAAPAE@Z ?Find@CHString@@QBEHG@Z ?Find@CHString@@QBEHPBG@Z ?FindOneOf@CHString@@QBEHPBG@Z ?Format@CHString@@QAAXIZZ ?Format@CHString@@QAAXPBGZZ ?FormatMessageW@CHString@@QAAXIZZ ?FormatMessageW@CHString@@QAAXPBGZZ ?FormatV@CHString@@QAEXPBGPAD@Z ?FreeExtra@CHPtrArray@@QAEXXZ ?FreeExtra@CHString@@QAEXXZ ?FreeExtra@CHStringArray@@QAEXXZ ?FreeSearchList@CRegistrySearch@@QAEHHAAVCHPtrArray@@@Z ?GetAllocLength@CHString@@QBEHXZ ?GetAt@CHPtrArray@@QBEPAXH@Z ?GetAt@CHString@@QBEGH@Z ?GetAt@CHStringArray@@QBE?AVCHString@@H@Z ?GetBuffer@CHString@@QAEPAGH@Z ?GetBufferSetLength@CHString@@QAEPAGH@Z ?GetClassNameW@CRegistry@@QAEPAGXZ ?GetCurrentBinaryKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGPAEPAK@Z ?GetCurrentBinaryKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z ?GetCurrentBinaryKeyValue@CRegistry@@QAEKPBGPAEPAK@Z ?GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAK@Z ?GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z ?GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHStringArray@@@Z ?GetCurrentKeyValue@CRegistry@@QAEKPBGAAK@Z ?GetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z ?GetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHStringArray@@@Z ?GetCurrentRawKeyValue@CRegistry@@AAEKPAUHKEY__@@PBGPAXPAK3@Z ?GetCurrentRawSubKeyValue@CRegistry@@AAEKPBGPAXPAK2@Z ?GetCurrentSubKeyCount@CRegistry@@QAEKXZ ?GetCurrentSubKeyName@CRegistry@@QAEKAAVCHString@@@Z ?GetCurrentSubKeyPath@CRegistry@@QAEKAAVCHString@@@Z ?GetCurrentSubKeyValue@CRegistry@@QAEKPBGAAK@Z ?GetCurrentSubKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z ?GetCurrentSubKeyValue@CRegistry@@QAEKPBGPAXPAK@Z ?GetData@CHPtrArray@@QAEPAPAXXZ ?GetData@CHPtrArray@@QBEPAPBXXZ ?GetData@CHString@@IBEPAUCHStringData@@XZ ?GetData@CHStringArray@@QAEPAVCHString@@XZ ?GetData@CHStringArray@@QBEPBVCHString@@XZ ?GetLength@CHString@@QBEHXZ ?GetLongestClassStringSize@CRegistry@@QAEKXZ ?GetLongestSubKeySize@CRegistry@@QAEKXZ ?GetLongestValueData@CRegistry@@QAEKXZ ?GetLongestValueName@CRegistry@@QAEKXZ ?GetPlatformID@CRegistry@@CGKXZ ?GetSize@CHPtrArray@@QBEHXZ ?GetSize@CHStringArray@@QBEHXZ ?GetUpperBound@CHPtrArray@@QBEHXZ ?GetUpperBound@CHStringArray@@QBEHXZ ?GetValueCount@CRegistry@@QAEKXZ ?GethKey@CRegistry@@QAEPAUHKEY__@@XZ ?Init@CHString@@IAEXXZ ?InsertAt@CHPtrArray@@QAEXHPAV1@@Z ?InsertAt@CHPtrArray@@QAEXHPAXH@Z ?InsertAt@CHStringArray@@QAEXHPAV1@@Z ?InsertAt@CHStringArray@@QAEXHPBGH@Z ?IsEmpty@CHString@@QBEHXZ ?Left@CHString@@QBE?AV1@H@Z ?LoadStringW@CHString@@IAEHIPAGI@Z ?LoadStringW@CHString@@QAEHI@Z ?LocateKeyByNameOrValueName@CRegistrySearch@@QAEHPAUHKEY__@@PBG1PAPBGKAAVCHString@@3@Z ?LockBuffer@CHString@@QAEPAGXZ ?MakeLower@CHString@@QAEXXZ ?MakeReverse@CHString@@QAEXXZ ?MakeUpper@CHString@@QAEXXZ ?Mid@CHString@@QBE?AV1@H@Z ?Mid@CHString@@QBE?AV1@HH@Z ?NextSubKey@CRegistry@@QAEKXZ ?Open@CRegistry@@QAEJPAUHKEY__@@PBGK@Z ?OpenAndEnumerateSubKeys@CRegistry@@QAEJPAUHKEY__@@PBGK@Z ?OpenCurrentUser@CRegistry@@QAEKPBGK@Z ?OpenLocalMachineKeyAndReadValue@CRegistry@@QAEJPBG0AAVCHString@@@Z ?OpenSubKey@CRegistry@@AAEKXZ ?PrepareToReOpen@CRegistry@@AAEXXZ ?Release@CHString@@IAEXXZ ?Release@CHString@@KGXPAUCHStringData@@@Z ?ReleaseBuffer@CHString@@QAEXH@Z ?RemoveAll@CHPtrArray@@QAEXXZ ?RemoveAll@CHStringArray@@QAEXXZ ?RemoveAt@CHPtrArray@@QAEXHH@Z ?RemoveAt@CHStringArray@@QAEXHH@Z ?ReverseFind@CHString@@QBEHG@Z ?RewindSubKeys@CRegistry@@QAEXXZ ?Right@CHString@@QBE?AV1@H@Z ?SafeStrlen@CHString@@KGHPBG@Z ?SearchAndBuildList@CRegistrySearch@@QAEHVCHString@@AAVCHPtrArray@@00HPAUHKEY__@@@Z ?SetAt@CHPtrArray@@QAEXHPAX@Z ?SetAt@CHString@@QAEXHG@Z ?SetAt@CHStringArray@@QAEXHPBG@Z ?SetAtGrow@CHPtrArray@@QAEXHPAX@Z ?SetAtGrow@CHStringArray@@QAEXHPBG@Z ?SetCHStringResourceHandle@@YGXPAUHINSTANCE__@@@Z ?SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAK@Z ?SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z ?SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHStringArray@@@Z ?SetCurrentKeyValue@CRegistry@@QAEKPBGAAK@Z ?SetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z ?SetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHStringArray@@@Z ?SetCurrentKeyValueExpand@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z ?SetDefaultValues@CRegistry@@AAEXXZ ?SetSize@CHPtrArray@@QAEXHH@Z ?SetSize@CHStringArray@@QAEXHH@Z ?SpanExcluding@CHString@@QBE?AV1@PBG@Z ?SpanIncluding@CHString@@QBE?AV1@PBG@Z ?TrimLeft@CHString@@QAEXXZ ?TrimRight@CHString@@QAEXXZ ?UnlockBuffer@CHString@@QAEXXZ ?myRegCreateKeyEx@CRegistry@@AAEJPAUHKEY__@@PBGKPAGKKPAU_SECURITY_ATTRIBUTES@@PAPAU2@PAK@Z ?myRegDeleteKey@CRegistry@@AAEJPAUHKEY__@@PBG@Z ?myRegDeleteValue@CRegistry@@AAEJPAUHKEY__@@PBG@Z ?myRegEnumKey@CRegistry@@AAEJPAUHKEY__@@KPAGK@Z ?myRegEnumValue@CRegistry@@AAEJPAUHKEY__@@KPAGPAK22PAE2@Z ?myRegOpenKeyEx@CRegistry@@AAEJPAUHKEY__@@PBGKKPAPAU2@@Z ?myRegQueryInfoKey@CRegistry@@AAEJPAUHKEY__@@PAGPAK22222222PAU_FILETIME@@@Z ?myRegQueryValueEx@CRegistry@@AAEJPAUHKEY__@@PBGPAK2PAE2@Z ?myRegSetValueEx@CRegistry@@AAEJPAUHKEY__@@PBGKKPBEK@Z ?s_dwPlatform@CRegistry@@0KA