091a7dea56b149ec4603cb1fab681da93a179a1243083dcd9bfd32e3abadaf14

Sharing

Copy URL

Twitter E-mail

General

Target

091a7dea56b149ec4603cb1fab681da93a179a1243083dcd9bfd32e3abadaf14
Size

1.5MB
MD5

767b22aa6ee583618e36e9b3121344cb
SHA1

fb64c3a5fd4fa75878188ad6502d2c59b59cd986
SHA256

091a7dea56b149ec4603cb1fab681da93a179a1243083dcd9bfd32e3abadaf14
SHA512

6d6b08861d1ccc2c9514e09f0b4c3024c2e661c1437a90bf1dd3620d9c055210c310c9d78f923ed4d21e75c338acd879613fe483775bfc7be32e9ee41d7718db
SSDEEP

24576:06tTD5H4yXRLIZv5ezD8Ye5C/yjlk/Nn6fMoSsnRkB4cKPxEC4:rD5Yyhg5Ct5cYsnRkBLK5EZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
091a7dea56b149ec4603cb1fab681da93a179a1243083dcd9bfd32e3abadaf14

Files

091a7dea56b149ec4603cb1fab681da93a179a1243083dcd9bfd32e3abadaf14
.exe windows:6 windows x86 arch:x86

748118838070a3dda2c6e91f5864961d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Jenkins\.jenkins\workspace\pay_group\os_context_menu\os_context_menu\out\Release\os_context_menu_app.pdb

Imports

kernel32

GetLongPathNameW
GetLogicalDriveStringsW
Process32NextW
Process32FirstW
UnregisterWaitEx
QueryDepthSList
GetModuleHandleA
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
CreateToolhelp32Snapshot
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
QueryDosDeviceW
OpenProcess
lstrlenW
EnumResourceNamesW
GetWindowsDirectoryW
CreateProcessW
Sleep
FindNextFileW
FindFirstFileW
FindClose
GetTickCount
ExpandEnvironmentStringsW
GetEnvironmentVariableW
K32GetModuleFileNameExW
DeleteFileW
GetPrivateProfileStringW
SetLastError
LoadLibraryW
GetCurrentProcess
MultiByteToWideChar
DuplicateHandle
TryEnterCriticalSection
IsBadReadPtr
FindResourceW
lstrcmpiW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
FindResourceExW
VirtualProtect
GetCurrentThreadId
GetCurrentProcessId
CreateMutexW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
CopyFileW
K32GetProcessImageFileNameW
HeapDestroy
GetLastError
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
WriteConsoleW
SetEndOfFile
SetStdHandle
ReadConsoleW
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetUnhandledExceptionFilter
RaiseException
CloseHandle
DecodePointer
GetThreadPriority
GetCommandLineW
GetCurrentThread
WideCharToMultiByte
GetStringTypeW
FormatMessageW
EncodePointer
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetFileSizeEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateFileW
ReleaseSemaphore
LocalFree
GetStartupInfoW
WriteFile
ReadFile
GetVersionExW
OpenFileMappingW
ReleaseMutex
UnhandledExceptionFilter
TerminateProcess
SetEvent
WaitForSingleObjectEx
QueryPerformanceCounter
InterlockedCompareExchange
FreeResource
GetSystemWindowsDirectoryW
DeviceIoControl
lstrcmpA
lstrcmpiA
GetSystemDirectoryW
CreateFileA
WaitNamedPipeW
WaitForMultipleObjectsEx
CreateSemaphoreW
RtlUnwind
InterlockedFlushSList
GetFileAttributesExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetFileType
SetFilePointerEx
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
ExitProcess
GetStdHandle
GetACP

user32

GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
SendMessageTimeoutW
UnregisterClassW
DestroyWindow
CharNextW
SetWindowLongW
FindWindowExW
RegisterWindowMessageW
PostMessageW
PostQuitMessage
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsWindow
ShowWindow
LoadCursorW
DestroyIcon
CreateIconFromResourceEx
GetIconInfo
wsprintfW
CallWindowProcW
DefWindowProcW
GetWindowLongW

gdi32

DeleteObject
GetObjectW

advapi32

RegOpenKeyExA
RegGetValueW
GetTokenInformation
RegEnumKeyExA
RegQueryValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
RegSaveKeyW
RegRestoreKeyW
RegCreateKeyW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

shell32

SHCreateDirectoryExW
ExtractIconExW
ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

IIDFromString
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoTaskMemRealloc
CoCreateGuid

oleaut32

VarUI4FromStr

shlwapi

SHSetValueA
SHGetValueA
StrTrimA
StrCmpNIW
StrCmpIW
StrStrIW
StrStrIA
PathIsDirectoryW
PathCombineW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
SHDeleteKeyW
SHGetValueW
SHSetValueW
ord487

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

comctl32

InitCommonControlsEx

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

gdiplus

GdipBitmapUnlockBits
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCloneImage
GdipBitmapLockBits
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipSaveImageToFile
GdipGetImageWidth
GdipGetImageHeight
GdipDisposeImage

crypt32

CertGetNameStringW
CryptStringToBinaryW
CryptBinaryToStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

Sections

.text
Size: 778KB - Virtual size: 778KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 18KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 424KB - Virtual size: 423KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

748118838070a3dda2c6e91f5864961d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

comctl32

wininet

iphlpapi

urlmon

gdiplus

crypt32

wintrust

Sections

.text Size: 778KB - Virtual size: 778KB

.rdata Size: 200KB - Virtual size: 199KB

.data Size: 18KB - Virtual size: 27KB

.rsrc Size: 424KB - Virtual size: 423KB

.reloc Size: 108KB - Virtual size: 112KB

.text
Size: 778KB - Virtual size: 778KB

.rdata
Size: 200KB - Virtual size: 199KB

.data
Size: 18KB - Virtual size: 27KB

.rsrc
Size: 424KB - Virtual size: 423KB

.reloc
Size: 108KB - Virtual size: 112KB