c2b37aad9ef2fa24df475ce735d12485ce2fd562504c56478f354fe46172ecf1N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
c2b37aad9ef2fa24df475ce735d12485ce2fd562504c56478f354fe46172ecf1N.exe
Size 853KB
Sample241225-sdchxswkbt
SHA256 c2b37aad9ef2fa24df475ce735d12485ce2fd562504c56478f354fe46172ecf1
MD5 8d31934f76913367b3b4cf833d67afd0
SHA1 3dc75c5ec8091783db99b83a8400b93b7e4192f8
SHA512 6e046c246a0ec52c522a6760a475ba3cd6b654120bc5a128e35e2fc49e3bab2417b2d4ddb72b03d856098bdb41a339bc036b4f02014998dadab0b4e0a0fa2d31
SSDEEP 24576:E7Vjpt+3FzayKQnThz+Ors1FdwyoVp7gNkAfe/Bx8:6Vb+VzayKQnThzrrs1FqVp7gWYej
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c2b37aad9ef2fa24df475ce735d12485ce2fd562504c56478f354fe46172ecf1N.exe

File Explorer

c2b37aad9ef2fa24df475ce735d12485ce2fd562504c56478f354fe46172ecf1N.exe

.exe 853KB

c2b37aad9ef2fa24df475ce735d12485ce2fd562504c56478f354fe46172ecf1N.exe

IMPHASH d6db0750999bb56a9cfcb718f5243e6a
SHA256 c2b37aad9ef2fa24df475ce735d12485ce2fd562504c56478f354fe46172ecf1
MD5 8d31934f76913367b3b4cf833d67afd0
SHA1 3dc75c5ec8091783db99b83a8400b93b7e4192f8
SHA512 6e046c246a0ec52c522a6760a475ba3cd6b654120bc5a128e35e2fc49e3bab2417b2d4ddb72b03d856098bdb41a339bc036b4f02014998dadab0b4e0a0fa2d31
SSDEEP 24576:E7Vjpt+3FzayKQnThz+Ors1FdwyoVp7gNkAfe/Bx8:6Vb+VzayKQnThzrrs1FqVp7gWYej
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

122211

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\ccViews\autobuild1_BR-1302-00PT_9.5_Snapshot\AMT_Development\SW\Src\Apps\PAVP2\PAVP30\IntelCpHeciSvc\Release\IntelCpHeciSvc.pdb

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

kernel32

ResumeThread CreateThread ReadFile GetOverlappedResult WriteFile DeviceIoControl CreateFileW Sleep GetCurrentProcess GetCurrentThread LocalFree GetCommandLineW LoadLibraryW WaitForMultipleObjects EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID IsValidCodePage GetOEMCP GetACP GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc HeapSize SetFilePointer WaitForSingleObject SetEvent LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary GetModuleFileNameW lstrcmpiW InterlockedDecrement InterlockedIncrement GetModuleHandleW GetProcAddress InitializeCriticalSectionAndSpinCount RaiseException lstrlenW CloseHandle CreateEventW OpenProcess GetLastError GetCurrentThreadId ExpandEnvironmentStringsW DeleteCriticalSection InitializeCriticalSection QueryPerformanceFrequency QueryPerformanceCounter LeaveCriticalSection EnterCriticalSection WriteConsoleW SetStdHandle GetProcessHeap SetEndOfFile IsValidLocale FlushFileBuffers GetConsoleMode GetConsoleCP ExitProcess GetFileType SetHandleCount GetLocaleInfoW GetStdHandle SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent LCMapStringW GetStartupInfoW HeapSetInformation ExitThread HeapAlloc GetCPInfo RtlUnwind HeapFree DecodePointer EncodePointer InterlockedExchange InterlockedCompareExchange GetStringTypeW WideCharToMultiByte

user32

DispatchMessageA RegisterDeviceNotificationW UnregisterDeviceNotification PostThreadMessageW LoadStringW TranslateMessage DispatchMessageW GetMessageW CharUpperW MessageBoxW RegisterWindowMessageW GetMessageA MsgWaitForMultipleObjectsEx PeekMessageW IsWindowUnicode CharNextW

advapi32

RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW QueryServiceConfigW ChangeServiceConfigW RegOpenKeyW OpenThreadToken OpenProcessToken ControlService DeleteService CreateServiceW GetTokenInformation SetSecurityDescriptorGroup SetSecurityDescriptorOwner InitializeSecurityDescriptor IsValidSid GetLengthSid CopySid RegQueryValueExW OpenSCManagerW OpenServiceW SetServiceStatus CloseServiceHandle GetSecurityDescriptorLength RegQueryValueExA RegSetValueExA ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW

ole32

CoGetInterfaceAndReleaseStream CoTaskMemRealloc CoTaskMemFree CoInitializeEx CoUninitialize CoRevokeClassObject CoRegisterClassObject CoAddRefServerProcess CoInitialize StringFromGUID2 CoCreateInstance CoTaskMemAlloc CoReleaseServerProcess CoInitializeSecurity CoResumeClassObjects CoMarshalInterThreadInterfaceInStream

oleaut32

RegisterTypeLi UnRegisterTypeLi SysAllocString SafeArrayRedim SafeArrayDestroy SafeArrayCreate SafeArrayCopy SafeArrayGetLBound VariantClear VariantInit SafeArrayUnlock SafeArrayLock SafeArrayGetUBound SafeArrayGetVartype LoadTypeLi LoadRegTypeLi VarUI4FromStr SysStringLen SysFreeString