02f830dacffb6588afc7ec48b3d54e8117f6bb1e00aee9572f74d3d55bd34946

Sharing

Copy URL

Twitter E-mail

General

Target

02f830dacffb6588afc7ec48b3d54e8117f6bb1e00aee9572f74d3d55bd34946
Size

1.8MB
MD5

84126a50efd2b6ce703ee2ff9777f97e
SHA1

50da4a583c2a90ea781e4e5953e89a108688b150
SHA256

02f830dacffb6588afc7ec48b3d54e8117f6bb1e00aee9572f74d3d55bd34946
SHA512

9b163a7203600ffe6c7ec1798853c74780119b8512c811dd1d9fbd4995d940dccb1deb1cea42c2d05721d9a227c53c3512563ac49fec0521a48e939516b47854
SSDEEP

49152:W+UrfhixumnGLgj1yzHwnzLt/wwwwsG378E1HuiTGUfU0rp6:W+UrfhRmnT3wE1H6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02f830dacffb6588afc7ec48b3d54e8117f6bb1e00aee9572f74d3d55bd34946

Files

02f830dacffb6588afc7ec48b3d54e8117f6bb1e00aee9572f74d3d55bd34946
.exe windows:5 windows x86 arch:x86

df15bf0cdaca3328fa0ee6495a6f5304

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\jenkins\workspace\pc-2345mpcsafe-build\RhinoProtect\Publish\OutPut\Bin\Win32\release\pdb\2345ScUpgrade.pdb

Imports

kernel32

CreateProcessW
GetModuleHandleW
GetExitCodeProcess
GetPrivateProfileStringW
InterlockedExchange
SetLastError
InterlockedExchangeAdd
GetTickCount
lstrlenW
GetFileAttributesW
LocalFree
HeapAlloc
WriteConsoleW
HeapSize
SetStdHandle
CreateThread
WaitForSingleObjectEx
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
OpenProcess
WaitForSingleObject
WaitForMultipleObjects
HeapFree
CreateFileMappingW
FreeLibrary
GetProcAddress
FileTimeToLocalFileTime
LoadLibraryW
FileTimeToSystemTime
GetCurrentThreadId
VirtualQuery
GetLogicalDriveStringsW
GetEnvironmentVariableW
GetModuleFileNameW
QueryDosDeviceW
GetCurrentProcess
CloseHandle
CreateEventW
GetCurrentProcessId
GetLastError
Sleep
GetProcessHeap
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
GetDriveTypeW
FindFirstFileW
GetLongPathNameW
GetShortPathNameW
CreateFileW
GetFileAttributesExW
ExpandEnvironmentStringsW
GetVersionExW
LockResource
GetSystemInfo
LoadResource
FindResourceW
lstrcmpiW
SearchPathW
TerminateProcess
OpenEventW
SetEvent
ResetEvent
GetACP
MultiByteToWideChar
WideCharToMultiByte
GetComputerNameExW
GlobalAlloc
GlobalFree
LoadLibraryA
LoadLibraryExW
GetVolumeInformationW
GetDiskFreeSpaceW
ReadFile
WriteFile
SetFileTime
SetFilePointer
SetEndOfFile
GetFileSize
GetFileTime
FindNextFileW
FindClose
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTime
DosDateTimeToFileTime
FileTimeToDosDateTime
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateDirectoryW
GetFullPathNameW
RemoveDirectoryW
GetTempPathW
GetSystemDirectoryW
SetFileAttributesW
DeleteFileW
GetCurrentDirectoryW
GetWindowsDirectoryW
SetCurrentDirectoryW
CopyFileW
GetTempFileNameW
MoveFileW
FormatMessageW
lstrcatW
lstrcpyW
GetFileSizeEx
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
CreateMutexW
ReleaseMutex
OpenMutexW
DeviceIoControl
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetLocalTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
GetStdHandle
GetFileType
OutputDebugStringW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
SetConsoleCtrlHandler
GetCurrentThread
HeapReAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
MoveFileExW

user32

MessageBoxW
GetParent
GetUserObjectInformationW
GetProcessWindowStation
UnregisterClassW
GetWindowThreadProcessId
GetWindowRect
GetFocus
SetWindowPos
GetSystemMetrics
GetShellWindow
WindowFromPoint
AttachThreadInput
GetForegroundWindow
SetFocus
GetClassNameW
GetDesktopWindow

advapi32

ReportEventW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
ChangeServiceConfig2W
DeleteService
ControlService
StartServiceW
OpenServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
SetEntriesInAclW
LookupPrivilegeNameW
SetNamedSecurityInfoW
EqualSid
AllocateAndInitializeSid
FreeSid
GetTokenInformation
RegCloseKey
OpenProcessToken
RegOpenKeyW
RegQueryValueExW
DeregisterEventSource
RegisterEventSourceW

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHFileOperationW

ole32

CoCreateInstance

psapi

GetProcessImageFileNameW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 19KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 124KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

df15bf0cdaca3328fa0ee6495a6f5304

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

psapi

version

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 260KB - Virtual size: 260KB

.data Size: 19KB - Virtual size: 34KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 124KB - Virtual size: 128KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 260KB - Virtual size: 260KB

.data
Size: 19KB - Virtual size: 34KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 124KB - Virtual size: 128KB