02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945

Sharing

Copy URL Twitter E-mail

General

Target
02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945
Size 3.9MB
Sample260416-2jth3act4p
SHA256 02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945
MD5 fb41928ec1132e8def2fa16bfb66c28d
SHA1 187a4e1cd3ef940f319fd99bcb4e4af4a96400c2
SHA512 a6b8ede4355d986790b1249e62f46c2a592ba563887e3eaaf506b996bf1351f8cdba303d1545003b29735d7756e7d34a9a91d686415ac8dc75f8c7a0bede5ca9
SSDEEP 98304:F5lWK+tw2kRMJ1QrROwLmN7bal7fnnwnrViDcRB4k:F5lWK+twzx0e7P8ZiDcRr
TLSH
T139167C2275144432D69142B29F0DEBBDDBBC6F70076240D37284BAAC6E76DC21736E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945

File Explorer

02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945

.exe 3.9MB

02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945

IMPHASH 2b2f71c892e7812a50a3f77a2e3e2070
SHA256 02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945
MD5 fb41928ec1132e8def2fa16bfb66c28d
SHA1 187a4e1cd3ef940f319fd99bcb4e4af4a96400c2
SHA512 a6b8ede4355d986790b1249e62f46c2a592ba563887e3eaaf506b996bf1351f8cdba303d1545003b29735d7756e7d34a9a91d686415ac8dc75f8c7a0bede5ca9
SSDEEP 98304:F5lWK+tw2kRMJ1QrROwLmN7bal7fnnwnrViDcRB4k:F5lWK+twzx0e7P8ZiDcRr
TLSH
T139167C2275144432D69142B29F0DEBBDDBBC6F70076240D37284BAAC6E76DC21736E9E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2261075

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\vm\share\AllTools\WhatsMinerTool\Release\WhatsMinerTool.pdb

kernel32

SetFilePointer WriteFile OutputDebugStringA CloseHandle WaitForSingleObject GetSystemTime WriteConsoleW RemoveDirectoryW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW IsValidCodePage FindFirstFileExW GetCurrentDirectoryW ReadConsoleW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileAttributesExW SetConsoleCtrlHandler ExitProcess HeapQueryInformation GetCommandLineW GetCommandLineA GetFullPathNameW SetStdHandle VirtualQuery VirtualAlloc GetFileInformationByHandle GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread RtlUnwind VerifyVersionInfoW PeekNamedPipe MoveFileExW FormatMessageW GetFileAttributesW DeleteFileW CreateDirectoryW UnlockFileEx SetFilePointerEx LockFileEx WaitNamedPipeW WideCharToMultiByte TransactNamedPipe SetNamedPipeHandleState CreateFileW GetSystemInfo GetVersion CreateProcessW CreateEventW SleepEx GetFileType CreateThread ReleaseMutex ExitThread CreateMutexA GetStringTypeW InitOnceExecuteOnce LCMapStringEx GetExitCodeThread WaitForSingleObjectEx TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared RaiseException OutputDebugStringW GetNativeSystemInfo GetModuleFileNameA GlobalAlloc FormatMessageA MoveFileA FindResourceW SizeofResource LockResource ReplaceFileA CreateToolhelp32Snapshot Process32First Process32Next CreateFileA CreateNamedPipeW IsDebuggerPresent TerminateProcess OpenProcess GetLocalTime FreeLibrary GlobalUnlock GlobalLock GetPrivateProfileIntA SetLastError GlobalSize MulDiv FindFirstFileA FlushFileBuffers GetFullPathNameA LockFile SetEndOfFile UnlockFile GetVolumeInformationA DuplicateHandle GetModuleFileNameW GetModuleHandleW LoadLibraryW lstrcmpiA GetThreadLocale InitializeCriticalSectionAndSpinCount LoadLibraryExW LocalAlloc FileTimeToSystemTime EncodePointer GetSystemDirectoryW GlobalDeleteAtom lstrcmpW FindResourceA GlobalAddAtomA GlobalFindAtomA GlobalGetAtomNameA CompareStringA SetThreadPriority SuspendThread ResumeThread GetVersionExA FileTimeToLocalFileTime LocalFree FindNextFileA GetCurrentThread lstrcmpA TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalReAlloc GlobalFree GetComputerNameA SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetUserDefaultLangID Sleep EnterCriticalSection LeaveCriticalSection DeleteFileA GetFileSize ReadFile GetLastError GetTickCount QueryPerformanceCounter QueryPerformanceFrequency FindClose FindNextFileW GetFileAttributesExA GetFileSizeEx LoadResource MultiByteToWideChar InitializeCriticalSection SetEvent ResetEvent CreateEventA FindResourceExW GetModuleHandleA GetPrivateProfileStringA WritePrivateProfileStringA CopyFileA GetCurrentProcessId WaitForMultipleObjects GetEnvironmentVariableA GetFileAttributesA GetSystemTimeAsFileTime CreateDirectoryA SetUnhandledExceptionFilter GetCurrentProcess GetCurrentThreadId WriteProcessMemory GetProcAddress LoadLibraryA GetPrivateProfileSectionNamesA DecodePointer HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle GetFileTime InitializeSListHead GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent UnhandledExceptionFilter GetUserDefaultLCID GetTempFileNameA GetTempPathA GetProfileIntA GetTickCount64 SearchPathA GetWindowsDirectoryA VerifyVersionInfoA VerSetConditionMask GetCurrentDirectoryA lstrcpyA GetACP GetCPInfo GetOEMCP VirtualProtect GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW GlobalFlags SetErrorMode

user32

GetUpdateRect GetComboBoxInfo MapVirtualKeyExA IsCharLowerA TranslateMDISysAccel DefMDIChildProcA DefFrameProcA DrawMenuBar DestroyCursor GetDoubleClickTime InvertRect HideCaret GetIconInfo PostThreadMessageA FrameRect CopyIcon SetCursorPos ReuseDDElParam UnpackDDElParam InsertMenuItemA LoadMenuA TranslateAcceleratorA LoadAcceleratorsA BringWindowToTop DestroyAcceleratorTable CreateAcceleratorTableA LoadAcceleratorsW GetWindowRect UnregisterClassA DrawFrameControl GetMessagePos ToAsciiEx GetKeyboardState GetKeyboardLayout LockWindowUpdate CharUpperBuffA SetParent SetClassLongA DrawFocusRect DrawEdge RegisterClipboardFormatA LoadImageA DrawIconEx GetNextDlgGroupItem InvalidateRgn CopyAcceleratorTableA CharNextA SetRect IsClipboardFormatAvailable LoadImageW DestroyIcon EnumDisplayMonitors SetLayeredWindowAttributes MonitorFromPoint UnionRect EnableScrollBar UpdateLayeredWindow IsRectEmpty SetMenuDefaultItem GetMenuDefaultItem NotifyWinEvent LoadCursorW MessageBeep SetWindowRgn CreateMenu SubtractRect GetWindowRgn GetKeyState SendMessageA EnableWindow PostQuitMessage wsprintfA IsIconic OpenClipboard CloseClipboard SetClipboardData EmptyClipboard SetTimer KillTimer GetSystemMetrics LoadMenuW CreatePopupMenu GetSubMenu AppendMenuA ModifyMenuA DrawIcon DrawTextA GetDC GetClientRect GetCursorPos ScreenToClient FindWindowA GetWindowThreadProcessId LoadIconA LoadIconW GetMenuStringA GetMenuState GetMenuItemID GetMenuItemCount InsertMenuA RemoveMenu IsWindowEnabled MessageBoxA GetWindowLongA GetParent GetLastActivePopup CharUpperA GetDesktopWindow DrawTextExA GrayStringA TabbedTextOutA GetWindowDC ReleaseDC BeginPaint EndPaint ClientToScreen GetSysColor FillRect GetFocus CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions SetMenuItemInfoA LoadBitmapW RegisterWindowMessageA DispatchMessageA PeekMessageA GetMessageTime PostMessageA DefWindowProcA CallWindowProcA RegisterClassA GetClassInfoA GetClassInfoExA CreateWindowExA IsWindow IsMenu IsChild DestroyWindow SetWindowPos GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos IsWindowVisible GetDlgItem GetDlgCtrlID SetFocus GetCapture GetMenu SetMenu TrackPopupMenu UpdateWindow SetActiveWindow GetForegroundWindow SetForegroundWindow ValidateRect RedrawWindow ScrollWindow SetScrollPos DeleteMenu GetSystemMenu ReleaseCapture SetCapture IsZoomed TrackMouseEvent GetAsyncKeyState CopyImage RealChildWindowFromPoint LoadCursorA GetSysColorBrush SystemParametersInfoA GetMenuItemInfoA DestroyMenu MapDialogRect SetWindowContextHelpId SetCursor ShowOwnedPopups WindowFromPoint WaitMessage IntersectRect InflateRect TranslateMessage GetMessageA OffsetRect SetRectEmpty MapVirtualKeyA GetKeyNameTextA InvalidateRect DrawStateA GetActiveWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamA IsDialogMessageA SetWindowTextA SendDlgItemMessageA CheckDlgButton GetScrollPos SetScrollRange GetScrollRange ShowScrollBar SetPropA GetPropA RemovePropA GetWindowTextA GetWindowTextLengthA AdjustWindowRectEx MapWindowPoints CopyRect EqualRect PtInRect SetWindowLongA GetClassLongA GetClassNameA GetTopWindow GetWindow SetWindowsHookExA EnumChildWindows UnhookWindowsHookEx CallNextHookEx SetScrollInfo GetScrollInfo WinHelpA MonitorFromWindow GetMonitorInfoA ShowWindow MoveWindow

gdi32

GetTextFaceA SetPixelV GetWindowOrgEx GetViewportOrgEx PtInRegion GetBoundsRect FrameRgn FillRgn RoundRect SetPaletteEntries ExtFloodFill LPtoDP GetSystemPaletteEntries GetPaletteEntries GetNearestPaletteIndex CreatePalette Rectangle Polyline Polygon CreatePolygonRgn Ellipse CreateEllipticRgn OffsetRgn SetDIBColorTable StretchBlt SetPixel RealizePalette EnumFontFamiliesExA GetRgnBox GetTextColor GetBkColor GetTextCharsetInfo EnumFontFamiliesA CreateDIBitmap CreateDIBSection CreateCompatibleBitmap CreateRoundRectRgn GetTextMetricsA GetTextExtentPoint32A DPtoLP SetRectRgn GetMapMode CreateFontIndirectA CombineRgn PatBlt CreateRectRgnIndirect ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutA TextOutA MoveToEx GetObjectA SetTextAlign SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SetBkColor SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetObjectType GetClipBox ExcludeClipRect Escape DeleteObject DeleteDC CreateSolidBrush CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC CreateBitmap BitBlt CreateDCA CopyMetaFileA SetTextColor GetDeviceCaps CreateFontA

msimg32

TransparentBlt AlphaBlend

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

advapi32

SystemFunction036 CryptEncrypt CryptImportKey CryptDestroyKey CryptAcquireContextW ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextA CryptReleaseContext RegCloseKey RegEnumKeyExA RegEnumValueA RegQueryValueA RegEnumKeyA RegSetValueExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegQueryValueExA RegOpenKeyExA GetUserNameA

shell32

SHGetSpecialFolderLocation SHGetFileInfoA SHGetDesktopFolder SHBrowseForFolderA DragQueryFileA SHGetPathFromIDListA SHGetMalloc ShellExecuteA ShellExecuteExA Shell_NotifyIconA DragFinish SHAppBarMessage

shlwapi

PathRemoveFileSpecW PathFindExtensionA PathStripToRootA PathIsUNCA PathFindFileNameA PathFileExistsA StrFormatKBSizeA

uxtheme

IsAppThemed DrawThemeText DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemePartSize GetCurrentThemeName IsThemeBackgroundPartiallyTransparent GetWindowTheme GetThemeColor GetThemeSysColor

ole32

CoFreeUnusedLibraries CreateStreamOnHGlobal DoDragDrop OleIsCurrentClipboard OleFlushClipboard CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CoDisconnectObject CLSIDFromProgID CLSIDFromString CoInitialize CoCreateGuid CoCreateInstance CoInitializeEx CoUninitialize ReleaseStgMedium OleUninitialize CoTaskMemFree CoTaskMemAlloc OleGetClipboard CoLockObjectExternal RegisterDragDrop OleInitialize RevokeDragDrop OleLockRunning OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator CoRevokeClassObject CoRegisterMessageFilter OleDuplicateData

oleaut32

SysAllocString OleCreateFontIndirect VarBstrFromDate VariantCopy SysFreeString SysAllocStringByteLen SysAllocStringLen VariantInit VariantClear VariantChangeType LoadTypeLi SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy

oledlg

ord8

ws2_32

htonl freeaddrinfo getaddrinfo WSAStartup setsockopt recvfrom listen getsockopt getsockname bind accept WSAGetLastError socket send select recv inet_addr htons ioctlsocket connect closesocket __WSAFDIsSet getpeername ntohs sendto WSASend WSAAddressToStringW WSAPoll WSAIoctl WSACloseEvent WSAAsyncSelect WSACreateEvent WSAEnumNetworkEvents WSAEventSelect gethostname WSACleanup WSASetLastError shutdown

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

iphlpapi

GetAdaptersInfo

dbghelp

MiniDumpWriteDump

gdiplus

GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePalette GdipGetImagePaletteSize GdipCreateBitmapFromStream GdiplusStartup GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDeleteGraphics GdipDrawImageI GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI GdiplusShutdown GdipAlloc GdipFree

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

winmm

PlaySoundA

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

rpcrt4

UuidCreate

crypt32

CryptBinaryToStringA

wldap32

ord219 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27 ord145 ord127 ord167 ord142 ord79 ord133 ord301 ord147

_cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetNumberValue@4 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithLength@8 _cJSON_ParseWithLengthOpts@16 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_SetValuestring@8 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

666KB

Virtual Size

666KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

49KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

214KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=34, id=259, version=33145,

count=100, id=260, productName=VS2019 v16.8.5 build 29337, version=29337,

count=2, id=259, productName=VS2019 v16.7.1 build 29111, version=29111,

count=42, id=261, productName=VS2019 v16.7.1 build 29111, version=29111,

count=3, id=261, productName=VS2019 v16.8.5 build 29337, version=29337,

count=21, id=260, version=32825,

count=6, id=253, version=33808,

count=42, id=260, version=33145,

count=252, id=261, version=33145,

count=1, id=262, version=33145,

count=49, id=257, version=33145,

count=994, id=1, productName=Unmarked objects,

count=27, id=259, version=33808,

count=19, id=260, version=33808,

count=420, id=261, version=33808,

count=99, id=260, version=34123,

count=59, id=261, version=34123,

count=1, id=256, version=34123,

count=1, id=255, version=34123,

count=1, id=151,

count=1, id=258, version=34123,