190030

Sharing

Copy URL Twitter E-mail

General

Target
190030
Size 265KB
Sample260427-psbndset9m
SHA256 20a3abd5e7ad32389dc8828873c947db87d43385993c51b811c219619791220c
MD5 770baa636f3b61da7e414421444f84fd
SHA1 104eb2e049c5627ed470a09ad2c0d2c1516b6e59
SHA512 307ed35dad2c514d57846f32fc1835909e4a4b9d73a9025b5e6f27b5712f322b283aa0f4540ecccb373732d3b1440a6ca8d19ebc268ac354c91679d5c63ea05e
SSDEEP 6144:lK9h9bOMIhNliBVCFRjraSgJG23neIJscEV9DVRrGM8sFNlqC1ru2+nPHTN1dyat:IlElir4JraSgJG23neIJscEV9DVRrGMW
TLSH
T110446B4FF6646CF2E25782B1C4869776E7B1BA541E60CB0F06A5C7073F27672AE08B14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

190030

.exe 265KB

IMPHASH 30262927b03d3a75d7e9eb9bcdfc9338
SHA256 20a3abd5e7ad32389dc8828873c947db87d43385993c51b811c219619791220c
MD5 770baa636f3b61da7e414421444f84fd
SHA1 104eb2e049c5627ed470a09ad2c0d2c1516b6e59
SHA512 307ed35dad2c514d57846f32fc1835909e4a4b9d73a9025b5e6f27b5712f322b283aa0f4540ecccb373732d3b1440a6ca8d19ebc268ac354c91679d5c63ea05e
SSDEEP 6144:lK9h9bOMIhNliBVCFRjraSgJG23neIJscEV9DVRrGM8sFNlqC1ru2+nPHTN1dyat:IlElir4JraSgJG23neIJscEV9DVRrGMW
TLSH
T110446B4FF6646CF2E25782B1C4869776E7B1BA541E60CB0F06A5C7073F27672AE08B14
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

06:40:ad:d3:62:f5:1d:cb:99:32:8d:6e:2e:c3:35:5b:cc:4b:e8:7d:20:79:c8:94:53:24:84:17:9e:43:91:85

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2014

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 1, 2014 - Oct 1, 2015

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:00:4e:f3:66:b1:29:13:9a:11:13:00:00:00:00:00:4e

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 23, 2014 - Aug 23, 2015

Minor OS version

Major OS version

Entry point

66176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AudioDG.pdb

msvcrt

exit __set_app_type memcpy_s _vsnwprintf _fmode _commode _resetstkoflw __wgetmainargs _amsg_exit _exit memmove_s _wcsicmp malloc ??_U@YAPEAX_K@Z wcsncpy_s ??3@YAXPEAX@Z _wcmdln __C_specific_handler _initterm _cexit _wcstoui64 _XcptFilter _CxxThrowException __CxxFrameHandler3 memcmp memset __setusermatherr ??2@YAPEAX_K@Z _purecall realloc _errno _onexit __dllonexit _unlock _lock ??1type_info@@UEAA@XZ ??_V@YAXPEAX@Z free ?terminate@@YAXXZ memcpy

ntdll

ShipAssertMsgW RtlInitUnicodeStringEx NtAlpcConnectPort NtAlpcAcceptConnectPort NtAlpcSendWaitReceivePort NtClose RtlRandomEx NtAlpcCreatePort AlpcGetMessageAttribute RtlSetLastWin32ErrorAndNtStatusFromNtStatus RtlDestroyMemoryZone RtlDestroyMemoryBlockLookaside RtlUnlockMemoryZone RtlAllocateMemoryBlockLookaside RtlCreateMemoryZone RtlNtStatusToDosError RtlAllocateMemoryZone RtlLockMemoryZone RtlCreateMemoryBlockLookaside RtlFreeMemoryBlockLookaside RtlExtendMemoryBlockLookaside RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtQueryInformationProcess EtwLogTraceEvent ShipAssert WinSqmIncrementDWORD EtwUnregisterTraceGuids EtwRegisterTraceGuidsW EtwGetTraceEnableFlags EtwGetTraceEnableLevel EtwGetTraceLoggerHandle EtwTraceMessage EtwEventWrite EtwEventRegister AlpcInitializeMessageAttribute

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection EnterCriticalSection WaitForMultipleObjectsEx CreateEventW SetEvent WaitForSingleObjectEx InitializeCriticalSection Sleep InitOnceBeginInitialize WaitForSingleObject ResetEvent InitOnceExecuteOnce DeleteCriticalSection

api-ms-win-core-handle-l1-1-0

DuplicateHandle GetHandleInformation CloseHandle

rpcrt4

I_RpcBindingInqLocalClientPID RpcServerUnregisterIfEx RpcServerRegisterIf3 NdrServerCallAll NdrServerCall2 I_RpcBindingInqTransportType RpcImpersonateClient RpcRevertToSelf RpcServerUseProtseqEpW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-com-l1-1-1

CoTaskMemRealloc StringFromCLSID CoRevertToSelf CoImpersonateClient PropVariantClear CoTaskMemAlloc CoRevokeClassObject CoRegisterClassObject CoResumeClassObjects CoCreateInstance CoInitializeSecurity CoUninitialize CLSIDFromString CoInitializeEx CoTaskMemFree

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter GetLastError SetUnhandledExceptionFilter RaiseException SetLastError

api-ms-win-core-processthreads-l1-1-2

TerminateProcess GetCurrentProcess GetCurrentProcessId OpenProcess GetStartupInfoW CreateThread GetCurrentThreadId

api-ms-win-security-base-l1-2-0

MakeAbsoluteSD

api-ms-win-core-heap-l1-2-0

GetProcessHeap HeapAlloc HeapReAlloc HeapFree HeapDestroy HeapSetInformation HeapSize

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW GetProcAddress LockResource FreeLibrary GetModuleFileNameW LoadResource GetModuleHandleW SizeofResource FindResourceExW

api-ms-win-core-processenvironment-l1-2-0

GetCommandLineW

api-ms-win-core-memory-l1-1-2

VirtualLock SetProcessWorkingSetSizeEx GetProcessWorkingSetSizeEx MapViewOfFile UnmapViewOfFile VirtualUnlock CreateFileMappingW

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime GetTickCount

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc LocalFree

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

mmdevapi

ord2 ord8 ord9

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegQueryInfoKeyW RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCloseKey RegEnumKeyExW

api-ms-win-eventing-classicprovider-l1-1-0

TraceEvent TraceMessage

api-ms-win-eventing-provider-l1-1-0

EventWrite

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook ResolveDelayLoadedAPI

Name

.text

Size

219KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

RT_CODE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

RT_BSS

Size

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

RT_DATA

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

RT_CONST

Size

1024B

Virtual Size

928B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

190030

msvcrt

ntdll

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

rpcrt4

api-ms-win-core-profile-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-security-base-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

mmdevapi

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-delayload-l1-1-1

generic