tmp_whbbqtp

Sharing

Copy URL Twitter E-mail

General

Target
tmp_whbbqtp
Size 298KB
Sample260522-wce47sb15n
SHA256 137297c6bc4f575f3c858d8f645e5ab60a967bd4c855e15d145a99acc0b6055e
MD5 7e6e25c01af614db545854e8698a8e75
SHA1 40f4da46fefb6262988f4acce9c7644c3294dd91
SHA512 90c8a3de69789f327bcc4d5b7dd7a42270d8da045135cdc0d9bc87c38172a87859dfab0228d25215568b2773239d431ba9db72ca0ee4f12966b4717bc2772435
SSDEEP 6144:P6QcDGsSQMsYHDQAnwOYS2BiVqx394VpMolap/jyH6/:CrGscxHDQNtSHC9WDg
TLSH
T1935401A7E59955A3C4762D755CDF89BA9CD308D20B780A36356C881E0FF7B82E473B80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp_whbbqtp

File Explorer

tmp_whbbqtp

.exe 298KB

IMPHASH 9b7fdaff652ec0eaf6eb6e53335d8e58
SHA256 137297c6bc4f575f3c858d8f645e5ab60a967bd4c855e15d145a99acc0b6055e
MD5 7e6e25c01af614db545854e8698a8e75
SHA1 40f4da46fefb6262988f4acce9c7644c3294dd91
SHA512 90c8a3de69789f327bcc4d5b7dd7a42270d8da045135cdc0d9bc87c38172a87859dfab0228d25215568b2773239d431ba9db72ca0ee4f12966b4717bc2772435
SSDEEP 6144:P6QcDGsSQMsYHDQAnwOYS2BiVqx394VpMolap/jyH6/:CrGscxHDQNtSHC9WDg
TLSH
T1935401A7E59955A3C4762D755CDF89BA9CD308D20B780A36356C881E0FF7B82E473B80
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16797

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetComputerNameW OutputDebugStringW TlsFree GetSystemTimeAsFileTime HeapSize FindFirstFileW TlsSetValue SetThreadAffinityMask CloseHandle HeapAlloc ResumeThread ResetEvent IsProcessorFeaturePresent WriteProcessMemory RegisterWaitForSingleObject VirtualAllocEx SetFilePointer OpenFileMappingW CreateThread EnterCriticalSection WaitForMultipleObjects GetModuleHandleA TlsAlloc HeapDestroy GetThreadContext GetProcessAffinityMask UnhandledExceptionFilter LeaveCriticalSection lstrcmpiW CreateFileW DuplicateHandle FindClose LockResource SwitchToThread FormatMessageW UnmapViewOfFile SizeofResource GetTempPathW OpenThread UnregisterWaitEx LoadLibraryExW LoadResource GetModuleHandleW HeapReAlloc TlsGetValue DeleteFileW GetThreadPriority WideCharToMultiByte WaitForSingleObject FormatMessageA GetCurrentThreadId FreeEnvironmentStringsW lstrlenW OpenProcess FindResourceExW GlobalLock ReadFile SetUnhandledExceptionFilter CreateProcessW IsDebuggerPresent InitializeCriticalSectionAndSpinCount GetProcessHeap RaiseException SetLastError LocalFree GetSystemInfo DeleteCriticalSection FreeLibrary SetEnvironmentVariableW SuspendThread FindResourceW CreateEventW LCMapStringW LocalAlloc HeapFree MapViewOfFile GetThreadLocale ExpandEnvironmentStringsW GlobalUnlock GlobalAlloc GetFileInformationByHandle

oleaut32

VariantClear SysStringByteLen VarUI4FromStr SysStringLen SysAllocStringByteLen VarBstrCmp VarBstrCat SysFreeString SysAllocStringLen SysAllocString VariantInit

ole32

CoTaskMemAlloc CoTaskMemRealloc StringFromGUID2 CoCreateGuid CoUninitialize StringFromCLSID CoLockObjectExternal CreateStreamOnHGlobal CLSIDFromString CoInitializeEx CoTaskMemFree CoCreateInstance

shell32

SHGetFolderPathW

advapi32

SetSecurityDescriptorDacl IsValidSecurityDescriptor RegCreateKeyExW RegOpenKeyExA RegQueryInfoKeyW OpenProcessToken PrivilegeCheck RegEnumKeyExW RegDeleteValueW AddAccessAllowedAce RegCloseKey SetSecurityDescriptorOwner DuplicateToken RegOpenKeyExW InitializeSecurityDescriptor InitializeAcl RegDeleteKeyW RegSetValueExW AllocateAndInitializeSid LookupPrivilegeValueW FreeSid SetSecurityDescriptorGroup RegQueryValueExW GetLengthSid AccessCheck AdjustTokenPrivileges RegQueryValueExA RegConnectRegistryW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

user32

PeekMessageW CharNextW LoadStringW PostThreadMessageW TranslateMessage CharUpperBuffW DispatchMessageW GetMessageW UpdateWindow

comctl32

CreateStatusWindow ImageList_EndDrag ImageList_DragEnter DestroyPropertySheetPage ImageList_LoadImage ImageList_DragShowNolock InitMUILanguage DrawStatusTextA LBItemFromPt

msrle32

DriverProc

Name

.text

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

74KB

Virtual Size

1012KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

142KB

Virtual Size

418KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

708KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmp_whbbqtp

kernel32

oleaut32

ole32

shell32

advapi32

version

user32

comctl32

msrle32

generic