client_packed[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
client_packed.exe
Size 3.4MB
Sample260628-xcmdysct5m
SHA256 1f7330e82778177b6c6d6b27f5452fb49089e952f50f0adbf7cca59f1feb611c
MD5 556bf1f33a8c5868cbb957771e7aa900
SHA1 afa16a6cecbda85e0891def8ca30ad20aec85b88
SHA512 0ff5246a833aaf89fa8244ac50b7f44f7ee9a98b70d01b4557073e083f354a9982152848651501e62e708587b8fc9e91aca60c9432cfd798a8f0cf122ca3793b
SSDEEP 49152:dlTZoZqSnSVTHR9y7AxCSZe+mg+kbHX6Z7pAO78ISH9uabjnIW9P1IgNswNstt:+eR0EIg+RWduabcW9PRNstt
TLSH
T1E9F54B47D26310ECC127C1748A6A9772FA31B45C42B47E7F6694CBF12F21E50BA2EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client_packed.exe

File Explorer

client_packed.exe

.exe 3.4MB

client_packed.exe

IMPHASH 095675090a741a18a36331d4ff20f165
SHA256 1f7330e82778177b6c6d6b27f5452fb49089e952f50f0adbf7cca59f1feb611c
MD5 556bf1f33a8c5868cbb957771e7aa900
SHA1 afa16a6cecbda85e0891def8ca30ad20aec85b88
SHA512 0ff5246a833aaf89fa8244ac50b7f44f7ee9a98b70d01b4557073e083f354a9982152848651501e62e708587b8fc9e91aca60c9432cfd798a8f0cf122ca3793b
SSDEEP 49152:dlTZoZqSnSVTHR9y7AxCSZe+mg+kbHX6Z7pAO78ISH9uabjnIW9P1IgNswNstt:+eR0EIg+RWduabcW9PRNstt
TLSH
T1E9F54B47D26310ECC127C1748A6A9772FA31B45C42B47E7F6694CBF12F21E50BA2EB25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CloseServiceHandle ControlService CreateServiceW DeleteService GetUserNameA GetUserNameW OpenSCManagerW OpenServiceW RegCloseKey RegDeleteValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExW RegSetValueExW StartServiceW

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptStringToBinaryA CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

kernel32

AreFileApisANSI CheckRemoteDebuggerPresent CloseHandle CopyFileW CreateDirectoryW CreateEventA CreateFileA CreateFileMappingW CreateFileW CreateHardLinkW CreateMutexW CreatePipe CreateProcessA CreateProcessW CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FlushFileBuffers FlushInstructionCache FlushViewOfFile FormatMessageA FormatMessageW FreeLibrary GetComputerNameW GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetEnvironmentVariableW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFullPathNameA GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStartupInfoA GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempFileNameW GetTempPathA GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 GlobalLock GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection IsDBCSLeadByte IsDebuggerPresent K32EnumDeviceDrivers K32GetDeviceDriverBaseNameW LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadProcessMemory ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEvent SetFilePointer SetHandleInformation SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualAllocEx VirtualProtect VirtualProtectEx VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile WriteProcessMemory __C_specific_handler

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoll strtoul strtoull wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ _putenv_s _wgetcwd getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _wchdir _wchmod _wfindfirst64i32 _wfindnext64i32 _wfullpath _wmkdir _wstat64 _fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

longjmp memchr memcmp memcpy memmove strchr strrchr __intrinsic_setjmp

api-ms-win-crt-runtime-l1-1-0

_set_app_type _assert __p___argc __p___argv __p__acmdln _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _get_errno _initialize_narrow_environment _initterm _initterm_e _set_errno _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf _chsize_s _close _get_osfhandle _setmode _wfopen _wopen fclose feof ferror fflush fputc fputs fread fseek ftell fwrite getc putc setvbuf ungetc fopen _write _read _lseeki64 _fileno

api-ms-win-crt-string-l1-1-0

iswctype _wcsicmp memset strcmp strcoll strcspn strlen strncmp strncpy strnlen strspn strxfrm tolower towlower towupper wcscat wcscmp wcscoll wcscpy wcslen wcsnlen wcsxfrm wctype _stricmp _stricmp _strdup

api-ms-win-crt-time-l1-1-0

_localtime64 _wutime64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

ntdll

RtlInitUnicodeString

ole32

CoCreateInstance CoInitializeEx

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

shell32

SHGetFolderPathW

user32

CallNextHookEx CloseClipboard CloseDesktop CloseWindowStation CreateDesktopW CreateWindowStationW DispatchMessageW GetClipboardData GetDC GetForegroundWindow GetKeyboardState GetMessageW GetProcessWindowStation GetSystemMetrics GetWindowTextW OpenClipboard OpenDesktopW OpenWindowStationW PostThreadMessageW ReleaseDC SendInput SetProcessWindowStation SetThreadDesktop SetWindowsHookExW ShowWindow ToUnicode TranslateMessage UnhookWindowsHookEx

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpWebSocketCompleteUpgrade WinHttpWebSocketReceive WinHttpWebSocketSend

winmm

timeGetTime

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

257KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

137KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

client_packed.exe

advapi32

bcrypt

crypt32

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ntdll

ole32

oleaut32

shell32

user32

winhttp

winmm

generic