089128c6ff521efca5957c12323ef82ab27f938a0768db97db536079cb115f67

Sharing

Copy URL Twitter E-mail

General

Target
089128c6ff521efca5957c12323ef82ab27f938a0768db97db536079cb115f67
Size 980KB
Sample260701-2cscesg13z
SHA256 089128c6ff521efca5957c12323ef82ab27f938a0768db97db536079cb115f67
MD5 a1af50400e05871a8ada07b6bfa34dae
SHA1 320896a0bed3880c17249c6fd37e7184ea8da14d
SHA512 75c6ed8f36490ed2bbe333e6327779224c843d0b5245c260a3660010a9e2bce8122b0a12b6d0cd3adcf179509516141eeb5725f4ba7fb810099e3d7b022553fa
SSDEEP 12288:J7y6jQlNvZNC9tAGLuedzlmOKvxpWwGxg8ID2Zy/EyldJ6AqfunOnv:J758bvZNkAAumsOo1Gxi2UdJ6A1nUv
TLSH
T13A258E2276818236E56206B28E3EFB1950BCFA20573549CBF3D81E0DDD70AD26B35767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
089128c6ff521efca5957c12323ef82ab27f938a0768db97db536079cb115f67

File Explorer

089128c6ff521efca5957c12323ef82ab27f938a0768db97db536079cb115f67

.exe 980KB

089128c6ff521efca5957c12323ef82ab27f938a0768db97db536079cb115f67

IMPHASH ef73d0049c2c8cab726861be3fd68291
SHA256 089128c6ff521efca5957c12323ef82ab27f938a0768db97db536079cb115f67
MD5 a1af50400e05871a8ada07b6bfa34dae
SHA1 320896a0bed3880c17249c6fd37e7184ea8da14d
SHA512 75c6ed8f36490ed2bbe333e6327779224c843d0b5245c260a3660010a9e2bce8122b0a12b6d0cd3adcf179509516141eeb5725f4ba7fb810099e3d7b022553fa
SSDEEP 12288:J7y6jQlNvZNC9tAGLuedzlmOKvxpWwGxg8ID2Zy/EyldJ6AqfunOnv:J758bvZNkAAumsOo1Gxi2UdJ6A1nUv
TLSH
T13A258E2276818236E56206B28E3EFB1950BCFA20573549CBF3D81E0DDD70AD26B35767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

594606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\TeamCity\buildAgent\work\d4d63473664e13ec\out\Release\bin\LoginPro.pdb

libcef

cef_string_multimap_free cef_string_multimap_alloc cef_string_map_free cef_string_map_alloc cef_string_utf8_clear cef_log cef_string_multimap_value cef_string_multimap_size cef_string_map_append cef_string_map_value cef_string_map_key cef_string_map_size cef_string_list_append cef_string_list_value cef_string_list_size cef_string_utf16_cmp cef_api_hash cef_string_list_alloc cef_string_list_free cef_currently_on cef_post_task cef_browser_host_create_browser cef_string_list_copy cef_string_ascii_to_utf16 cef_string_utf16_to_utf8 cef_string_utf8_to_utf16 cef_cookie_manager_get_global_manager cef_string_multimap_key cef_string_utf16_set cef_string_userfree_utf16_free cef_string_multimap_append cef_quit_message_loop cef_run_message_loop cef_shutdown cef_initialize cef_execute_process cef_string_utf16_clear

kernel32

SetEnvironmentVariableA GetCommandLineW CreateFileW WriteFile CloseHandle InitializeCriticalSectionAndSpinCount RaiseException GetLastError DecodePointer DeleteCriticalSection SetLastError WriteConsoleW GetTimeZoneInformation GetOEMCP IsValidCodePage GetStdHandle HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetStartupInfoW UnhandledExceptionFilter GetCPInfo ReadConsoleW RtlUnwind AreFileApisANSI SetStdHandle HeapReAlloc GetConsoleMode GetConsoleCP GetFullPathNameW IsProcessorFeaturePresent GetStringTypeW EncodePointer InterlockedExchangeAdd TerminateProcess LoadLibraryExW lstrcmpiW GetDriveTypeW FreeLibrary HeapFree GetProcessHeap HeapAlloc FreeEnvironmentStringsW GetEnvironmentStringsW OutputDebugStringW WideCharToMultiByte DosDateTimeToFileTime GetFileType GlobalUnlock GlobalLock GlobalAlloc InterlockedDecrement GetLocalTime MulDiv ExitProcess GetFileSize LoadLibraryW MultiByteToWideChar GetACP FindResourceW SizeofResource LoadResource LockResource CreateToolhelp32Snapshot Process32NextW Process32FirstW GetUserDefaultLangID FreeResource GetModuleHandleExA GetTempFileNameW GetCurrentProcess CreateDirectoryW CopyFileW GetFileAttributesW ReadFile GetTempPathW GetCurrentDirectoryW GetLongPathNameW RemoveDirectoryW GetFileAttributesExW DeleteFileW WaitForSingleObject GetCurrentThread Sleep IsDebuggerPresent GetCurrentThreadId DuplicateHandle CreateThread InterlockedCompareExchange TlsGetValue TlsSetValue TlsAlloc TlsFree SetEvent CreateEventW SetUnhandledExceptionFilter CreateMutexW SetFilePointer CreateProcessW GetTickCount GetModuleFileNameW ReleaseMutex GetCurrentProcessId LeaveCriticalSection EnterCriticalSection GetSystemDirectoryW GetWindowsDirectoryW SetEndOfFile SetFilePointerEx SetFileTime FlushFileBuffers SystemTimeToTzSpecificLocalTime SystemTimeToFileTime QueryPerformanceCounter GetSystemTimeAsFileTime FileTimeToSystemTime QueryPerformanceFrequency GetNativeSystemInfo GetModuleHandleW GetVersionExW GetProcAddress GetModuleHandleExW GetQueuedCompletionStatus InterlockedExchange PostQueuedCompletionStatus CreateIoCompletionPort InterlockedIncrement

user32

CreateAcceleratorTableW MoveWindow GetSysColor ClientToScreen SetCaretPos ShowCaret HideCaret CreateCaret InvalidateRgn GetCaretBlinkTime GetWindowTextLengthW GetWindowTextW SetWindowTextW SetRect FillRect GetDesktopWindow BeginDeferWindowPos GetGUIThreadInfo GetCaretPos DeferWindowPos SetActiveWindow DrawTextW CharPrevW GetLastActivePopup EndDeferWindowPos SetForegroundWindow UnregisterClassW PostMessageW AllowSetForegroundWindow SendMessageW FindWindowW SetWindowRgn MessageBoxW DispatchMessageW DefWindowProcW CreateWindowExW MsgWaitForMultipleObjectsEx PeekMessageW CallMsgFilterW RegisterClassExW TranslateMessage GetQueueStatus WaitMessage KillTimer PostQuitMessage SetTimer DestroyWindow IntersectRect PtInRect CharNextW wvsprintfW SetCursor UnionRect OffsetRect LoadCursorW IsWindow SetWindowPos IsWindowVisible IsIconic SetFocus GetActiveWindow GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect GetWindowRect GetCursorPos ScreenToClient MapWindowPoints IsRectEmpty GetWindowLongW SetWindowLongW GetParent GetWindow CallWindowProcW RegisterClassW GetClassInfoExW ShowWindow EnableWindow SetPropW GetPropW MonitorFromWindow GetMonitorInfoW IsZoomed

shell32

SHGetFolderPathW SHFileOperationW ShellExecuteW CommandLineToArgvW

ole32

OleInitialize CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CreateStreamOnHGlobal OleLockRunning CLSIDFromProgID CLSIDFromString CoCreateInstance CoInitializeEx CoUninitialize CoInitialize RevokeDragDrop

oleaut32

VarUI4FromStr VariantClear VariantInit SysAllocString SysFreeString

dbghelp

MiniDumpWriteDump

gdiplus

GdipDeleteGraphics GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipCreateBitmapFromScan0 GdipGraphicsClear GdipDrawImage GdipDrawImageRectI GdipDeleteFontFamily GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipCreateLineBrushI GdipDeleteBrush GdipCloneBrush GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipCreateFromHDC GdipAlloc GdipFree GdipDrawString GdipGetFamily GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdiplusShutdown GdiplusStartup

vmprotectsdk32

VMProtectBegin VMProtectEnd

winmm

timeEndPeriod timeBeginPeriod timeGetTime

imm32

ImmReleaseContext ImmSetCompositionFontW ImmSetCompositionWindow ImmGetContext

iphlpapi

GetAdaptersInfo

comctl32

_TrackMouseEvent ord17

gdi32

GetObjectW SetWindowOrgEx CreateRoundRectRgn CombineRgn CreatePenIndirect CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW GetTextMetricsW DeleteDC DeleteObject GetStockObject Rectangle RestoreDC SelectObject CreatePen BitBlt GetDeviceCaps CreatePatternBrush GetObjectA GdiFlush ExtTextOutW TextOutW MoveToEx CreateDIBSection SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateSolidBrush CreateRectRgnIndirect SaveDC

advapi32

RegDeleteKeyW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegQueryInfoKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW IsTextUnicode

libcurl

curl_free curl_slist_append curl_easy_init curl_easy_escape curl_global_init curl_slist_free_all curl_easy_cleanup curl_easy_getinfo curl_easy_perform curl_easy_setopt

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

751KB

Virtual Size

750KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=199, version=41118,

count=40, id=223, productName=VS2013 build 21005, version=21005,

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=88, id=225, productName=VS2013 build 21005, version=21005,

count=254, id=224, productName=VS2013 build 21005, version=21005,

count=2, id=225, version=20806,

count=4, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=34, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=83, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=36, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=588, id=1, productName=Unmarked objects,

count=127, id=229, version=31101,

count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,