microsoft-office-2024-16-0-18025-20140[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
microsoft-office-2024-16-0-18025-20140.exe
Size 7.2MB
Sample260701-3kshtshv5v
SHA256 e950db34a18a2a34fd0fcde97009218c69c9b39fefc328cbe013a386cb6004a1
MD5 94d8237c93ca773771bfb5b3f2314c17
SHA1 34ebd1493b3dcc5ec2dce16b4d3d4f731b189f6b
SHA512 1211ee06dbfcc512147826f7b662f512710933e20c32a04e9c882569f16e53a9fc14ac413119207223746c224ac072a4d0c9f04b24845b093212937a2622c829
SSDEEP 196608:B5yeJSOxmp+8jIh/FdF3bx30bqGdiZhQNGIwWar45iWaI6HMaJTtGb5k1:3Qj+8jyF73V3xZ7ck1
TLSH
T12F767C33A6D6CC36F5B7E2F0AD7DAF1944BABE720930801F6384D64D1AB0982D525727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
microsoft-office-2024-16-0-18025-20140.exe

File Explorer

microsoft-office-2024-16-0-18025-20140.exe

.exe 7.2MB

microsoft-office-2024-16-0-18025-20140.exe

IMPHASH ca7d3169e7c7942080190cde3c16c7c7
SHA256 e950db34a18a2a34fd0fcde97009218c69c9b39fefc328cbe013a386cb6004a1
MD5 94d8237c93ca773771bfb5b3f2314c17
SHA1 34ebd1493b3dcc5ec2dce16b4d3d4f731b189f6b
SHA512 1211ee06dbfcc512147826f7b662f512710933e20c32a04e9c882569f16e53a9fc14ac413119207223746c224ac072a4d0c9f04b24845b093212937a2622c829
SSDEEP 196608:B5yeJSOxmp+8jIh/FdF3bx30bqGdiZhQNGIwWar45iWaI6HMaJTtGb5k1:3Qj+8jyF73V3xZ7ck1
TLSH
T12F767C33A6D6CC36F5B7E2F0AD7DAF1944BABE720930801F6384D64D1AB0982D525727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infetado

Minor OS version

Major OS version

Entry point

4075362

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

d:\dbs\el\omr\target\x86\ship\click2run\en-us\SetupBootstrapper.pdb

advapi32

ConvertSidToStringSidW OpenProcessToken GetTokenInformation RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash CryptReleaseContext CreateWellKnownSid CheckTokenMembership RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegDeleteValueW IsValidSid GetSidSubAuthorityCount GetSidSubAuthority EventWriteTransfer EventRegister EventUnregister EventSetInformation RegNotifyChangeKeyValue RevertToSelf OpenThreadToken GetLengthSid CopySid InitializeAcl AddAccessAllowedAce AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA EqualSid RegEnumValueA RegDeleteValueA RegGetValueA EventWrite LookupPrivilegeValueW AdjustTokenPrivileges OpenSCManagerW CloseServiceHandle OpenServiceW QueryServiceStatusEx QueryServiceConfigW StartServiceW ControlService EnumDependentServicesW ChangeServiceConfigW

ole32

CoInitialize CLSIDFromString CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemFree StringFromCLSID CoCreateInstance CoSetProxyBlanket CoCreateGuid StringFromGUID2 CoCreateFreeThreadedMarshaler IIDFromString CoInitializeSecurity CoInitializeEx CoEnableCallCancellation CoDisableCallCancellation CoCancelCall CoUninitialize

oleaut32

GetErrorInfo SysFreeString VariantInit VariantClear SetErrorInfo SysAllocString SysStringLen

gdi32

CreateFontW SetBkColor SetTextColor DeleteObject Rectangle SetDCPenColor CreatePen GetTextExtentPoint32W SelectObject CreateSolidBrush SetDCBrushColor GetTextMetricsW GetStockObject GetDeviceCaps

kernel32

RtlUnwind SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo EncodePointer CreateTimerQueueTimer ExitProcess GetOEMCP CloseHandle GetLastError GetModuleHandleW GetProcAddress LoadLibraryW SetLastError GetModuleFileNameW OutputDebugStringA CompareStringEx LocalFree HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId FreeLibrary CreateThread GetCurrentThreadId GetExitCodeThread SetProcessMitigationPolicy CreateEventExW WriteFile DeleteFileW WideCharToMultiByte IsWow64Process GetModuleHandleExW ExpandEnvironmentStringsW GlobalFree MultiByteToWideChar InitializeCriticalSectionEx DeleteCriticalSection DecodePointer CreateMutexW GetNativeSystemInfo VerSetConditionMask VerifyVersionInfoW GetUserDefaultLocaleName FlsFree FlsAlloc AttachConsole AllocConsole GetStdHandle WriteConsoleW FreeConsole LocaleNameToLCID FindClose UnmapViewOfFile CreateFileA GetFileSize CreateFileMappingW MapViewOfFile Sleep GetStringTypeExW GetUserDefaultLCID LoadLibraryA LCMapStringW FormatMessageA RaiseException InitializeSRWLock AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared OpenProcess GetExitCodeProcess GetProcessTimes GetTickCount64 GetSystemTimeAsFileTime TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW LoadLibraryExW FindResourceW SizeofResource LoadResource GlobalMemoryStatusEx GetVersionExW IsValidCodePage GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GetCPInfoExW GetDiskFreeSpaceExW CreateFileW DeviceIoControl SetErrorMode GetComputerNameW MulDiv FormatMessageW GetLogicalProcessorInformation GetSystemDirectoryW HeapAlloc CreateEventW SetEvent WaitForSingleObject ReleaseSemaphore EnumSystemLocalesW WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork QueryDepthSList TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace TzSpecificLocalTimeToSystemTime QueryUnbiasedInterruptTime OpenEventW ReleaseMutex CreateMutexExW OpenMutexW GetTempPathW GetLongPathNameW GetFinalPathNameByHandleW TlsAlloc TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue ResetEvent IsDebuggerPresent GetFileAttributesExW FindFirstFileExW MoveFileExW FindNextFileW CreateDirectoryW SetFileAttributesW ReadFile SetFilePointerEx SetEndOfFile GetFileSizeEx FlushFileBuffers LockFileEx UnlockFileEx GetFileInformationByHandleEx GetCurrentDirectoryW GetTempFileNameW CopyFileExW GetVolumePathNamesForVolumeNameW SetFileInformationByHandle WaitForMultipleObjects K32EnumProcessModulesEx OpenThread GetFileType SetFilePointer GetOverlappedResult GetFileAttributesW GetFileTime CopyFileW QueryPerformanceCounter QueryPerformanceFrequency GlobalAlloc LockResource LCIDToLocaleName SetFileTime CancelIoEx GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer GetTickCount InitOnceExecuteOnce WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus GetStartupInfoW CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic OutputDebugStringW OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocalAlloc GetLocaleInfoEx LCMapStringEx IsValidLocale GetSystemDefaultLCID ResolveLocaleName EnumSystemLocalesEx GetSystemDefaultLocaleName GetFileAttributesA LoadLibraryExA GetUserGeoID GetLocaleInfoW GetUserPreferredUILanguages GetACP GetTimeZoneInformation AreFileApisANSI HeapCreate GetFullPathNameW GetDiskFreeSpaceW LockFile InitializeCriticalSection GetFullPathNameA HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA FlushViewOfFile DeleteFileA HeapReAlloc GetSystemInfo HeapCompact HeapDestroy UnlockFile K32GetProcessMemoryInfo GetPhysicallyInstalledSystemMemory GetProductInfo SwitchToThread InitializeCriticalSectionAndSpinCount FindFirstFileW GetThreadLocale lstrcmpW ProcessIdToSessionId GetCommandLineW SetEnvironmentVariableW GetPriorityClass K32EnumProcesses IsProcessorFeaturePresent InitOnceComplete InitOnceBeginInitialize CreateSymbolicLinkW DeleteTimerQueueTimer GetThreadTimes FreeLibraryAndExitThread ExitThread GetConsoleMode ReadConsoleW GetConsoleOutputCP RemoveDirectoryW GetFileInformationByHandle GetStringTypeW TryAcquireSRWLockExclusive CompareStringW SetStdHandle GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW VirtualProtect VirtualQuery GetLocalTime WaitForSingleObjectEx GetSystemPreferredUILanguages K32GetProcessImageFileNameW GetDateFormatW GetTimeFormatW GetDriveTypeW

setupapi

SetupIterateCabinetW

gdiplus

GdipDeleteGraphics GdiplusStartup GdipCreateFromHDC GdipDrawImageRectI GdipLoadImageFromStream GdipFree GdipFillRectangleI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromScan0 GdipDisposeImage GdipCloneImage GdipAlloc