c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767

Sharing

Copy URL Twitter E-mail

General

Target
c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767
Size 4.6MB
Sample260702-lkvvhsft9y
SHA256 c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767
MD5 f965033e536c8d385ad4cf45885d1d39
SHA1 925954ad23cdc5b1d2a34a3fe6f791840131b274
SHA512 4acfea38927996a5aa1718e47e068067c9e076f0ba747ea64955093bba9d93e97e61ddd6f1af754e96bb7d4f85a9d7b4b9ad8c61edc6b22f3eba2eea0f39ea92
SSDEEP 49152:2tySTm9OB6V3hezMTrZ+M05VOx4x8EVep:2tyHv3heEix8EVy
TLSH
T161268C31FA83A02FDA92207895658265496B7F259733C4DFBEAC761CC4337C05978F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767

File Explorer

c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767

.exe 4.6MB

c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767

IMPHASH d28043dcf463a695d0b80045dce8920d
SHA256 c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767
MD5 f965033e536c8d385ad4cf45885d1d39
SHA1 925954ad23cdc5b1d2a34a3fe6f791840131b274
SHA512 4acfea38927996a5aa1718e47e068067c9e076f0ba747ea64955093bba9d93e97e61ddd6f1af754e96bb7d4f85a9d7b4b9ad8c61edc6b22f3eba2eea0f39ea92
SSDEEP 49152:2tySTm9OB6V3hezMTrZ+M05VOx4x8EVep:2tyHv3heEix8EVy
TLSH
T161268C31FA83A02FDA92207895658265496B7F259733C4DFBEAC761CC4337C05978F2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

478104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\4010328\Documents\soft\src\UrNotice\src\Release\UrNotice.pdb

kernel32

CreateProcessW CompareStringW GetUserDefaultUILanguage FindFirstFileW FindClose GetTempPathW GetTempFileNameW ReleaseMutex SetProcessShutdownParameters MoveFileW QueryPerformanceCounter LoadLibraryExW FindResourceW LoadResource SizeofResource WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW SystemTimeToTzSpecificLocalTime GetDriveTypeW GetACP FreeLibraryAndExitThread ExpandEnvironmentStringsW CreateThread GetModuleHandleExW ExitProcess RtlUnwind AreFileApisANSI MultiByteToWideChar SetFilePointerEx SetEndOfFile RemoveDirectoryW GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW CreateDirectoryW GetCurrentDirectoryW GetFileSizeEx WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle ExpandEnvironmentStringsA VerifyVersionInfoA LoadLibraryA GetModuleHandleA GetSystemDirectoryA VerSetConditionMask QueryPerformanceFrequency SleepEx GetStartupInfoW WaitForSingleObjectEx ResetEvent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW LCMapStringW GetTickCount GetSystemTimeAsFileTime GetTimeZoneInformation MulDiv GlobalAlloc GlobalLock GlobalUnlock GetTickCount64 lstrcmpW LoadLibraryW GetCurrentThreadId lstrlenW LockResource FreeResource ExitThread lstrcmpiW FreeLibrary GetFileTime DosDateTimeToFileTime LocalFileTimeToFileTime CreateFileA SetFilePointer ReadFile GetModuleHandleW GetProcAddress GetVersionExW FlushFileBuffers FormatMessageA GetCurrentProcessId GetLocalTime OutputDebugStringW OutputDebugStringA GetSystemTime DecodePointer RaiseException HeapReAlloc HeapSize LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetEvent TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread CreateEventW InitializeCriticalSectionAndSpinCount GetCPInfo GetStringTypeW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent Sleep InitializeCriticalSectionEx DeviceIoControl SetLastError OpenMutexW WaitForSingleObject CreateMutexW FileTimeToLocalFileTime SetCurrentDirectoryA GetCurrentDirectoryA WriteFile DeleteFileW CloseHandle SetFileTime SystemTimeToFileTime CreateFileW GlobalFree WideCharToMultiByte CopyFileW GetProcessHeap GetModuleFileNameW LocalFree HeapAlloc FileTimeToSystemTime GetLastError lstrcmpA LocalAlloc HeapFree GetCurrentProcess IsWow64Process

user32

DrawTextW LoadBitmapW EnableWindow SetDlgItemTextW MessageBeep SetTimer KillTimer OpenInputDesktop CloseDesktop GetWindowRect MoveWindow ScreenToClient EnumWindows SendMessageW GetMessageW IsDialogMessageW TranslateMessage DispatchMessageW IsWindow GetClassInfoExW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW ShowWindow GetKeyState ChangeWindowMessageFilterEx SetForegroundWindow MessageBoxIndirectW SetCursor IsWindowVisible DestroyWindow CreateDialogParamW BeginPaint EndPaint UnregisterDeviceNotification DefWindowProcW LoadStringW SetWindowTextW GetDlgItem SetFocus PostMessageW GetWindowTextW GetClassNameW SystemParametersInfoW SetWindowPos GetClientRect SetWindowLongW GetWindowLongW DestroyAcceleratorTable GetDesktopWindow ReleaseDC GetDC UnregisterClassW InvalidateRect GetUserObjectInformationW CharNextW MessageBoxW UpdateWindow GetSystemMetrics ExitWindowsEx CallWindowProcW InvalidateRgn FillRect ReleaseCapture SetCapture GetParent ClientToScreen CreateAcceleratorTableW RedrawWindow GetSysColor GetWindow GetFocus IsChild GetWindowTextLengthW RegisterWindowMessageW PostQuitMessage

gdi32

SetBkMode SetTextColor Rectangle LineTo MoveToEx CreatePen CreateFontW CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject BitBlt DeleteDC GetStockObject GetObjectW GetDeviceCaps

advapi32

CryptGenRandom AdjustTokenPrivileges OpenSCManagerW OpenServiceW CryptDestroyKey CryptImportKey CryptEncrypt QueryServiceStatus CryptAcquireContextA ControlService CloseServiceHandle CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegQueryValueExW RegCloseKey RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegQueryInfoKeyW RegEnumKeyExW OpenProcessToken LookupPrivilegeValueW

shell32

SHGetFolderPathA ord165 ShellExecuteW

ole32

CoTaskMemRealloc CoInitializeEx CoUninitialize OleRun OleInitialize CLSIDFromString CoTaskMemFree CLSIDFromProgID CoTaskMemAlloc CoCreateInstance OleUninitialize StringFromGUID2 OleLockRunning CreateStreamOnHGlobal CoGetClassObject

oleaut32

SafeArrayUnlock SafeArrayGetUBound SafeArrayGetLBound SafeArrayDestroy SafeArrayCopy SafeArrayGetVartype SysAllocStringByteLen SysStringByteLen DispCallFunc SysAllocStringLen SafeArrayRedim LoadRegTypeLi SysStringLen OleCreateFontIndirect SysAllocString VariantClear VariantInit VarUI4FromStr SysFreeString SafeArrayCreate SafeArrayLock LoadTypeLi

shlwapi

PathFileExistsW PathRemoveFileSpecW PathAppendW PathFindFileNameW PathAppendA PathIsDirectoryW PathAddExtensionW PathFileExistsA

winhttp

WinHttpOpen WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiOpenDevRegKey

wtsapi32

WTSFreeMemory WTSRegisterSessionNotification WTSQuerySessionInformationW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

comctl32

InitCommonControlsEx

wintrust

WinVerifyTrust

crypt32

CertFreeCertificateContext CertVerifyTimeValidity CertOpenSystemStoreW CryptQueryObject CertCloseStore CryptMsgGetParam CertFreeCertificateChain CertFindCertificateInStore CertGetNameStringW CertVerifyCertificateChainPolicy CertGetCertificateContextProperty CertOpenStore CertGetNameStringA CryptBinaryToStringW CryptStringToBinaryW CertEnumCertificatesInStore CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptStringToBinaryA CertGetCertificateChain CertAddCertificateContextToStore CryptDecodeObject CryptMsgClose

ws2_32

freeaddrinfo recvfrom sendto setsockopt send recv WSASetLastError select __WSAFDIsSet getaddrinfo WSAGetLastError WSACleanup WSAStartup ntohs htons getsockopt getsockname bind ntohl htonl socket gethostname ioctlsocket listen accept getpeername connect WSAIoctl closesocket

wldap32

ord30 ord200 ord301 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord217 ord143 ord79

normaliz

IdnToAscii

bcrypt

BCryptGenRandom BCryptExportKey BCryptCloseAlgorithmProvider BCryptDeriveKey BCryptDestroySecret BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSecretAgreement BCryptGenerateSymmetricKey BCryptHashData BCryptFinishHash BCryptGenerateKeyPair BCryptDestroyHash BCryptVerifySignature BCryptDecrypt BCryptFinalizeKeyPair BCryptGetProperty BCryptDestroyKey BCryptEncrypt BCryptSetProperty BCryptCreateHash

generic

count=15, id=259, version=25203,

count=188, id=261, version=25203,

count=22, id=260, version=25203,

count=6, id=261, productName=VS2017 v15.6.0 build 26128, version=26128,

count=6, id=257, version=26213,

count=6, id=260, version=25019,

count=103, id=260, productName=VS2017 v15.9.7 build 27027, version=27027,

count=6, id=199, version=41118,

count=26, id=259, version=26706,

count=1, id=110, productName=VS2005 build 50727, version=50727,

count=3, id=109, productName=VS2005 build 50727, version=50727,

count=35, id=260, version=26706,

count=79, id=261, version=26706,

count=7, id=262, version=25203,

count=33, id=257, version=25203,

count=492, id=1, productName=Unmarked objects,

count=41, id=265, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,