32ab09de9d1f6ba5851cf0f10d022b77136c11ee6cb4ee46ab5b1ac5a871ab07

Sharing

Copy URL Twitter E-mail

General

Target
32ab09de9d1f6ba5851cf0f10d022b77136c11ee6cb4ee46ab5b1ac5a871ab07
Size 6.9MB
Sample260703-jhttbsds6y
SHA256 32ab09de9d1f6ba5851cf0f10d022b77136c11ee6cb4ee46ab5b1ac5a871ab07
MD5 8391c4a39d50f8452022e428ef7246af
SHA1 1c1c98c626827bded7d7c1cf054c749d021e8b0d
SHA512 5d7aa327d1e32a1177257f0ebaac282ce73b88080524ac757eda7cc7025309f08ab0d3538049174d8edd748ea87232e2c0e8fbf160f3d4a03501a3926c2ed635
SSDEEP 49152:ZbMFIFaS1hN+BkA+gYR9t7qGDPK6BPPrbdXeY/FmgVXjA++Ptnf7FolGZ6TpKApb:6279bNXjA/PtoGrPk0dffM
TLSH
T1A4763A17F77500D1E17BC03D9A93962BFDB17495CBB4A7CB86514B2A4F22BE0AA39700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
32ab09de9d1f6ba5851cf0f10d022b77136c11ee6cb4ee46ab5b1ac5a871ab07

File Explorer

32ab09de9d1f6ba5851cf0f10d022b77136c11ee6cb4ee46ab5b1ac5a871ab07

.dll 6.9MB

32ab09de9d1f6ba5851cf0f10d022b77136c11ee6cb4ee46ab5b1ac5a871ab07

IMPHASH 951be07ce51bccbb3acc33e169ac2af4
SHA256 32ab09de9d1f6ba5851cf0f10d022b77136c11ee6cb4ee46ab5b1ac5a871ab07
MD5 8391c4a39d50f8452022e428ef7246af
SHA1 1c1c98c626827bded7d7c1cf054c749d021e8b0d
SHA512 5d7aa327d1e32a1177257f0ebaac282ce73b88080524ac757eda7cc7025309f08ab0d3538049174d8edd748ea87232e2c0e8fbf160f3d4a03501a3926c2ed635
SSDEEP 49152:ZbMFIFaS1hN+BkA+gYR9t7qGDPK6BPPrbdXeY/FmgVXjA++Ptnf7FolGZ6TpKApb:6279bNXjA/PtoGrPk0dffM
TLSH
T1A4763A17F77500D1E17BC03D9A93962BFDB17495CBB4A7CB86514B2A4F22BE0AA39700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3436944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\MyWork\Linux\MyWork\HP-Socket\Windows\Bin\HPSocket\x64\HPSocket_UD.pdb

kernel32

CreateEventW CreateTimerQueue DeleteTimerQueueEx CreateWaitableTimerW InitializeConditionVariable GetSystemInfo TerminateThread GetExitCodeThread PostQueuedCompletionStatus ResetEvent RaiseException FindResourceW SizeofResource LockResource LoadResource GetQueuedCompletionStatus SetEvent FindResourceExW WideCharToMultiByte CreateIoCompletionPort WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS UnmapViewOfFile MultiByteToWideChar lstrlenA ResumeThread SetThreadPriority lstrlenW CreateFileW GetFileSize MapViewOfFileEx CreateFileMappingW GetProcAddress GetModuleHandleW WaitForMultipleObjects SetWaitableTimer CancelWaitableTimer TryEnterCriticalSection CreateTimerQueueTimer DeleteTimerQueueTimer SystemTimeToFileTime GetSystemTime TlsAlloc TlsGetValue TlsSetValue TlsFree DeleteFiber SwitchToFiber CreateFiber FindNextFileW FindFirstFileW FindClose GetVersion WriteFile GetFileType GetStdHandle FormatMessageW ConvertFiberToThread ConvertThreadToFiber GetSystemTimeAsFileTime QueryPerformanceCounter GetConsoleMode SetConsoleMode Sleep ReadConsoleW GetEnvironmentVariableW GetTickCount64 GetNativeSystemInfo SetEnvironmentVariableA CompareStringW GetDriveTypeW SetEndOfFile GetUserDefaultLCID EnumSystemLocalesA SwitchToThread ReleaseSemaphore WaitForSingleObject CloseHandle CreateSemaphoreW TryAcquireSRWLockExclusive TryAcquireSRWLockShared InitializeSRWLock SetLastError GetLastError GetCurrentThreadId GetCurrentProcessId HeapDestroy HeapCreate HeapFree HeapAlloc IsValidLocale GetLocaleInfoA VirtualQuery SetFilePointer SetStdHandle FlushFileBuffers GetConsoleCP ReadFile GetFullPathNameA SetCurrentDirectoryW GetCurrentDirectoryW CreateFileA PeekNamedPipe GetFileInformationByHandle AcquireSRWLockShared GetTickCount GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation GetStringTypeW LCMapStringW GetLocaleInfoW FreeLibrary GetStartupInfoW SetHandleCount IsValidCodePage GetCPInfo GetOEMCP GetACP HeapQueryInformation HeapSetInformation FlsFree FlsAlloc FlsGetValue LoadLibraryW FatalAppExitA GetModuleFileNameA SetConsoleCtrlHandler FindFirstFileExA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime GetCommandLineA FlsSetValue ExitThread CreateThread WriteConsoleW ExitProcess RtlPcToFileHeader EncodePointer RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockShared ReadConsoleA OpenEventA OutputDebugStringA OutputDebugStringW GetProcessHeap HeapReAlloc HeapSize VirtualAlloc MapViewOfFile CreateFileMappingA GetCurrentThread OpenFileMappingA GetModuleFileNameW InitializeCriticalSection RtlLookupFunctionEntry RtlUnwindEx HeapValidate IsBadReadPtr DecodePointer TerminateProcess

user32

GetProcessWindowStation GetUserObjectInformationW MsgWaitForMultipleObjects DispatchMessageW MessageBoxW TranslateMessage PeekMessageW

advapi32

OpenThreadToken SetThreadToken DeregisterEventSource ReportEventW RegisterEventSourceW CryptEnumProvidersW CryptReleaseContext CryptDestroyKey CryptDecrypt CryptCreateHash CryptSetHashParam CryptSignHashW CryptDestroyHash CryptExportKey CryptGetUserKey CryptAcquireContextW CryptGetProvParam RevertToSelf

oleaut32

SysFreeString

shlwapi

StrChrW PathFileExistsW PathIsDirectoryW

winmm

timeGetTime timeGetDevCaps timeEndPeriod timeBeginPeriod

ws2_32

bind WSARecvFrom WSASendTo WSARecv WSASend shutdown closesocket sendto send ioctlsocket getsockopt WSACreateEvent socket InetPtonW ntohl getsockname getpeername InetNtopW getaddrinfo freeaddrinfo WSASetLastError WSAStringToAddressW htons ntohs WSAGetLastError WSAGetOverlappedResult connect WSAStartup WSAIoctl WSACleanup WSAEventSelect WSAWaitForMultipleEvents WSAEnumNetworkEvents WSAResetEvent recv WSACloseEvent listen recvfrom getnameinfo accept setsockopt htonl

bcrypt

BCryptGenRandom

crypt32

CertOpenStore CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertDuplicateCertificateContext CertGetCertificateContextProperty CertFreeCertificateContext

HP_Create_HttpAgent HP_Create_HttpClient HP_Create_HttpServer HP_Create_HttpSyncClient HP_Create_HttpsAgent HP_Create_HttpsClient HP_Create_HttpsServer HP_Create_HttpsSyncClient HP_Create_SSLAgent HP_Create_SSLClient HP_Create_SSLPackAgent HP_Create_SSLPackClient HP_Create_SSLPackServer HP_Create_SSLPullAgent HP_Create_SSLPullClient HP_Create_SSLPullServer HP_Create_SSLServer HP_Create_SocketTaskObj HP_Create_TcpAgent HP_Create_TcpClient HP_Create_TcpPackAgent HP_Create_TcpPackClient HP_Create_TcpPackServer HP_Create_TcpPullAgent HP_Create_TcpPullClient HP_Create_TcpPullServer HP_Create_TcpServer HP_Create_ThreadPool HP_Create_UdpArqClient HP_Create_UdpArqServer HP_Create_UdpCast HP_Create_UdpClient HP_Create_UdpNode HP_Create_UdpServer HP_Destroy_HttpAgent HP_Destroy_HttpClient HP_Destroy_HttpServer HP_Destroy_HttpSyncClient HP_Destroy_HttpsAgent HP_Destroy_HttpsClient HP_Destroy_HttpsServer HP_Destroy_HttpsSyncClient HP_Destroy_SSLAgent HP_Destroy_SSLClient HP_Destroy_SSLPackAgent HP_Destroy_SSLPackClient HP_Destroy_SSLPackServer HP_Destroy_SSLPullAgent HP_Destroy_SSLPullClient HP_Destroy_SSLPullServer HP_Destroy_SSLServer HP_Destroy_SocketTaskObj HP_Destroy_TcpAgent HP_Destroy_TcpClient HP_Destroy_TcpPackAgent HP_Destroy_TcpPackClient HP_Destroy_TcpPackServer HP_Destroy_TcpPullAgent HP_Destroy_TcpPullClient HP_Destroy_TcpPullServer HP_Destroy_TcpServer HP_Destroy_ThreadPool HP_Destroy_UdpArqClient HP_Destroy_UdpArqServer HP_Destroy_UdpCast HP_Destroy_UdpClient HP_Destroy_UdpNode HP_Destroy_UdpServer HP_GetHPSocketVersion HP_GetSocketErrorDesc HP_HttpCookie_HLP_CurrentUTCTime HP_HttpCookie_HLP_ExpiresToMaxAge HP_HttpCookie_HLP_MakeExpiresStr HP_HttpCookie_HLP_MaxAgeToExpires HP_HttpCookie_HLP_ParseExpires HP_HttpCookie_HLP_ToString HP_HttpCookie_MGR_ClearCookies HP_HttpCookie_MGR_DeleteCookie HP_HttpCookie_MGR_IsEnableThirdPartyCookie HP_HttpCookie_MGR_LoadFromFile HP_HttpCookie_MGR_RemoveExpiredCookies HP_HttpCookie_MGR_SaveToFile HP_HttpCookie_MGR_SetCookie HP_HttpCookie_MGR_SetEnableThirdPartyCookie HP_SSL_DefaultServerNameCallback HP_SSL_RemoveThreadLocalState SYS_Base64Decode SYS_Base64Encode SYS_BrotliCompress SYS_BrotliCompressEx SYS_BrotliGuessCompressBound SYS_BrotliUncompress SYS_CodePageToUnicode SYS_Compress SYS_CompressEx SYS_EnumHostIPAddresses SYS_Free SYS_FreeHostIPAddresses SYS_GZipCompress SYS_GZipGuessUncompressBound SYS_GZipUncompress SYS_GbkToUnicode SYS_GbkToUtf8 SYS_GetIPAddress SYS_GetLastError SYS_GetSocketLocalAddress SYS_GetSocketOption SYS_GetSocketRemoteAddress SYS_GuessBase64DecodeBound SYS_GuessBase64EncodeBound SYS_GuessCompressBound SYS_GuessUrlDecodeBound SYS_GuessUrlEncodeBound SYS_HToN64 SYS_IoctlSocket SYS_IsIPAddress SYS_IsLittleEndian SYS_Malloc SYS_NToH64 SYS_Realloc SYS_SSO_DontLinger SYS_SSO_ExclusiveAddressUse SYS_SSO_Linger SYS_SSO_NoDelay SYS_SSO_RecvBuffSize SYS_SSO_RecvTimeOut SYS_SSO_ReuseAddress SYS_SSO_SendBuffSize SYS_SSO_SendTimeOut SYS_SetSocketOption SYS_SwapEndian16 SYS_SwapEndian32 SYS_Uncompress SYS_UncompressEx SYS_UnicodeToCodePage SYS_UnicodeToGbk SYS_UnicodeToUtf8 SYS_UrlDecode SYS_UrlEncode SYS_Utf8ToGbk SYS_Utf8ToUnicode SYS_WSAGetLastError SYS_WSAIoctl

Name

.text

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

274KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

text

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

32ab09de9d1f6ba5851cf0f10d022b77136c11ee6cb4ee46ab5b1ac5a871ab07

kernel32

user32

advapi32

oleaut32

shlwapi

winmm

ws2_32

bcrypt

crypt32

generic