02d89140dca19b892ce6a00736cf60a74ef7347dd8a316bc816ca8ca08f394bc

Sharing

Copy URL Twitter E-mail

General

Target
02d89140dca19b892ce6a00736cf60a74ef7347dd8a316bc816ca8ca08f394bc
Size 3.9MB
Sample260706-e9t6ysdw3l
SHA256 02d89140dca19b892ce6a00736cf60a74ef7347dd8a316bc816ca8ca08f394bc
MD5 19a08eab8f44536afc2f6ba3a17eabe1
SHA1 7af9580d9d73addc0fe317b55f63b9eaf11bbd05
SHA512 490e563257f752eb38087e1ba77e4dee6d4245335afacb89fb004eaabfc7a4e5a393616ac7fff4b71cd1370fe0770d0334aa5e026f024ad6076f880d1d268ad0
SSDEEP 49152:0VxbdzHcJxEDHFBukpLU/VMGtg/awYR4J52guIqkEgcLScQxsQ7zJPlHx6bIQzF7:0v7MsEIYgcLScRGHx6b1z382kNS
TLSH
T1A016AF13EB6400F4C9BBE178C9679613D7B2B45507739BDB0294867A1F63AE52EBE300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02d89140dca19b892ce6a00736cf60a74ef7347dd8a316bc816ca8ca08f394bc

File Explorer

02d89140dca19b892ce6a00736cf60a74ef7347dd8a316bc816ca8ca08f394bc

.exe 3.9MB

02d89140dca19b892ce6a00736cf60a74ef7347dd8a316bc816ca8ca08f394bc

IMPHASH 11794201c242efc2b1be8383b5c66f75
SHA256 02d89140dca19b892ce6a00736cf60a74ef7347dd8a316bc816ca8ca08f394bc
MD5 19a08eab8f44536afc2f6ba3a17eabe1
SHA1 7af9580d9d73addc0fe317b55f63b9eaf11bbd05
SHA512 490e563257f752eb38087e1ba77e4dee6d4245335afacb89fb004eaabfc7a4e5a393616ac7fff4b71cd1370fe0770d0334aa5e026f024ad6076f880d1d268ad0
SSDEEP 49152:0VxbdzHcJxEDHFBukpLU/VMGtg/awYR4J52guIqkEgcLScQxsQ7zJPlHx6bIQzF7:0v7MsEIYgcLScRGHx6b1z382kNS
TLSH
T1A016AF13EB6400F4C9BBE178C9679613D7B2B45507739BDB0294867A1F63AE52EBE300
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2184924

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\data\landun\workspace\CommonComponent\ACE-Guard\1.compile_source\output\x64\Release\SGuardUpdate64.pdb

iphlpapi

GetAdaptersInfo

shlwapi

PathRemoveFileSpecW PathAppendW PathFileExistsW PathFindFileNameA PathFindFileNameW

ws2_32

htonl WSASetLastError select __WSAFDIsSet WSAStartup getaddrinfo WSACleanup send closesocket bind getpeername getsockname getsockopt ntohs setsockopt WSAIoctl socket connect recvfrom recv sendto ioctlsocket freeaddrinfo htons WSAGetLastError accept listen gethostname shutdown gethostbyname getservbyname

wldap32

ord143 ord30 ord200 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord217 ord46 ord211 ord301

crypt32

CertFreeCertificateContext CertCloseStore CertFindCertificateInStore CertOpenStore CertEnumCertificatesInStore CertDuplicateCertificateContext CertGetCertificateContextProperty

kernel32

UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead GetStringTypeW EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetCPInfo CreateThread ExitThread FreeLibraryAndExitThread GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler GetConsoleMode ReadConsoleInputA SetConsoleMode ExitProcess GetACP ReadConsoleW GetConsoleCP GetCurrentThread IsValidLocale GetCurrentDirectoryW SetStdHandle FindFirstFileExW IsValidCodePage CreateFileW GetFileAttributesW AreFileApisANSI CloseHandle RaiseException GetLastError SetLastError HeapAlloc HeapReAlloc HeapFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent ReleaseMutex WaitForSingleObject WaitForSingleObjectEx CreateMutexA CreateMutexW CreateEventW Sleep TerminateProcess GetThreadTimes GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW GetOEMCP CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW LocalAlloc LocalFree CreateFileMappingA GetTimeZoneInformation CompareStringW MultiByteToWideChar WideCharToMultiByte LCMapStringW GetLocaleInfoW GetUserDefaultLCID EnumSystemLocalesW HeapSize SwitchToThread DecodePointer HeapDestroy DeleteCriticalSection GetCurrentProcessId GetProcessHeap GetModuleHandleW CreateDirectoryW FindFirstFileW FindNextFileW FindClose DeleteFileW OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetExitCodeProcess GetCommandLineA GetCommandLineW SetCurrentDirectoryW CopyFileW MoveFileW GetFileSize GetModuleHandleExW ExpandEnvironmentStringsW RemoveDirectoryW OpenEventW GetNativeSystemInfo VerSetConditionMask VerifyVersionInfoW GetFileSizeEx SystemTimeToFileTime GetCurrentProcess GetModuleFileNameA Module32FirstW Module32NextW SetUnhandledExceptionFilter ReadFile WriteFile SetFilePointerEx GetSystemTime TryEnterCriticalSection HeapCreate GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW GetCurrentThreadId HeapValidate GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA DeleteFileA HeapCompact UnlockFile LockFileEx FormatMessageA QueryPerformanceCounter FlushFileBuffers SleepEx GetModuleHandleA GetSystemDirectoryA QueryPerformanceFrequency VerifyVersionInfoA ExpandEnvironmentStringsA WaitForMultipleObjects GetFileType GetStdHandle PeekNamedPipe FlushConsoleInputBuffer GlobalMemoryStatus GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW

user32

GetUserObjectInformationW GetProcessWindowStation MessageBoxA wsprintfW

advapi32

FreeSid DeregisterEventSource RegisterEventSourceA ReportEventA CryptAcquireContextW CryptReleaseContext CryptDestroyKey RegCloseKey RegOpenKeyExW RegQueryValueExW QueryServiceStatusEx OpenServiceW CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW CreateServiceW QueryServiceStatus QueryServiceConfigA OpenSCManagerW CloseServiceHandle GetTokenInformation InitializeSecurityDescriptor OpenProcessToken SetEntriesInAclW AllocateAndInitializeSid SetFileSecurityW SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW QueryServiceConfigW StartServiceW ControlService SetServiceObjectSecurity DeleteService ChangeServiceConfig2W

shell32

ShellExecuteExW

ntdll

RtlUnwindEx RtlPcToFileHeader RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

539KB

Virtual Size

538KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

371KB

Virtual Size

393KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

133KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

692B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.tvm0

Size

604KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

generic

count=13, id=241, version=40116,

count=186, id=243, version=40116,

count=28, id=242, version=40116,

count=2, id=261, version=23013,

count=8, id=199, version=41118,

count=8, id=259, version=24123,

count=120, id=261, version=24123,

count=41, id=260, version=24123,

count=1, id=135, version=30729,

count=620, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=259, productName=VS2015 UPD3 build 24210, version=24210,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=462, id=1, productName=Unmarked objects,

count=1, id=261, version=31332,

count=65, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,