ab3339a2e86c7def9d089e225fd28dfa7b97486f3f7a40f3356201040cbfbefa

Sharing

Copy URL Twitter E-mail

General

Target
ab3339a2e86c7def9d089e225fd28dfa7b97486f3f7a40f3356201040cbfbefa
Size 8.0MB
Sample260706-ehft9ads9k
SHA256 ab3339a2e86c7def9d089e225fd28dfa7b97486f3f7a40f3356201040cbfbefa
MD5 62c30501ac585495eb6f7f16c0a78813
SHA1 a92ee92418569215466e207e9d4a7d77db27d9ff
SHA512 7fffea255dd4a63f5c79caa4b783c64c400ae8211636f8c3c541679c7925b98bd8b727dece96ca9d70a9b8c769ed03cbd445af3263c4598cce405974f66ffea2
SSDEEP 196608:A6hnnmjzvr5Y0kIwg45P/xAgnQmDymwXdLZDnkkT:A6hnmjzvrVw51/6nmMdLBkk
TLSH
T15786BE12F950807CFDA60131616AD7FA08FE5A38872487C7D7D03969A970DE1EA3B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab3339a2e86c7def9d089e225fd28dfa7b97486f3f7a40f3356201040cbfbefa

File Explorer

ab3339a2e86c7def9d089e225fd28dfa7b97486f3f7a40f3356201040cbfbefa

.exe 8.0MB

ab3339a2e86c7def9d089e225fd28dfa7b97486f3f7a40f3356201040cbfbefa

IMPHASH 91a4354ba6d3631eaa7f86a7f6b1851b
SHA256 ab3339a2e86c7def9d089e225fd28dfa7b97486f3f7a40f3356201040cbfbefa
MD5 62c30501ac585495eb6f7f16c0a78813
SHA1 a92ee92418569215466e207e9d4a7d77db27d9ff
SHA512 7fffea255dd4a63f5c79caa4b783c64c400ae8211636f8c3c541679c7925b98bd8b727dece96ca9d70a9b8c769ed03cbd445af3263c4598cce405974f66ffea2
SSDEEP 196608:A6hnnmjzvr5Y0kIwg45P/xAgnQmDymwXdLZDnkkT:A6hnmjzvrVw51/6nmMdLBkk
TLSH
T15786BE12F950807CFDA60131616AD7FA08FE5A38872487C7D7D03969A970DE1EA3B25F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3179562

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\skylar_win_client\27.DataDiscovery\install\Release\install.pdb

crypt32

CertOpenSystemStoreA CertOpenSystemStoreW CertGetCertificateContextProperty CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptQueryObject CertFreeCertificateContext CryptMsgGetParam CertDuplicateCertificateContext CryptDecodeObject

kernel32

GetPrivateProfileStringW CopyFileW GetFileAttributesExW UpdateResourceW EndUpdateResourceW ReadFile SetFilePointer GetExitCodeProcess WritePrivateProfileStringW QueryDosDeviceW GetCurrentProcessId OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDriveStringsW OutputDebugStringW FreeResource GlobalAlloc GlobalUnlock GlobalLock GlobalFree WriteFile FlushFileBuffers GetFileSize CreateDirectoryW SetEndOfFile GetCurrentProcess CreateProcessW MoveFileExW GetPrivateProfileStringA RemoveDirectoryW SetFileAttributesW GetCurrentDirectoryW GetACP ExitProcess GetFileType SetFileTime DuplicateHandle DosDateTimeToFileTime SystemTimeToFileTime GetLocalTime GetStdHandle TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetEnvironmentVariableW InitializeCriticalSection TryEnterCriticalSection GetExitCodeThread CreateSemaphoreA SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA LoadLibraryA FormatMessageA GetSystemTime ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA DeleteFileW QueryPerformanceCounter QueryPerformanceFrequency GetModuleHandleA FormatMessageW MoveFileExA CompareFileTime GetEnvironmentVariableA PeekNamedPipe LoadResource SleepEx WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage CreatePipe SetStdHandle SetEnvironmentVariableW IsValidLocale GetConsoleCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList FreeLibraryAndExitThread GetCurrentThread GetProcessAffinityMask ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetFileSizeEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlCaptureStackBackTrace SetConsoleTextAttribute GetConsoleScreenBufferInfo GetComputerNameA GetWindowsDirectoryA OutputDebugStringA GetTempPathA IsDebuggerPresent GetStringTypeW GetCPInfo SwitchToThread CreateHardLinkW DeviceIoControl SetFilePointerEx GetFullPathNameW GetFileInformationByHandle FindFirstFileExW FindResourceExW CreateFileW GetFileAttributesW GetLongPathNameW BeginUpdateResourceW GetModuleHandleW FindResourceW SizeofResource ReadConsoleW LockResource AreFileApisANSI CloseHandle RaiseException GetLastError SetLastError HeapAlloc HeapReAlloc HeapFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent ReleaseSemaphore ReleaseMutex WaitForSingleObject lstrcmpA DeleteCriticalSection GetProcessHeap HeapSize HeapDestroy GetCommandLineW GetTempPathW VerifyVersionInfoW GetPrivateProfileIntW FindNextFileW FindFirstFileW FindClose VerSetConditionMask EnumSystemLocalesW GetUserDefaultLCID GetLocaleInfoW LCMapStringW WideCharToMultiByte MultiByteToWideChar CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation UnregisterWait RegisterWaitForSingleObject MulDiv SetThreadAffinityMask ConvertThreadToFiber LocalFree LocalAlloc WaitForMultipleObjects LoadLibraryW GetProcAddress GetModuleFileNameW FreeLibrary DeleteTimerQueueTimer CreateTimerQueueTimer VirtualFree VirtualProtect VirtualAlloc GetNativeSystemInfo GetVersionExW GetSystemDirectoryW GetTickCount GetSystemTimeAsFileTime GetThreadTimes GetCurrentThreadId TerminateProcess Sleep CreateEventW CreateEventA CreateMutexW WaitForSingleObjectEx

user32

MoveWindow GetWindowRgn LoadCursorW GetPropW SetPropW EnableWindow ShowWindow GetClassInfoExW wvsprintfW SetCursor OffsetRect IsZoomed SetWindowRgn CharPrevW DrawTextW FillRect RegisterClassExW RegisterClassW CallWindowProcW DefWindowProcW GetWindow GetParent SetWindowLongW PtInRect IsRectEmpty UnionRect IntersectRect MapWindowPoints ScreenToClient GetCursorPos GetWindowRect InvalidateRect GetUpdateRect EndPaint BeginPaint KillTimer GetUserObjectInformationW SetTimer ReleaseCapture SetCapture GetKeyState GetFocus GetActiveWindow SetFocus CharNextW IsIconic IsWindowVisible DestroyWindow GetClientRect GetProcessWindowStation GetGUIThreadInfo GetDC ReleaseDC AdjustWindowRectEx MonitorFromWindow SendMessageW LoadImageW MessageBoxW SetRect CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen GetSysColor SetWindowTextW GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn PostQuitMessage SetWindowPos GetMenu GetMonitorInfoW GetWindowLongW GetMessageW TranslateMessage DispatchMessageW PostMessageW CreateWindowExW IsWindow

gdi32

GdiFlush ExtTextOutW TextOutW MoveToEx SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateSolidBrush CreateRectRgnIndirect CreatePenIndirect CombineRgn GetObjectA CreateRoundRectRgn CreateDIBSection PtInRegion CreateRectRgn SetWindowOrgEx GetObjectW GetTextMetricsW SelectObject SaveDC RestoreDC Rectangle GetStockObject DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt GetDeviceCaps CreatePatternBrush

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegEnumKeyExW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW BuildExplicitAccessWithNameW CryptHashData CryptGetHashParam CryptAcquireContextA CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource GetUserNameA GetTokenInformation CreateProcessAsUserW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

shell32

ord165 CommandLineToArgvW SHGetSpecialFolderPathW SHChangeNotify ShellExecuteExW SHBrowseForFolderW SHGetPathFromIDListW SHCreateDirectoryExW

ole32

CoUninitialize CoInitializeEx CoCreateInstance CreateStreamOnHGlobal OleLockRunning CoCreateGuid CLSIDFromString CLSIDFromProgID CoInitialize

oleaut32

VariantInit SysFreeString SysStringLen SysAllocString VariantClear

shlwapi

SHGetValueW PathCombineW PathFileExistsW PathRemoveFileSpecW PathAppendW SHDeleteValueW wnsprintfW PathIsPrefixW PathIsDirectoryW PathFindExtensionW

ws2_32

connect closesocket bind accept WSASetLastError select setsockopt send recv getservbyname getservbyport gethostbyaddr inet_addr htonl gethostbyname ntohs getsockopt getsockname ioctlsocket WSACleanup WSAStartup getaddrinfo socket shutdown getpeername inet_ntoa recvfrom sendto WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSAIoctl freeaddrinfo gethostname listen htons WSAGetLastError __WSAFDIsSet

version

VerQueryValueA VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW GetProcessImageFileNameW

setupapi

SetupIterateCabinetW

gdiplus

GdipAlloc GdipFree GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipGetFamily GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDeleteFontFamily GdipDrawImage GdipGraphicsClear GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipSetCompositingQuality GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipCreateLineBrushI GdipDeleteBrush GdipCloneBrush GdipDrawImageRectI GdipRotateWorldTransform GdipTranslateWorldTransform GdipDeleteGraphics GdipCreateFromHDC GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdiplusShutdown GdiplusStartup GdipSetStringFormatLineAlign

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

imm32

ImmDisableIME ImmReleaseContext ImmSetCompositionFontW ImmSetCompositionWindow ImmGetContext

comctl32

ord17 _TrackMouseEvent

dbghelp

SymFromAddr SymInitialize SymCleanup SymSetOptions UnDecorateSymbolName

wldap32

ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord211 ord46 ord217 ord143 ord301

generic

count=24, id=259, version=26715,

count=223, id=261, version=26715,

count=10, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=264, version=28612,

count=8, id=199, version=41118,

count=19, id=260, version=28427,

count=27, id=259, version=28427,

count=1, id=263, version=26715,

count=8, id=261, productName=VS2019 v16.6.2 build 28806, version=28806,

count=151, id=261, version=28427,

count=36, id=260, version=26715,

count=1, id=262, version=26715,

count=41, id=257, version=26715,

count=666, id=1, productName=Unmarked objects,

count=980, id=260, productName=VS2019 v16.5.5 build 28614, version=28614,

count=23, productName=Unmarked objects (old),

count=1, id=260, productName=VS2019 v16.8.0 build 29333, version=29333,

count=35, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,

count=1, id=261, version=31332,

count=58, id=261, productName=VS2019 v16.5.2 build 28612, version=28612,

count=1, id=256, productName=VS2019 v16.5.2 build 28612, version=28612,

count=1, id=255, productName=VS2019 v16.5.2 build 28612, version=28612,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.5.2 build 28612, version=28612,