558012b64d57e270e1d14ea7583ff2a7317947ad51c84f97908683fd6458a9d7

Sharing

Copy URL Twitter E-mail

General

Target
558012b64d57e270e1d14ea7583ff2a7317947ad51c84f97908683fd6458a9d7
Size 681KB
Sample260709-g3682set6z
SHA256 558012b64d57e270e1d14ea7583ff2a7317947ad51c84f97908683fd6458a9d7
MD5 144889fb4bda04f0a91dd3c8c7bb4fc8
SHA1 c29031ed4ec79289a98f3e9856931a5378fcbe64
SHA512 8548385567d044bfe1a529798c35b995e42c56318f9d8e3a1cc02d5c7a2be877aefaa6ef470d3a839df8a3f7413a0b8613bcc111dc978db51e2f5d237f839100
SSDEEP 12288:1zG7FsZ3uUyMhZpRDZEJUDfAVgGjTgrJ7X4f4RGv0Xx+ZENucupH:1S7iZ3uUJZpR1EJUDFGjs174+x+ChuF
TLSH
T1CBE49D223A41C13AD9B212B14D2CDFAE516EFD710B6219D7A38C0B755E644E27F3263B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
558012b64d57e270e1d14ea7583ff2a7317947ad51c84f97908683fd6458a9d7

File Explorer

558012b64d57e270e1d14ea7583ff2a7317947ad51c84f97908683fd6458a9d7

.exe 681KB

558012b64d57e270e1d14ea7583ff2a7317947ad51c84f97908683fd6458a9d7

IMPHASH 450c8c34201242ddd5ff06bafd23e546
SHA256 558012b64d57e270e1d14ea7583ff2a7317947ad51c84f97908683fd6458a9d7
MD5 144889fb4bda04f0a91dd3c8c7bb4fc8
SHA1 c29031ed4ec79289a98f3e9856931a5378fcbe64
SHA512 8548385567d044bfe1a529798c35b995e42c56318f9d8e3a1cc02d5c7a2be877aefaa6ef470d3a839df8a3f7413a0b8613bcc111dc978db51e2f5d237f839100
SSDEEP 12288:1zG7FsZ3uUyMhZpRDZEJUDfAVgGjTgrJ7X4f4RGv0Xx+ZENucupH:1S7iZ3uUJZpR1EJUDFGjs174+x+ChuF
TLSH
T1CBE49D223A41C13AD9B212B14D2CDFAE516EFD710B6219D7A38C0B755E644E27F3263B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

147773

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ProgramData\Jenkins\.jenkins\workspace\MGame\BzySearch\SearchUpdate\Release\update.pdb

kernel32

EnterCriticalSection LeaveCriticalSection CreateMutexW Sleep FindResourceExW GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar DeleteFileW GetLongPathNameW WaitForSingleObject GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess OpenProcess FreeLibrary GetProcAddress LoadLibraryW WideCharToMultiByte GetFileAttributesW InitializeCriticalSection SetFileAttributesW GetTempPathW GetWindowsDirectoryW WritePrivateProfileStringW CopyFileW MoveFileW MoveFileExW CloseHandle DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException LocalFree WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetEndOfFile SetStdHandle ReadConsoleW ReadFile RemoveDirectoryW DecodePointer FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsDebuggerPresent OutputDebugStringW EncodePointer GetStringTypeW FormatMessageW TryEnterCriticalSection GetCurrentThreadId SetLastError CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW QueryPerformanceCounter CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo lstrcpynW lstrcpyW lstrlenW InitializeCriticalSectionEx ReleaseMutex SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead CreateFileW GetFileSizeEx SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue GetSystemWindowsDirectoryW FreeResource DeviceIoControl lstrcmpA RtlUnwind ExitThread GetModuleHandleExW GetFileType SetFilePointerEx WriteFile GetConsoleOutputCP GetConsoleMode GetTimeZoneInformation ExitProcess GetStdHandle IsValidLocale

user32

wsprintfW

advapi32

LookupPrivilegeValueW RegCloseKey RegOpenKeyExW RegQueryValueExW GetTokenInformation RegSetValueExW RegEnumKeyExW AdjustTokenPrivileges OpenProcessToken RegCreateKeyExW

shell32

ord165 SHFileOperationW ShellExecuteExW

ole32

CoInitialize CoUninitialize CoInitializeEx CoSetProxyBlanket CoCreateGuid CoInitializeSecurity CoCreateInstance

oleaut32

SysAllocStringLen SysStringLen VariantClear VariantInit SysAllocString SysFreeString

shlwapi

StrCmpIW StrStrIA StrTrimA PathAppendW PathRemoveFileSpecW PathFileExistsW StrCmpNIW StrStrIW PathCombineW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

psapi

GetModuleFileNameExW EnumProcesses

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

Sharing

General

Malware Config

Signatures

File Explorer

558012b64d57e270e1d14ea7583ff2a7317947ad51c84f97908683fd6458a9d7

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

psapi

wininet

iphlpapi

urlmon

generic