d79e9198c51c13de19e2bf6eb4f480fe998afc5e352a59d387b1e9d4d5db233a

Sharing

Copy URL Twitter E-mail

General

Target
d79e9198c51c13de19e2bf6eb4f480fe998afc5e352a59d387b1e9d4d5db233a
Size 869KB
Sample260709-jakwfsey8z
SHA256 d79e9198c51c13de19e2bf6eb4f480fe998afc5e352a59d387b1e9d4d5db233a
MD5 846dd6a6891e26bd5804d14d8b4ed0e1
SHA1 948a335d4353f113f7891a3b4178b7903409fedb
SHA512 e8cd9a26e42ebee3cc95927b8ad7ded9f8c6e96592cd995cef06303ce416e79447f65afd1cf6705f4fbc16f0cb51bb8e6ccc23adc450ec72bce5f11e8dbd9df6
SSDEEP 24576:AzG2YTcbmoMceJ4VKOW0jxuBIRIMKsLPPn:kG2YTm5MHJLh0jpIMlXn
TLSH
T1B71501317BC58836E2730131A8F9A3749965BC718E21854FB3D4BB1D2C75A92ED24FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d79e9198c51c13de19e2bf6eb4f480fe998afc5e352a59d387b1e9d4d5db233a

File Explorer

d79e9198c51c13de19e2bf6eb4f480fe998afc5e352a59d387b1e9d4d5db233a

.exe 869KB

d79e9198c51c13de19e2bf6eb4f480fe998afc5e352a59d387b1e9d4d5db233a

IMPHASH b613936fb14f959dfc8cf6d22330ff0f
SHA256 d79e9198c51c13de19e2bf6eb4f480fe998afc5e352a59d387b1e9d4d5db233a
MD5 846dd6a6891e26bd5804d14d8b4ed0e1
SHA1 948a335d4353f113f7891a3b4178b7903409fedb
SHA512 e8cd9a26e42ebee3cc95927b8ad7ded9f8c6e96592cd995cef06303ce416e79447f65afd1cf6705f4fbc16f0cb51bb8e6ccc23adc450ec72bce5f11e8dbd9df6
SSDEEP 24576:AzG2YTcbmoMceJ4VKOW0jxuBIRIMKsLPPn:kG2YTm5MHJLh0jpIMlXn
TLSH
T1B71501317BC58836E2730131A8F9A3749965BC718E21854FB3D4BB1D2C75A92ED24FA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

135971

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Code\WXWork\win\bugreport\Output\PdbFinal\bugreport.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

dbghelp

SymLoadModule SymInitialize SymSetOptions SymCleanup SymGetModuleInfoW

wininet

InternetCloseHandle InternetConnectA HttpOpenRequestA HttpSendRequestA InternetReadFile InternetOpenUrlA InternetOpenA

psapi

GetModuleFileNameExW GetModuleFileNameExA

comctl32

ImageList_Create ImageList_ReplaceIcon InitCommonControlsEx

tinyxml

?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ ?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ ?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ ?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ ?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ ?Print@TiXmlDocument@@UBEXPAU_iobuf@@H@Z ?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ ?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ ?Clone@TiXmlDocument@@MBEPAVTiXmlNode@@XZ ?Accept@TiXmlDocument@@UBE_NPAVTiXmlVisitor@@@Z ?GetText@TiXmlElement@@QBEPBDXZ ?ToElement@TiXmlNode@@UBEPBVTiXmlElement@@XZ ?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ ?ToElement@TiXmlNode@@UAEPAVTiXmlElement@@XZ ?Value@TiXmlNode@@QBEPBDXZ ?ToDocument@TiXmlDocument@@UBEPBV1@XZ ??1TiXmlDocument@@UAE@XZ ?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ ?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ ?ToDocument@TiXmlDocument@@UAEPAV1@XZ ?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z ?Attribute@TiXmlElement@@QBEPBDPBD@Z ?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ ?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ??0TiXmlDocument@@QAE@XZ

kernel32

GetProcessTimes IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcess DeviceIoControl OutputDebugStringW QueryPerformanceCounter LeaveCriticalSection GetSystemTimeAsFileTime GetStartupInfoW SetFileAttributesW InitializeSListHead GetProcAddress EnterCriticalSection InitializeCriticalSection MoveFileW GetCurrentThreadId GetCurrentProcessId VirtualFree VirtualAlloc GetThreadSelectorEntry WritePrivateProfileStringW GetPrivateProfileIntW GetFileSize GetVersionExW HeapAlloc GetProcessHeap VirtualProtect HeapFree GetModuleHandleW HeapDestroy HeapSize HeapReAlloc SetErrorMode MultiByteToWideChar GetCommandLineW GetTickCount SetCurrentDirectoryW ReadProcessMemory WriteProcessMemory CloseHandle OpenProcess GetLastError VirtualQueryEx CreateFileA GetWindowsDirectoryW GetModuleFileNameW OpenThread CreateThread GetLocalTime TerminateProcess SetEvent CreateProcessW FreeLibrary WaitForSingleObject lstrlenW lstrcatW DeleteFileW CopyFileW LoadLibraryW FindFirstFileW FindNextFileW FindClose lstrcpyW WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceW FindResourceExW InterlockedIncrement InterlockedDecrement GlobalAlloc GlobalLock GlobalUnlock GlobalFree Sleep IsDBCSLeadByte FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime ResumeThread FreeResource CreateEventW GetFileAttributesW CreateFileW CreateDirectoryW CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteFile InitializeCriticalSectionAndSpinCount RaiseException DeleteCriticalSection GetPrivateProfileSectionW GetSystemDefaultLCID ReadFile SetFilePointer GetTempPathW

user32

DestroyWindow CreateWindowExW GetDlgItem EndDialog LoadIconW SendMessageW SetWindowTextW SetWindowPos LoadImageW ShowWindow GetClientRect DrawIconEx GetWindowThreadProcessId GetWindowTextW GetClassNameW EnumWindows GetWindowLongW EnumChildWindows PostMessageW GetDesktopWindow GetWindowTextLengthW GetKeyState CallWindowProcW SetTimer SendDlgItemMessageW EnableWindow GetSystemMenu GetMenuItemCount GetMenuItemID EnableMenuItem SetDlgItemTextW GetSysColorBrush KillTimer ClientToScreen SetWindowLongW MapWindowPoints GetWindowRect MapDialogRect InvalidateRect RegisterClipboardFormatW OpenClipboard EmptyClipboard SetClipboardData CloseClipboard DialogBoxParamW BeginPaint EndPaint GetDC DrawTextW ReleaseDC GetGuiResources IsWindow CreatePopupMenu TrackPopupMenu DestroyMenu DefWindowProcW RegisterClassExW GetClassInfoExW

gdi32

SetBkMode DeleteObject CreateFontW SelectObject GetStockObject SetTextColor

advapi32

RegOpenKeyExW RegCreateKeyExW RegQueryValueExW RegSetValueExW RegDeleteValueW RegCloseKey

shell32

SHGetDesktopFolder SHGetFileInfoW SHBindToParent ord155 ShellExecuteExW SHGetSpecialFolderPathW ShellExecuteW

ole32

OleInitialize DoDragDrop CreateStreamOnHGlobal OleUninitialize

oleaut32

SysStringLen SysAllocString SysFreeString SysAllocStringByteLen SysStringByteLen

gdiplus

GdipFree GdipAlloc GdiplusStartup GdiplusShutdown GdipImageSelectActiveFrame GdipCreateFromHDC GdipDeleteGraphics GdipGetPropertyItem GdipGetPropertyItemSize GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipLoadImageFromStreamICM GdipGetImageWidth GdipGetImageHeight GdipDrawImageRectI GdipDisposeImage GdipCloneImage

shlwapi

PathFileExistsW

msvcp140

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain

iphlpapi

GetAdaptersInfo GetAdaptersAddresses

netapi32

Netbios

vcruntime140

memset memcpy __std_terminate memmove _purecall wcsrchr wcschr wcsstr memcmp strchr strrchr memchr _except_handler4_common __std_exception_copy __std_exception_destroy _CxxThrowException __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

wcscmp _wcslwr_s wcsncpy strnlen wcsnlen tolower wmemcpy_s wcsncmp _wcsicmp iswspace strcmp strncpy_s strlen wcscpy wcscat iswalnum wcscpy_s wcslen iswdigit wcscat_s towlower strncmp isalnum isspace iswalpha

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _beginthreadex _configure_wide_argv __p___wargv __p___argc _initialize_wide_environment _invalid_parameter_noinfo_noreturn _get_wide_winmain_command_line _controlfp_s _initterm _initterm_e exit _exit _c_exit _register_thread_local_exe_atexit_callback _errno _invalid_parameter_noinfo

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode fwrite fread ftell fseek _wfopen __stdio_common_vfprintf __stdio_common_vsprintf_s __stdio_common_vswprintf_s __stdio_common_vswprintf __stdio_common_vswscanf _set_fmode __stdio_common_vsprintf fclose

api-ms-win-crt-time-l1-1-0

_time64 _gmtime32 _time32

api-ms-win-crt-multibyte-l1-1-0

_mbschr _mbslwr_s _mbscmp _mbsstr _mbsicmp _mbsrchr

api-ms-win-crt-convert-l1-1-0

strtoul _wtoi atoi

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

d79e9198c51c13de19e2bf6eb4f480fe998afc5e352a59d387b1e9d4d5db233a

version

dbghelp

wininet

psapi

comctl32

tinyxml

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

shlwapi

msvcp140

wtsapi32

crypt32

wintrust

iphlpapi

netapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic