fdab881740e6c6b3fe5288cf8d3a5056f7e0fb405a1fada3d38e136d1914b14d

Sharing

Copy URL Twitter E-mail

General

Target
fdab881740e6c6b3fe5288cf8d3a5056f7e0fb405a1fada3d38e136d1914b14d
Size 3.9MB
Sample260709-kcxtgae17l
SHA256 fdab881740e6c6b3fe5288cf8d3a5056f7e0fb405a1fada3d38e136d1914b14d
MD5 6fafbd9bfcdcf26fcf2099204abbb6ae
SHA1 185430c9eaf6bf04967f61b6fb941a0365f099bb
SHA512 acf39c5b1f57077ccedb7c96a965bc03331de1790f09b79eda9ba2182ddee9d76429ef5822c5e7208abf0dfeebd3c1e4e86b5636213a754c056e17a0c415c97e
SSDEEP 98304:xFG0GNHeVwRz8aGnkYc6ynef5zHRG6PgTraRDEvsIZVg:nLSHeVwRz8aGnkYJyeWrMEvlZ6
TLSH
T186168E87A2B801E8D0B7C1B885164913E6B27C6507719BDB02E4E5676F33AF21E3E735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fdab881740e6c6b3fe5288cf8d3a5056f7e0fb405a1fada3d38e136d1914b14d

File Explorer

fdab881740e6c6b3fe5288cf8d3a5056f7e0fb405a1fada3d38e136d1914b14d

.exe 3.9MB

fdab881740e6c6b3fe5288cf8d3a5056f7e0fb405a1fada3d38e136d1914b14d

IMPHASH f178d459f55ef4c2ee17fa31a625c1c1
SHA256 fdab881740e6c6b3fe5288cf8d3a5056f7e0fb405a1fada3d38e136d1914b14d
MD5 6fafbd9bfcdcf26fcf2099204abbb6ae
SHA1 185430c9eaf6bf04967f61b6fb941a0365f099bb
SHA512 acf39c5b1f57077ccedb7c96a965bc03331de1790f09b79eda9ba2182ddee9d76429ef5822c5e7208abf0dfeebd3c1e4e86b5636213a754c056e17a0c415c97e
SSDEEP 98304:xFG0GNHeVwRz8aGnkYc6ynef5zHRG6PgTraRDEvsIZVg:nLSHeVwRz8aGnkYJyeWrMEvlZ6
TLSH
T186168E87A2B801E8D0B7C1B885164913E6B27C6507719BDB02E4E5676F33AF21E3E735
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2096116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Jenkins\jobs\LenovoStore_x64\workspace\bin\x64\SDLRelease\StoreDownloader.pdb

kernel32

InitializeCriticalSectionAndSpinCount FormatMessageW LocalFree SystemTimeToFileTime SetFileTime LocalFileTimeToFileTime ExitProcess lstrlenW lstrcmpW GlobalLock GlobalUnlock GetModuleHandleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread ExitThread SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx RtlPcToFileHeader GetEnvironmentVariableW InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetTickCount RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext TryEnterCriticalSection AreFileApisANSI HeapCreate GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile DeleteFileA HeapCompact UnlockFile LockFileEx CreateFileMappingW MapViewOfFile FlushFileBuffers GetCurrentDirectoryW VerifyVersionInfoW MulDiv LoadLibraryW GetProcAddress VerSetConditionMask GetACP TerminateProcess GetCurrentProcess ReadFile GetFileSize SetConsoleTextAttribute WriteConsoleW WideCharToMultiByte MultiByteToWideChar WTSGetActiveConsoleSessionId MoveFileExW GetPrivateProfileStringW GetPrivateProfileIntW FindResourceW SizeofResource LockResource LoadResource GetModuleFileNameW lstrcpynW FindResourceExW VirtualQuery GetNativeSystemInfo GetLocalTime GetProcessId ProcessIdToSessionId CreateProcessW GetCurrentThreadId GetExitCodeProcess GetCurrentProcessId Sleep CreateMutexW WaitForSingleObject ReleaseMutex DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError CloseHandle DecodePointer OutputDebugStringW GetTempPathW WriteFile SetFilePointer SetFileAttributesW RemoveDirectoryW GetFileSizeEx GetFileAttributesW FindNextFileW FindFirstFileW GetTimeZoneInformation FileTimeToSystemTime GetSystemTime TerminateThread CreateThread GetSystemFirmwareTable GetLocaleInfoW GetProductInfo GetSystemInfo SignalObjectAndWait CreateEventW CreateFileA SleepEx WaitForMultipleObjects PeekNamedPipe GetFileType GetEnvironmentVariableA MoveFileExA LoadLibraryA GetModuleHandleA FreeLibrary GetSystemDirectoryA CreateEventA SetEvent GetSystemTimeAsFileTime GetCPInfo FindClose DeleteFileW CreateFileW CreateDirectoryW CompareStringEx LCMapStringEx EncodePointer WakeAllConditionVariable QueryPerformanceFrequency QueryPerformanceCounter GetStringTypeW SleepConditionVariableSRW RtlUnwind FormatMessageA TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread WaitForSingleObjectEx RaiseException IsDebuggerPresent GlobalAlloc lstrcmpiW FreeResource lstrcpyW ExpandEnvironmentStringsW UnhandledExceptionFilter GetStdHandle

user32

GetForegroundWindow GetWindowLongW SetWindowLongW FindWindowW GetWindowThreadProcessId SetCursor InflateRect IsIconic OffsetRect LoadCursorW GetDC ReleaseDC MonitorFromPoint GetMessageW TranslateMessage ShowWindow UnionRect DispatchMessageW EnumDisplaySettingsW SendMessageW PostMessageW CreateWindowExW DestroyWindow IsZoomed SetForegroundWindow SetFocus GetActiveWindow TrackPopupMenu GetKeyState SetCapture ReleaseCapture SetTimer KillTimer BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect ScreenToClient MapWindowPoints GetSysColor IntersectRect IsRectEmpty PtInRect GetParent GetWindow LoadImageW MonitorFromWindow GetMonitorInfoW wsprintfW DefWindowProcW CallWindowProcW RegisterClassExW AttachThreadInput GetWindowRect MessageBoxW GetCursorPos GetDesktopWindow CharNextW AppendMenuW DestroyMenu CreatePopupMenu GetSystemMetrics IsWindowVisible GetClassInfoExW EnableWindow SetPropW GetPropW GetWindowLongPtrW SetWindowLongPtrW SetWindowRgn UpdateLayeredWindow CharPrevW DrawTextW FillRect SetRect LoadIconW SetWindowPos IsWindow PostQuitMessage GetFocus RegisterClassW DestroyIcon MapVirtualKeyExW GetKeyNameTextW GetKeyboardLayout GetGUIThreadInfo InvalidateRgn CreateAcceleratorTableW MoveWindow DrawTextA wsprintfA IsWindowEnabled GetWindowTextLengthW GetWindowTextW SetWindowTextW EqualRect UpdateWindow ClientToScreen GetCaretPos SetCaretPos ShowCaret HideCaret GetCaretBlinkTime CreateCaret EnableMenuItem GetIconInfo DrawIconEx

gdi32

CloseEnhMetaFile SelectObject SaveDC RestoreDC Rectangle RemoveFontMemResourceEx AddFontMemResourceEx GetStockObject EnumFontFamiliesExW DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateDIBitmap CreateCompatibleDC CreateCompatibleBitmap BitBlt GetDeviceCaps GetEnhMetaFileHeader GetTextMetricsW GetObjectW SetWindowOrgEx CreateRoundRectRgn CreateDIBSection CombineRgn CreateDCW CreatePenIndirect CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetDIBits GetTextExtentPoint32W LineTo SelectClipRgn CreateEnhMetaFileW ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor GetObjectA MoveToEx TextOutW GdiFlush CreatePatternBrush GetTextExtentPointA GetBitmapBits SetBitmapBits PlayEnhMetaFile

advapi32

CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash OpenServiceW OpenSCManagerW ControlService CloseServiceHandle RegGetValueW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegOpenCurrentUser RegCloseKey SetSecurityDescriptorDacl SetFileSecurityW RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CryptDestroyKey CryptImportKey CryptEncrypt CryptAcquireContextA RegOpenKeyExA RegQueryValueExA GetUserNameA RegSetValueExA RegQueryValueExW QueryServiceStatus StartServiceW

shell32

DragQueryFileW CommandLineToArgvW Shell_NotifyIconW ShellExecuteExW SHCreateDirectoryExW SHGetSpecialFolderPathW

ole32

CoInitializeEx StringFromGUID2 CoCreateGuid CoUninitialize CoInitialize CoCreateInstance CoInitializeSecurity DoDragDrop OleDuplicateData ReleaseStgMedium CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID OleLockRunning RegisterDragDrop CoSetProxyBlanket

oleaut32

VariantClear SafeArrayAccessData SysAllocString SysFreeString VariantInit SafeArrayUnaccessData

shlwapi

PathFindFileNameW PathIsDirectoryW PathRemoveFileSpecW PathFileExistsW

bcrypt

BCryptEncrypt BCryptGenerateSymmetricKey BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

ws2_32

send WSAStartup gethostname gethostbyname WSACloseEvent WSACreateEvent ioctlsocket getpeername sendto recvfrom freeaddrinfo getsockopt recv listen htonl getsockname connect bind accept select getaddrinfo __WSAFDIsSet socket htons WSAIoctl setsockopt WSACleanup ntohs WSAGetLastError WSASetLastError closesocket WSAWaitForMultipleEvents WSAEnumNetworkEvents WSAEventSelect WSAResetEvent

wtsapi32

WTSQueryUserToken

comctl32

ord17 _TrackMouseEvent InitCommonControlsEx

gdiplus

GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawImageRectI GdipFillPath GdipFillRectangleI GdipDrawPath GdipDrawRectangleI GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipDeleteFont GdipSetSmoothingMode GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateTexture GdipSetTextureTransform GdipLoadImageFromFile GdipGetImageThumbnail GdipFillEllipseI GdipTranslateWorldTransform GdipRotateWorldTransform GdipDeleteGraphics GdipCreateFromHDC GdipBitmapUnlockBits GdipBitmapLockBits GdipStringFormatGetGenericTypographic GdipImageGetFrameDimensionsCount GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipLoadImageFromStream GdipSetPenMode GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix GdipAddPathArc GdipAddPathLine GdipDeletePath GdipCreatePath GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipMeasureString GdipDrawString GdipImageGetFrameDimensionsList GdipRotateMatrix

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

dbghelp

MakeSureDirectoryPathExists

sensapi

IsNetworkAlive

iphlpapi

GetAdaptersAddresses

crypt32

CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptQueryObject PFXImportCertStore CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCreateCertificateChainEngine CertFreeCertificateChain CertGetCertificateChain CryptDecodeObjectEx CertFreeCertificateChainEngine CryptStringToBinaryA CertCloseStore CertOpenStore

wldap32

ord143 ord217 ord46 ord211 ord60 ord45 ord50 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41

winhttp

WinHttpSetStatusCallback WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpQueryDataAvailable WinHttpQueryOption WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpSetCredentials WinHttpQueryAuthSchemes WinHttpReceiveResponse WinHttpQueryHeaders WinHttpGetIEProxyConfigForCurrentUser WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpGetProxyForUrl

generic

count=22, id=259, version=30795,

count=220, id=261, version=30795,

count=3, productName=Unmarked objects (old),

count=6, id=260, version=27031,

count=7, id=253, version=33808,

count=10, id=259, version=33808,

count=19, id=260, version=33808,

count=1, id=260, version=34123,

count=1, id=263, version=30795,

count=3, id=265, version=34123,

count=6, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=127, id=260, version=33523,

count=105, id=261, version=33808,

count=46, id=260, version=30795,

count=1, id=262, version=30795,

count=41, id=257, version=30795,

count=644, id=1, productName=Unmarked objects,

count=81, id=261, version=34123,

count=1, id=255, version=34123,

count=1, id=151,

count=1, id=258, version=34123,