Silviozas Premium Proxy[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Silviozas Premium Proxy.exe
Size 10.8MB
Sample260710-hdtr4aex8k
SHA256 dad0994aaf5c4563e20c8c3ff122851cf2219930eed0f3e1eeb079f30afbde6c
MD5 11470804eb7608b3844cc451b598d4a7
SHA1 802236cc392c4b586ae6a3ed14fe80a64ea9be31
SHA512 d171feac684ce06313dcba6d579e4378bef0012ccd47d23110178514cde0a71e76a7cc2382994ba97229a6b030d8fee360b312da6ebea32276c425d27c4de238
SSDEEP 49152:kRVwASOVGtlqc4IU6it0q+jiGJBEQ+aST9YARWhcB+9RmWkC8s+iKlaj0+Rwjjgg:7H+HfFWkC8s7uzGaGjT0NbCzNaAyr
TLSH
T10AB6F60AEA7691E1D1FAD139C2526627BC323C5DC334A7E38A859B175F267E0E93D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Silviozas Premium Proxy.exe

File Explorer

Silviozas Premium Proxy.exe

.exe 10.8MB

Silviozas Premium Proxy.exe

IMPHASH f02d0dc4aa631338cdc1f10e01351096
SHA256 dad0994aaf5c4563e20c8c3ff122851cf2219930eed0f3e1eeb079f30afbde6c
MD5 11470804eb7608b3844cc451b598d4a7
SHA1 802236cc392c4b586ae6a3ed14fe80a64ea9be31
SHA512 d171feac684ce06313dcba6d579e4378bef0012ccd47d23110178514cde0a71e76a7cc2382994ba97229a6b030d8fee360b312da6ebea32276c425d27c4de238
SSDEEP 49152:kRVwASOVGtlqc4IU6it0q+jiGJBEQ+aST9YARWhcB+9RmWkC8s+iKlaj0+Rwjjgg:7H+HfFWkC8s7uzGaGjT0NbCzNaAyr
TLSH
T10AB6F60AEA7691E1D1FAD139C2526627BC323C5DC334A7E38A859B175F267E0E93D700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2098924

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptSignHashW GetUserNameW ConvertSidToStringSidW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges DeregisterEventSource RegCloseKey RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegSetValueExW RegisterEventSourceW CryptEnumProvidersW GetTokenInformation CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertOpenSystemStoreW CertEnumCertificatesInStore CertCloseStore CertFindCertificateInStore CertGetCertificateContextProperty CertOpenStore

kernel32

WideCharToMultiByte GetSystemTimeAsFileTime K32EnumProcessModules QueryPerformanceCounter GlobalUnlock AllocConsole IsDebuggerPresent VirtualQueryEx GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetModuleHandleW InitializeSListHead SetLastError GetSystemTime EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW GetFileType WriteFile OutputDebugStringW GetProcAddress SwitchToFiber DeleteFiber CreateFiber GetModuleHandleExW FindClose FindFirstFileW FindNextFileW ConvertFiberToThread ConvertThreadToFiber FreeLibrary LoadLibraryA LoadLibraryW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetCurrentProcessId GetFileAttributesExW FindFirstFileExW CreateFileW GetLocaleInfoEx FormatMessageA AreFileApisANSI MoveFileExW GetFileInformationByHandleEx InitOnceComplete InitOnceBeginInitialize GetStringTypeW TryAcquireSRWLockExclusive ReadProcessMemory ExitProcess DeleteCriticalSection LocalFree GlobalLock GetThreadContext DecodePointer CreateWaitableTimerA K32EnumProcesses K32GetModuleInformation FreeConsole K32GetModuleBaseNameA CloseHandle GlobalAlloc QueryPerformanceFrequency GetSystemDirectoryA GetCurrentThread GetLastError K32GetModuleFileNameExA Sleep MultiByteToWideChar OpenProcess GetTickCount64 WaitForSingleObjectEx GetExitCodeThread GetNativeSystemInfo WakeConditionVariable LCMapStringEx EncodePointer CompareStringEx GetCPInfo lstrlenW ReadFile PeekNamedPipe WaitNamedPipeW GetCurrentThreadId WaitForSingleObject InitializeCriticalSectionEx GetModuleFileNameW OutputDebugStringA GetCurrentProcess SystemTimeToFileTime SetConsoleTitleA SetWaitableTimer WriteProcessMemory SetConsoleCtrlHandler GetModuleFileNameA

shell32

ShellExecuteA

user32

MessageBoxW GetUserObjectInformationW GetProcessWindowStation GetWindowThreadProcessId GetWindowTextA GetAsyncKeyState OpenClipboard GetWindowTextLengthA MessageBoxA EnumDisplaySettingsA DefWindowProcA SetClipboardData GetClientRect EmptyClipboard PostQuitMessage CloseClipboard FindWindowExA

vcruntime140

memchr wcsstr strrchr strstr __uncaught_exceptions _CxxThrowException __current_exception_context __current_exception _purecall __std_type_info_compare __C_specific_handler __std_terminate memset memcmp __std_exception_copy memcpy memmove __std_exception_destroy strchr

vcruntime140_1

__CxxFrameHandler4

wininet

InternetReadFile InternetOpenA InternetCloseHandle InternetOpenUrlA

winmm

timeBeginPeriod timeEndPeriod timeGetTime

ws2_32

send getsockname listen socket WSACleanup __WSAFDIsSet bind getpeername closesocket WSAStartup getaddrinfo ntohs connect recv inet_pton getsockopt WSASocketW htonl select WSASetLastError WSAAddressToStringA accept ntohl WSAGetLastError setsockopt WSARecvFrom getnameinfo ioctlsocket shutdown WSASendTo htons freeaddrinfo

api-ms-win-crt-convert-l1-1-0

strtol atoi strtoul strtoll strtod strtof strtoull

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_access_s _mkdir _stat64i32 _unlock_file remove _lock_file _wmkdir

api-ms-win-crt-heap-l1-1-0

realloc calloc _set_new_mode _callnewh malloc free

api-ms-win-crt-locale-l1-1-0

localeconv ___mb_cur_max_func setlocale _unlock_locales _lock_locales ___lc_collate_cp_func ___lc_locale_name_func ___lc_codepage_func __pctype_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

sqrtf fabs _dtest __setusermatherr frexp _ldtest _dsign

api-ms-win-crt-runtime-l1-1-0

strerror_s raise strerror _configure_narrow_argv abort _wassert _register_thread_local_exe_atexit_callback _c_exit system terminate signal __p___argv __p___argc _invoke_watson _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _beginthreadex _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _errno exit _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __acrt_iob_func fgetpos setvbuf _popen fgets ungetwc fputwc fgetwc fputs ungetc fflush fputc __stdio_common_vfprintf _wfopen feof fsetpos _fseeki64 freopen_s __stdio_common_vsscanf _setmode fgetc _fileno ferror __stdio_common_vswprintf fopen ftell __p__commode fread fopen_s fwrite _pclose fseek fclose _set_fmode __stdio_common_vsprintf_s _fsopen _get_stream_buffer_pointers

api-ms-win-crt-string-l1-1-0

toupper tolower _strdup strcpy _strnicmp strcspn strcpy_s strlen _stricmp wcslen isdigit isalnum wcsnlen __strncnt strspn islower _wcsdup isupper strncmp isspace wcscpy wcscmp strcat strncpy strcmp

api-ms-win-crt-time-l1-1-0

_gmtime64 _gmtime64_s _time64

api-ms-win-crt-utility-l1-1-0

llabs rand _lrotl _lrotr qsort rand_s abs

bcrypt

BCryptGenRandom

ole32

CoCreateInstance CoInitialize