522e46b8cd2d516dbfecdbd12b25e4078d8461e9c101915e32ddcb29d586b42b

Sharing

Copy URL Twitter E-mail

General

Target
522e46b8cd2d516dbfecdbd12b25e4078d8461e9c101915e32ddcb29d586b42b
Size 2.2MB
Sample260710-man5nahw2k
SHA256 522e46b8cd2d516dbfecdbd12b25e4078d8461e9c101915e32ddcb29d586b42b
MD5 102096087754ade272e6b2d6da34e373
SHA1 64c98378120fe88d548a92dd8b26a5f183ab44da
SHA512 b2ee3ffd9e78e2ec618d2d78990e356046a6d836a5c4d37b312dc3ae99b5c658f506bf14dd3b581bd09d64e5abf469e5321b297e4a675bf830f051562c6975f7
SSDEEP 49152:oJYI6WsZXaTdZeV5hehf0NUdumz4QWTmp9diDw4FyPLm8fExF:oJL6zATdIVhid9z4QdMwqF
TLSH
T149B58D207A86C637D65211B0072DAE6F506C7D201B6494D7F3D82F3EA9F0AD35A31E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
522e46b8cd2d516dbfecdbd12b25e4078d8461e9c101915e32ddcb29d586b42b

File Explorer

522e46b8cd2d516dbfecdbd12b25e4078d8461e9c101915e32ddcb29d586b42b

.exe 2.2MB

522e46b8cd2d516dbfecdbd12b25e4078d8461e9c101915e32ddcb29d586b42b

IMPHASH 7e7f052ef9c996cd924896270a6c4a14
SHA256 522e46b8cd2d516dbfecdbd12b25e4078d8461e9c101915e32ddcb29d586b42b
MD5 102096087754ade272e6b2d6da34e373
SHA1 64c98378120fe88d548a92dd8b26a5f183ab44da
SHA512 b2ee3ffd9e78e2ec618d2d78990e356046a6d836a5c4d37b312dc3ae99b5c658f506bf14dd3b581bd09d64e5abf469e5321b297e4a675bf830f051562c6975f7
SSDEEP 49152:oJYI6WsZXaTdZeV5hehf0NUdumz4QWTmp9diDw4FyPLm8fExF:oJL6zATdIVhid9z4QdMwqF
TLSH
T149B58D207A86C637D65211B0072DAE6F506C7D201B6494D7F3D82F3EA9F0AD35A31E6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1310763

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\RhinoProtect\Publish\OutPut\bin\Win32\release\pdb\2345SFGuard.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

LoadResource FindResourceW GetProcAddress GetModuleHandleW FreeLibrary InterlockedIncrement lstrcmpiW LoadLibraryExW IsBadStringPtrW WriteProcessMemory WaitForSingleObject OpenProcess CreateEventW SetEvent LoadLibraryA ResetEvent VirtualAllocEx CreateRemoteThread VirtualFreeEx OpenMutexW QueryDosDeviceW GetEnvironmentVariableW GetLogicalDriveStringsW VirtualQuery WriteFile CreateFileW GetModuleHandleExW CreateMutexW ReleaseMutex MultiByteToWideChar HeapAlloc LocalFree GetProcessHeap CreateDirectoryW GetWindowsDirectoryW ReadFile SetFilePointer SetEndOfFile Sleep DeleteFileW GetFileSize GetTickCount InterlockedExchange SetLastError InterlockedExchangeAdd lstrlenW GetPrivateProfileStringW LoadLibraryW GlobalMemoryStatusEx ExpandEnvironmentStringsW GetVersionExW GetCurrentProcess GetFileAttributesW SetStdHandle WaitForSingleObjectEx OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCurrentThreadId LeaveCriticalSection WaitForMultipleObjects GetModuleFileNameW InterlockedDecrement EnterCriticalSection SizeofResource DeleteCriticalSection DecodePointer RaiseException CloseHandle GetLastError SetErrorMode InitializeCriticalSectionAndSpinCount WriteConsoleW GetCurrentProcessId GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA GetTimeZoneInformation FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP LockResource GetSystemInfo SearchPathW OpenFileMappingW UnmapViewOfFile CreateFileMappingW MapViewOfFile ResumeThread OpenEventW GetACP WideCharToMultiByte GetVolumeInformationW GetDiskFreeSpaceW GetDriveTypeW FindFirstFileW GetLongPathNameW GetShortPathNameW GetFileAttributesExW TryEnterCriticalSection InitializeCriticalSection FindNextFileW FindClose LocalFileTimeToFileTime FileTimeToSystemTime FileTimeToLocalFileTime SystemTimeToFileTime GetSystemTime DosDateTimeToFileTime FileTimeToDosDateTime HeapFree GetComputerNameExW GlobalAlloc GlobalFree SetFileTime GetFileTime GetFullPathNameW RemoveDirectoryW GetTempPathW GetSystemDirectoryW SetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW MoveFileExW CopyFileW GetTempFileNameW MoveFileW DeviceIoControl lstrcatW lstrcpyW GetFileSizeEx CreateProcessW GetExitCodeProcess FormatMessageW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent OutputDebugStringW GetLocalTime UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlCaptureContext ReleaseSemaphore GetProcessId SuspendThread TerminateThread CreateThread GetThreadContext CreateSemaphoreW OpenThread VirtualQueryEx SetNamedPipeHandleState DuplicateHandle TransactNamedPipe WaitNamedPipeW GetStdHandle GetFileType RtlUnwind InterlockedPushEntrySList InterlockedFlushSList ExitThread FreeLibraryAndExitThread ExitProcess GetModuleFileNameA SetConsoleCtrlHandler GetCurrentThread HeapSize HeapReAlloc SetFilePointerEx GetConsoleMode ReadConsoleW

user32

GetProcessWindowStation MessageBoxW GetUserObjectInformationW UnregisterClassW PostThreadMessageW GetMessageW DispatchMessageW PeekMessageW CharNextW TranslateMessage

advapi32

ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor InitializeAcl GetLengthSid AddAccessAllowedAce RegCloseKey RegQueryInfoKeyW RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc CoCreateInstance CoTaskMemAlloc CoTaskMemFree

oleaut32

SysFreeString VarUI4FromStr

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

522e46b8cd2d516dbfecdbd12b25e4078d8461e9c101915e32ddcb29d586b42b

version

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic