968f35aba7b9b7fa742b20c79c329018e675d103891a2262596a4e3f779896fd

Sharing

Copy URL Twitter E-mail

General

Target
968f35aba7b9b7fa742b20c79c329018e675d103891a2262596a4e3f779896fd
Size 6.1MB
Sample260712-dnbbaact4p
SHA256 968f35aba7b9b7fa742b20c79c329018e675d103891a2262596a4e3f779896fd
MD5 fe731a7b7ef7920cfe1288a9f00e5064
SHA1 afca0b03c20a762b1d5960f01ace92471ac1e4a7
SHA512 d922f7aea126be737cbbce2b3c6a15e43d5af4275da868eb7a7c4b72e6c18b86c388c1c704d1a85d687a871612342d66c26f49e059ba5ca210abb448faed6d57
SSDEEP 98304:S0a7S1evKNmlIcv2mtkFQMqUzhq70SIMUke3H7iWuPHWnvwLufuu9uuQuuuRBuuY:Sk1eemlIWMqUsA3bIqF
TLSH
T14656AE01B9E18475E57303323665B3A6EDBEB9A19B3185CBB38C162E4F319C1873BB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
968f35aba7b9b7fa742b20c79c329018e675d103891a2262596a4e3f779896fd

File Explorer

968f35aba7b9b7fa742b20c79c329018e675d103891a2262596a4e3f779896fd

.exe 6.1MB

968f35aba7b9b7fa742b20c79c329018e675d103891a2262596a4e3f779896fd

IMPHASH 69f6b02f5091d9270374252f3dc730e5
SHA256 968f35aba7b9b7fa742b20c79c329018e675d103891a2262596a4e3f779896fd
MD5 fe731a7b7ef7920cfe1288a9f00e5064
SHA1 afca0b03c20a762b1d5960f01ace92471ac1e4a7
SHA512 d922f7aea126be737cbbce2b3c6a15e43d5af4275da868eb7a7c4b72e6c18b86c388c1c704d1a85d687a871612342d66c26f49e059ba5ca210abb448faed6d57
SSDEEP 98304:S0a7S1evKNmlIcv2mtkFQMqUzhq70SIMUke3H7iWuPHWnvwLufuu9uuQuuuRBuuY:Sk1eemlIWMqUsA3bIqF
TLSH
T14656AE01B9E18475E57303323665B3A6EDBEB9A19B3185CBB38C162E4F319C1873BB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1533986

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

CareUEyes.pdb

winmm

timeSetEvent mciSendStringW timeKillEvent

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

kernel32

FindNextFileW GetFileAttributesExW GetCurrentDirectoryW MapViewOfFile GetVolumeInformationW GetFileAttributesW GetTempPathW CreateDirectoryW SetFilePointerEx SetEndOfFile FlushFileBuffers GetFileInformationByHandle CreateToolhelp32Snapshot GetFileSizeEx FormatMessageW TryEnterCriticalSection GetSystemTimeAsFileTime SystemTimeToFileTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetVersionExW GetSystemInfo GetSystemDirectoryW GetTimeZoneInformation GetUserDefaultLangID FindFirstChangeNotificationW FindCloseChangeNotification WaitForMultipleObjects FindNextChangeNotification Process32FirstW Process32NextW ResetEvent OpenFileMappingW IsBadReadPtr GetSystemTime GetCurrentDirectoryA GetModuleFileNameA GetVersionExA HeapCreate FreeResource GetFullPathNameW SleepEx VerSetConditionMask QueryPerformanceFrequency VerifyVersionInfoW QueryPerformanceCounter MoveFileExA CompareFileTime GetFileType GetStdHandle PeekNamedPipe FormatMessageA InterlockedDecrement WriteFile UnmapViewOfFile SuspendThread GetThreadContext lstrlenA InterlockedIncrement VirtualFree GlobalAlloc VirtualAlloc FlushInstructionCache VirtualProtect GetEnvironmentVariableW GetEnvironmentVariableA CreateProcessW ResumeThread TerminateProcess FindFirstFileW ReadProcessMemory LoadLibraryExA LoadLibraryA GetComputerNameA OutputDebugStringW IsBadWritePtr SetLastError ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber ReadConsoleA SetConsoleMode WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode GetACP GetDriveTypeW SetStdHandle GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetStartupInfoW UnhandledExceptionFilter LocalFree GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW GetExitCodeThread SwitchToThread WaitForSingleObjectEx DuplicateHandle IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent lstrcmpW ExitProcess GlobalAddAtomA Sleep InterlockedCompareExchange GetModuleHandleA SetEvent CreateEventW WaitForSingleObject InitializeCriticalSection GetProcessHeap FindClose ReadFile CreateFileMappingW GetFileSize GlobalLock GlobalUnlock MulDiv WideCharToMultiByte OutputDebugStringA DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateThread LoadLibraryW GetProcAddress FreeLibrary GetLastError CloseHandle SetUnhandledExceptionFilter GetCurrentProcess GetCurrentProcessId GetCommandLineA GetModuleHandleW GetLocalTime GetTickCount HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetCommandLineW SetCurrentDirectoryW InitializeCriticalSectionAndSpinCount lstrcmpiW LockResource SizeofResource FindResourceExW DecodePointer RaiseException MultiByteToWideChar DeleteFileW LoadResource FindResourceW LoadLibraryExW GetCurrentThread GetModuleFileNameW VirtualQuery GetCurrentThreadId CreateFileW

user32

ReleaseDC MessageBoxW GetActiveWindow IsWindowVisible GetFocus GetParent ShowWindow SetWindowPos DestroyWindow SendMessageW UnregisterClassW CharNextW PtInRect GetDC OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindow MsgWaitForMultipleObjects CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW SetClassLongW GetClassLongW RemovePropW GetPropW SetPropW SetMenuContextHelpId GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenu AppendMenuW GetMenuItemCount DestroyMenu DrawTextW SystemParametersInfoA CharLowerBuffW MapVirtualKeyA UpdateLayeredWindow OffsetRect PeekMessageW FindWindowW GetWindowRect MonitorFromRect PostMessageW UnhookWinEvent SetWinEventHook GetForegroundWindow GetCursorPos WindowFromPoint GetMonitorInfoW BringWindowToTop GetUserObjectInformationW GetProcessWindowStation DrawIconEx SetWindowLongW SetForegroundWindow MonitorFromPoint GetSystemMetrics GetAsyncKeyState UnregisterHotKey RegisterHotKey EnumDisplayMonitors CopyRect ScreenToClient GetWindowLongW MonitorFromWindow GetClassNameW GetShellWindow GetAncestor ClientToScreen GetWindowThreadProcessId SystemParametersInfoW AttachThreadInput LockWorkStation InvalidateRect SetCursor SetCapture ReleaseCapture SetActiveWindow PostQuitMessage GetDesktopWindow CreateWindowExW SetWindowTextW GetWindowTextW GetWindowTextLengthW MoveWindow GetClientRect BeginPaint EndPaint InvalidateRgn RedrawWindow SetFocus GetWindow IsChild GetDlgCtrlID GetDlgItem GetSysColor DestroyAcceleratorTable FillRect CreateAcceleratorTableW DefWindowProcW RegisterWindowMessageW GetClassInfoExW LoadCursorW RegisterClassExW CreatePopupMenu IsMenu IsWindowEnabled EnableWindow LoadImageW CreateIconFromResource LoadBitmapW GetIconInfo MapWindowPoints SetCaretPos HideCaret GetCaretBlinkTime CreateCaret UpdateWindow GetCapture AnimateWindow TrackMouseEvent SetRect DispatchMessageW CallWindowProcW SetTimer KillTimer GetWindowLongA SetLayeredWindowAttributes IsIconic EnumDisplayDevicesW DestroyIcon SendMessageA GetWindowDC GetWindowRgn IsZoomed SetSysColors DestroyCursor GetKeyState TranslateMessage GetMessageW EqualRect IsRectEmpty UnionRect IntersectRect InflateRect EnableMenuItem

gdi32

SetDeviceGammaRamp GetObjectW GetStockObject DeleteDC CreateCompatibleBitmap CreateSolidBrush DeleteObject SelectObject SetBkMode SaveDC SetViewportOrgEx CreateFontIndirectW EnumFontsW CreateRectRgn CreatePen SetROP2 CreateHatchBrush FrameRgn Rectangle SetGraphicsMode CreateRoundRectRgn ExcludeClipRect GetDeviceCaps RestoreDC ExtCreateRegion GetRegionData IntersectClipRect SelectClipRgn CreateDIBSection GetCurrentObject GetViewportOrgEx CreateBitmap StretchBlt GetFontUnicodeRanges GetGlyphIndicesW GetTextExtentPointI AddFontMemResourceEx RemoveFontMemResourceEx SetTextColor SetTextAlign GetTextMetricsW SetWorldTransform ExtTextOutW GetTextFaceW GdiFlush BitBlt CreateCompatibleDC EnumFontFamiliesExW GetCharABCWidthsW GetFontData GetGlyphOutlineW GetOutlineTextMetricsW

comdlg32

GetOpenFileNameW ChooseColorW

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegNotifyChangeKeyValue RegQueryValueExW GetUserNameA RegDeleteValueW RegCreateKeyExW RegSetValueExW CryptEnumProvidersW

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW Shell_NotifyIconW SHFileOperationW SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderLocation ord680 ShellExecuteW

ole32

CoTaskMemAlloc CoCreateInstance OleUninitialize CoTaskMemRealloc CLSIDFromString CLSIDFromProgID CoGetClassObject CoTaskMemFree OleLockRunning IIDFromString CoCreateGuid CreateBindCtx StringFromGUID2 CreateStreamOnHGlobal OleInitialize

oleaut32

SysAllocString VarUI4FromStr VariantTimeToSystemTime SystemTimeToVariantTime VarBstrFromDate SysAllocStringLen SysStringLen LoadTypeLi VariantInit VariantClear OleCreateFontIndirect DispCallFunc SysFreeString LoadRegTypeLi VarUdateFromDate

shlwapi

PathFileExistsW PathIsDirectoryW PathFindExtensionW PathRemoveFileSpecW PathAppendW StrToIntExW PathQuoteSpacesW

gdiplus

GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipAlloc GdipFree GdipImageGetFrameCount GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipGraphicsClear GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipBitmapLockBits

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeA GetFileVersionInfoA GetFileVersionInfoSizeW

dwmapi

DwmGetWindowAttribute

ws2_32

getsockname getpeername connect bind WSAGetLastError send recv closesocket getsockopt htons ntohs setsockopt WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl listen ioctlsocket __WSAFDIsSet select getaddrinfo freeaddrinfo recvfrom shutdown sendto gethostname socket getnameinfo

iphlpapi

GetAdaptersInfo

imm32

ImmGetContext ImmReleaseContext ImmAssociateContext

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore

wldap32

ord208 ord41 ord46 ord145 ord216 ord14 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord301 ord133 ord147 ord219

usp10

ScriptShape ScriptItemize ScriptFreeCache

generic

count=41, id=241, version=40116,

count=206, id=243, version=40116,

count=41, id=242, version=40116,

count=9, id=199, version=41118,

count=28, id=259, version=26706,

count=15, id=261, productName=VS2017 v15.9.7 build 27027, version=27027,

count=22, id=260, version=27041,

count=41, id=260, version=26706,

count=136, id=261, version=26706,

count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=21, productName=Unmarked objects (old),

count=658, id=260, version=27038,

count=5, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=689, id=1, productName=Unmarked objects,

count=344, id=261, version=27041,

count=78, id=261, version=27054,

count=7, id=261, version=27051,

count=143, id=265, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,