473773cffda03551b08f0a0beb2bd9949449662998c0b63168690ddf0b8b6106

Sharing

Copy URL Twitter E-mail

General

Target
473773cffda03551b08f0a0beb2bd9949449662998c0b63168690ddf0b8b6106
Size 317KB
Sample260718-abc3kadx2w
SHA256 473773cffda03551b08f0a0beb2bd9949449662998c0b63168690ddf0b8b6106
MD5 91d03e592820dcbe21c53078c761dfb6
SHA1 c0a588b0076ef031d23ce24b69b10b7fb7b049de
SHA512 f43887008181e157f44fcca8bf4c85850f64a6ddb46125222e4d7fb1db5e24586e3ba6af9ae03ba7e586604495501f9a9f5e27dd8076a614b9abcde19c47d55d
SSDEEP 6144:PIIIIpmOT7gg0zh/pDUi/GVgmJ69uPOMdteudstv:pms8g0l7+Su690dJytv
TLSH
T1AB648D306A19CA3BC61702B8D8599E7F94377F290FD161D3B3D85E8E94702E25732A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
473773cffda03551b08f0a0beb2bd9949449662998c0b63168690ddf0b8b6106

File Explorer

473773cffda03551b08f0a0beb2bd9949449662998c0b63168690ddf0b8b6106

.exe 317KB

473773cffda03551b08f0a0beb2bd9949449662998c0b63168690ddf0b8b6106

IMPHASH 1dd675e7624725ec2a189e9525d28ba5
SHA256 473773cffda03551b08f0a0beb2bd9949449662998c0b63168690ddf0b8b6106
MD5 91d03e592820dcbe21c53078c761dfb6
SHA1 c0a588b0076ef031d23ce24b69b10b7fb7b049de
SHA512 f43887008181e157f44fcca8bf4c85850f64a6ddb46125222e4d7fb1db5e24586e3ba6af9ae03ba7e586604495501f9a9f5e27dd8076a614b9abcde19c47d55d
SSDEEP 6144:PIIIIpmOT7gg0zh/pDUi/GVgmJ69uPOMdteudstv:pms8g0l7+Su690dJytv
TLSH
T1AB648D306A19CA3BC61702B8D8599E7F94377F290FD161D3B3D85E8E94702E25732A27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

159149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345softmgr-build\SoftMgr\main\bin\Win32\release\pdb\2345SoftInstallAgent.pdb

kernel32

GetModuleFileNameW GetCurrentThreadId GetCurrentProcessId HeapFree HeapAlloc LocalFree GetProcessHeap IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead FindFirstFileW GetFileAttributesExW GetACP GetVersionExW LockResource GetEnvironmentVariableW GetCurrentProcess GetLastError GetNamedPipeInfo GetStdHandle FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW GetPrivateProfileStringW WideCharToMultiByte SystemTimeToFileTime GetCurrentDirectoryW CloseHandle LocalFileTimeToFileTime MultiByteToWideChar GetFileAttributesW CreateFileW SetFilePointer SetFileTime WriteFile ReadFile CreateDirectoryW LoadResource FindResourceW lstrcmpiW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection SetFileAttributesW FormatMessageW RemoveDirectoryW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter GetFileSize GetFileSizeEx DeleteFileW SetEndOfFile FindClose FindNextFileW ReleaseMutex WaitForSingleObject CreateMutexW UnhandledExceptionFilter

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoTaskMemFree

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Xbad_alloc@std@@YAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate wcsstr __CxxFrameHandler3 _except_handler4_common _CxxThrowException __current_exception __current_exception_context memmove wcschr strstr _purecall memcpy memset

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc calloc free _callnewh

api-ms-win-crt-string-l1-1-0

towlower wcscpy_s strpbrk wcsncpy towupper _wcsicmp

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf __stdio_common_vswprintf __stdio_common_vsprintf_s ftell _wfopen_s fread fwrite rewind fseek fclose _set_fmode

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _invoke_watson _crt_atexit _cexit _seh_filter_exe _set_app_type _invalid_parameter_noinfo _get_narrow_winmain_command_line _controlfp_s terminate _initterm _register_onexit_function _errno _register_thread_local_exe_atexit_callback _c_exit _initterm_e _exit exit

api-ms-win-crt-math-l1-1-0

modf _dclass __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

473773cffda03551b08f0a0beb2bd9949449662998c0b63168690ddf0b8b6106

kernel32

shell32

ole32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic