eService Free Perm (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
eService Free Perm (1).exe
Size 1.1MB
Sample260721-e8xkpagv41
SHA256 499c3f93f77ac790a3a7ff6c7c82e973776e95095a489e6e9f00f5f7cc16411f
MD5 e9b39e61d711763c6314196890c4030c
SHA1 43add7293c1ac8fff8a4b359c36bc8ab80ab1026
SHA512 99804887e27d3915059c60b5011fa1cd1f33d25c346eb343f7b2e390ccccbb0d58a4b453573791c003330a6c1d639104edde045cf82cb9874de707a4a0dffacb
SSDEEP 24576:XUX3CaAhCgCl61iHxV2uGKFanFEvwNO5dL9iL:ECRCgCoEAnowQ5niL
TLSH
T16035BFE7636710A3F42127B048402847E6B470A5A6659BB731B08D5B7FDF2F2BC64B36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eService Free Perm (1).exe

File Explorer

eService Free Perm (1).exe

.exe 1.1MB

eService Free Perm (1).exe

IMPHASH 64fe58ec38e29ee2716907740904bca1
SHA256 499c3f93f77ac790a3a7ff6c7c82e973776e95095a489e6e9f00f5f7cc16411f
MD5 e9b39e61d711763c6314196890c4030c
SHA1 43add7293c1ac8fff8a4b359c36bc8ab80ab1026
SHA512 99804887e27d3915059c60b5011fa1cd1f33d25c346eb343f7b2e390ccccbb0d58a4b453573791c003330a6c1d639104edde045cf82cb9874de707a4a0dffacb
SSDEEP 24576:XUX3CaAhCgCl61iHxV2uGKFanFEvwNO5dL9iL:ECRCgCoEAnowQ5niL
TLSH
T16035BFE7636710A3F42127B048402847E6B470A5A6659BB731B08D5B7FDF2F2BC64B36
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

266632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VerifyVersionInfoW QueryPerformanceCounter TerminateProcess WaitForMultipleObjects WaitForSingleObject GetModuleHandleA Sleep GetSystemDirectoryA CloseHandle CreateThread CreateDirectoryA GetTickCount SetEndOfFile WriteConsoleW HeapReAlloc HeapSize CreateFileW GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetModuleHandleW GetConsoleOutputCP FlushFileBuffers LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx WriteFile GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GlobalUnlock WideCharToMultiByte GlobalLock ExitThread ReadFile LoadLibraryExW FreeLibrary TlsFree GlobalFree GlobalAlloc GetFileSizeEx MultiByteToWideChar TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead TryAcquireSRWLockExclusive InitializeCriticalSectionEx RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection

user32

GetClipboardData GetCursorPos ReleaseDC CloseClipboard SetClipboardData OpenClipboard EmptyClipboard SetCursorPos GetWindowRect SetWindowRgn GetSystemMetrics DispatchMessageW PeekMessageW MessageBoxA TranslateMessage PostQuitMessage UpdateWindow GetWindowLongW DefWindowProcW AdjustWindowRectEx GetKeyState DestroyWindow GetDC SetWindowPos MonitorFromWindow EnumDisplayMonitors CreateWindowExW ScreenToClient UnregisterClassW SetWindowTextW RegisterClassExW WindowFromPoint ShowWindow GetCapture GetMonitorInfoW ClientToScreen IsChild GetForegroundWindow SetLayeredWindowAttributes SetFocus BringWindowToTop LoadCursorW SetCapture SetCursor SetWindowLongW GetClientRect ReleaseCapture SetForegroundWindow IsIconic

gdi32

CreateRoundRectRgn GetDeviceCaps

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA ShellExecuteExA

xinput1_3

ord4 ord2

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemory

urlmon

URLDownloadToFileA

Name

.text

Size

398KB

Virtual Size

397KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

233KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

249KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

239KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

eService Free Perm (1).exe

kernel32

user32

gdi32

advapi32

shell32

xinput1_3

imm32

d3d9

d3dx9_43

urlmon

generic