arlingtonchamber[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
arlingtonchamber.exe
Size 76.4MB
Sample260722-wpqfpsem6t
SHA256 2726e3c8ecac30154d4c2c9c3da9f5942bab8ce25b43771ab888d65a2bd2f59c
MD5 e9c842e3043a5e287612f4e24badb3d3
SHA1 f47306c562708fa1c2b54b0af931668cd3070689
SHA512 5aef127bc51b768058e1aa93b1a5a7ff3e1c132e51f9175d712de7665dbf151c8632294b56b96dff3c3a4b3ab00d0061cb617965b0db598fe4a625a16c78d0e2
SSDEEP 1572864:FqnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpr:FiLVelepClAy6uw3W0BEROh2nvvV
TLSH
T12108011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
arlingtonchamber.exe

File Explorer

arlingtonchamber.exe

.exe 76.4MB

arlingtonchamber.exe

IMPHASH 63c11544893457fb321a43dc42728c6a
SHA256 2726e3c8ecac30154d4c2c9c3da9f5942bab8ce25b43771ab888d65a2bd2f59c
MD5 e9c842e3043a5e287612f4e24badb3d3
SHA1 f47306c562708fa1c2b54b0af931668cd3070689
SHA512 5aef127bc51b768058e1aa93b1a5a7ff3e1c132e51f9175d712de7665dbf151c8632294b56b96dff3c3a4b3ab00d0061cb617965b0db598fe4a625a16c78d0e2
SSDEEP 1572864:FqnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpr:FiLVelepClAy6uw3W0BEROh2nvvV
TLSH
T12108011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

359528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Faronics\morocco\Faronics_Hg\Deploy\Faronics-Deploy_CloudAgent\Source\bin\Release\FaronicsDeployAgent\Win32\FaronicsDeployAgent.pdb

comctl32

ord17

shell32

SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteExW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

crypt32

CryptStringToBinaryA CryptBinaryToStringA

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

kernel32

LocalAlloc LockResource DeviceIoControl FindNextFileW LocalFree SetFilePointer SetEndOfFile InterlockedDecrement ReadFile GetCurrentProcess LoadLibraryW GetUserDefaultLangID SetLastError GetVersionExW GetExitCodeProcess TerminateProcess IsWow64Process ExpandEnvironmentStringsW GetCurrentProcessId Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GlobalLock GlobalAlloc GlobalUnlock GetComputerNameExW GlobalFree GetWindowsDirectoryW CreateThread GetSystemDefaultLCID GetLocaleInfoW GetTimeZoneInformation MapViewOfFile UnmapViewOfFile CreateFileMappingW MoveFileExW GetSystemWindowsDirectoryW FindClose GetPrivateProfileStringW CopyFileW GetFileAttributesW WritePrivateProfileStringW GetTempPathW GetPrivateProfileIntW CreateEventW RemoveDirectoryW GetSystemInfo LoadResource LeaveCriticalSection EnterCriticalSection SystemTimeToFileTime FileTimeToSystemTime InterlockedCompareExchange InterlockedExchange GetProcessHeap WriteConsoleW SetStdHandle HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize IsValidCodePage GetOEMCP GetACP GetCurrentThreadId TlsFree TlsSetValue TlsGetValue GetProcAddress SizeofResource GetSystemDirectoryW GetModuleHandleW WaitForSingleObject CreateDirectoryW CreateProcessW CloseHandle GetLocalTime CreateFileW WriteFile DeleteFileW OutputDebugStringA MoveFileW GetLastError lstrlenW MultiByteToWideChar GetBinaryTypeW GetModuleFileNameW Sleep WideCharToMultiByte OutputDebugStringW FindFirstFileW TlsAlloc FlushFileBuffers GetConsoleMode GetConsoleCP FindResourceW InitializeCriticalSection FindResourceExW ExitProcess HeapDestroy HeapCreate IsProcessorFeaturePresent GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW HeapAlloc RtlUnwind RaiseException GetCPInfo GetStartupInfoW HeapSetInformation GetStringTypeW EncodePointer DecodePointer DeleteCriticalSection HeapFree GetSystemTimeAsFileTime GetCommandLineW InterlockedIncrement

user32

GetDesktopWindow EndDialog InvalidateRect LoadIconW PtInRect BeginPaint SetFocus GetClientRect DialogBoxParamW SetWindowPos GetWindowRect SetTimer SetWindowRgn EndPaint GetSystemMetrics ShowWindow SendMessageW SetWindowTextW MoveWindow wsprintfW MessageBoxExW ExitWindowsEx KillTimer

gdi32

SelectObject Rectangle CreateRoundRectRgn CreatePen CreateSolidBrush DeleteObject

advapi32

DeregisterEventSource RegCreateKeyExA ReportEventW RegOpenKeyExA RegisterEventSourceW RegCreateKeyA RegDeleteKeyW RegCreateKeyExW LookupAccountSidW ConvertStringSidToSidW RegQueryInfoKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken QueryServiceConfigW ControlService QueryServiceStatus StartServiceW OpenServiceW OpenSCManagerW CloseServiceHandle RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW

ole32

CreateStreamOnHGlobal CoInitializeEx CoSetProxyBlanket CLSIDFromProgID CoCreateInstance CoInitialize CoUninitialize

oleaut32

VariantTimeToSystemTime VarCmp SysStringByteLen VariantChangeType SysAllocStringByteLen SysStringLen SysFreeString VariantInit VariantClear SysAllocString VariantCopy

shlwapi

PathGetArgsW PathAddBackslashW StrTrimW PathRemoveFileSpecW StrStrIW PathUnquoteSpacesW PathQuoteSpacesW PathRemoveArgsW PathFileExistsW

winhttp

WinHttpSetCredentials WinHttpReadData WinHttpOpenRequest WinHttpOpen WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpSetOption WinHttpReceiveResponse WinHttpSendRequest

msi

ord119 ord163 ord17 ord160 ord20 ord158 ord125 ord115 ord32 ord118 ord8 ord92 ord159

gdiplus

GdiplusStartup GdipCreatePen1 GdipCreatePath GdipCloneImage GdipCreateFromHDC GdipCreateFontFamilyFromName GdipDrawString GdipDeletePath GdipCreateFont GdiplusShutdown GdipDeleteBrush GdipFree GdipDeletePen GdipCloneBrush GdipStartPathFigure GdipCreateBitmapFromStream GdipSetTextRenderingHint GdipDrawPath GdipDisposeImage GdipAlloc GdipDrawImageI GdipCreateSolidFill GdipAddPathArcI GdipDeleteFontFamily GdipAddPathLineI GdipClosePathFigure GdipSetSmoothingMode GdipDeleteGraphics GdipDeleteFont