bb3178c3cdb56f47489de436dd98bdffd53674dc2a17eaf03abed301e221c7c9

General

Target
bb3178c3cdb56f47489de436dd98bdffd53674dc2a17eaf03abed301e221c7c9
Size 1.3MB
Sample260723-h2lrdsysft
SHA256 bb3178c3cdb56f47489de436dd98bdffd53674dc2a17eaf03abed301e221c7c9
MD5 dca3e74a331d1362ded75d555c67cd09
SHA1 6fed26aa37651147729e23da8b32f605998826a6
SHA512 0ef386bd1792da23b0d7d7fce9aec9647641d02dc3d2dc396911de29cb380885dba1ad89fa2e94167b14b2a1ff8dea7c34aa3a1ed6546bb5a0b4dae4dc2925e3
SSDEEP 12288:vG0gZEnwOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vG0MEnxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A4551257B1C59072E872093581B4E5699C2FFD225F208DA73B8626BE9FB04D08E39D37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb3178c3cdb56f47489de436dd98bdffd53674dc2a17eaf03abed301e221c7c9

File Explorer

bb3178c3cdb56f47489de436dd98bdffd53674dc2a17eaf03abed301e221c7c9

.exe 1.3MB

bb3178c3cdb56f47489de436dd98bdffd53674dc2a17eaf03abed301e221c7c9

IMPHASH 84d3c70447dcf330371806d21febf1b6
SHA256 bb3178c3cdb56f47489de436dd98bdffd53674dc2a17eaf03abed301e221c7c9
MD5 dca3e74a331d1362ded75d555c67cd09
SHA1 6fed26aa37651147729e23da8b32f605998826a6
SHA512 0ef386bd1792da23b0d7d7fce9aec9647641d02dc3d2dc396911de29cb380885dba1ad89fa2e94167b14b2a1ff8dea7c34aa3a1ed6546bb5a0b4dae4dc2925e3
SSDEEP 12288:vG0gZEnwOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vG0MEnxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A4551257B1C59072E872093581B4E5699C2FFD225F208DA73B8626BE9FB04D08E39D37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5208

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\home\jenkins\agent\workspace\s_TANG_Software_TVSU_TVSU_master\tvsu\Output\ConfigService.pdb

shlwapi

StrStrIW

kernel32

SetUnhandledExceptionFilter WriteConsoleW ExitProcess CloseHandle UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle WriteFile GetModuleFileNameW DecodePointer GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx CreateFileW

advapi32

EventWrite CloseServiceHandle EventRegister OpenServiceW EventUnregister OpenSCManagerW ChangeServiceConfig2W

Sharing

General

Malware Config

Signatures

File Explorer

bb3178c3cdb56f47489de436dd98bdffd53674dc2a17eaf03abed301e221c7c9

shlwapi

kernel32

advapi32

generic