265e9c9ff8103fc9c11d5e1af8c996c4cc30b5db47d98605c12983c559479191

Sharing

Copy URL Twitter E-mail

General

Target
265e9c9ff8103fc9c11d5e1af8c996c4cc30b5db47d98605c12983c559479191
Size 3.7MB
Sample260723-nbc98a1ves
SHA256 265e9c9ff8103fc9c11d5e1af8c996c4cc30b5db47d98605c12983c559479191
MD5 e5fe8ef5470459b23335c486a3f5da5c
SHA1 5d1aac667bc81fd8a9f23222821539a8cc0dc439
SHA512 98ef12f095e9c625c3634972232eb478dea8208cd261d83b6665b1d3266efa6a34a7d199b6a7640f202555c53190c7ccb4bfb0d65c33bafeeeaf2af9357d64e4
SSDEEP 49152:NWk2nQAVAWnrIyJtJTvOnKQeWipPh2g3tbUcPQco1qg6ZcTty4Mh+ZFDrr8DAHx0:NW9nQAC4IyJXOnJCdbJNo0x1h+DrCd
TLSH
T188067D207A47CA7BD64202B1096CEE5F115DAA240F6154C7E3DC0F6EA9F4AD31E32D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
265e9c9ff8103fc9c11d5e1af8c996c4cc30b5db47d98605c12983c559479191

File Explorer

265e9c9ff8103fc9c11d5e1af8c996c4cc30b5db47d98605c12983c559479191

.exe 3.7MB

265e9c9ff8103fc9c11d5e1af8c996c4cc30b5db47d98605c12983c559479191

IMPHASH 8385f63dd750cba128057f27651b17dc
SHA256 265e9c9ff8103fc9c11d5e1af8c996c4cc30b5db47d98605c12983c559479191
MD5 e5fe8ef5470459b23335c486a3f5da5c
SHA1 5d1aac667bc81fd8a9f23222821539a8cc0dc439
SHA512 98ef12f095e9c625c3634972232eb478dea8208cd261d83b6665b1d3266efa6a34a7d199b6a7640f202555c53190c7ccb4bfb0d65c33bafeeeaf2af9357d64e4
SSDEEP 49152:NWk2nQAVAWnrIyJtJTvOnKQeWipPh2g3tbUcPQco1qg6ZcTty4Mh+ZFDrr8DAHx0:NW9nQAC4IyJXOnJCdbJNo0x1h+DrCd
TLSH
T188067D207A47CA7BD64202B1096CEE5F115DAA240F6154C7E3DC0F6EA9F4AD31E32D6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2153353

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\RhinoProtect\Publish\OutPut\Bin\Win32\release\pdb\Uninstall.pdb

crypt32

CertFindCertificateInStore CertFreeCertificateContext CryptMsgClose CryptDecodeObject CertCloseStore CryptQueryObject CryptMsgGetParam CertGetNameStringW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

advapi32

CreateServiceW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW DeregisterEventSource RegisterEventSourceW QueryServiceStatusEx RegDeleteKeyW QueryServiceStatus ChangeServiceConfig2W ControlService StartServiceW ReportEventW OpenServiceW RegOpenKeyExW RegSetValueExW DeleteService OpenSCManagerW CloseServiceHandle RegCloseKey GetTokenInformation FreeSid OpenProcessToken SetNamedSecurityInfoW LookupPrivilegeNameW SetEntriesInAclW AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW RegOpenKeyW RegCreateKeyExW

kernel32

ReleaseMutex ReleaseSemaphore SetProcessAffinityMask GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateFileW GetModuleHandleExW SignalObjectAndWait CreateTimerQueue WriteFile DuplicateHandle MapViewOfFile OpenFileMappingW LocalAlloc GetPrivateProfileStringW VirtualQuery GetLogicalDriveStringsW GetEnvironmentVariableW GetModuleFileNameW RaiseException CloseHandle GetLastError QueryDosDeviceW GetExitCodeProcess FreeLibrary GetModuleHandleW CreateProcessW GetProcessHeap LocalFree GetProcAddress HeapAlloc CreateDirectoryExW CopyFileExW MoveFileWithProgressW RemoveDirectoryW FileTimeToLocalFileTime GetNativeSystemInfo FileTimeToSystemTime LoadLibraryW OpenProcess WaitForSingleObject Sleep WaitForMultipleObjects HeapFree GetTickCount DeleteFileW SetFileAttributesW GetCurrentProcessId DeleteCriticalSection WaitNamedPipeW IsBadReadPtr GetOverlappedResult GetExitCodeThread PeekNamedPipe lstrcpynW OpenThread SetThreadContext GetThreadContext CreateToolhelp32Snapshot SuspendThread Thread32First Thread32Next MoveFileExW WriteConsoleW HeapSize SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA WaitForSingleObjectEx FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx HeapReAlloc GetCurrentThread SetConsoleCtrlHandler ExitProcess GetModuleFileNameA FreeLibraryAndExitThread ExitThread InterlockedFlushSList RtlUnwind GetFileType GetStdHandle GetLocalTime LoadLibraryExA VirtualFree VirtualAlloc InterlockedPushEntrySList InterlockedPopEntrySList OutputDebugStringW FlushInstructionCache HeapDestroy HeapCreate OutputDebugStringA VirtualProtect CreateThread DisableThreadLibraryCalls GetModuleHandleA MapViewOfFileEx CreateFileMappingW UnmapViewOfFile QueryPerformanceFrequency GlobalUnlock GlobalLock FreeResource CancelWaitableTimer CreateWaitableTimerW SetWaitableTimer MulDiv lstrcmpW InterlockedIncrement InterlockedDecrement SizeofResource GetStartupInfoW IsDebuggerPresent InitializeSListHead QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetStringTypeW EncodePointer GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread FormatMessageW DeviceIoControl GetFileSizeEx MoveFileW GetTempFileNameW CopyFileW SetCurrentDirectoryW GetWindowsDirectoryW GetCurrentDirectoryW GetSystemDirectoryW GetFullPathNameW CreateDirectoryW CreateMutexW SetErrorMode InitializeCriticalSectionAndSpinCount GetCurrentProcess GetTempPathW QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx WritePrivateProfileStringW InterlockedCompareExchange DecodePointer GetComputerNameW ReadFile SetFilePointer SetEndOfFile GetFileSize SetEvent lstrlenW InterlockedExchange InterlockedExchangeAdd SetLastError GlobalMemoryStatusEx GetFileAttributesW ExpandEnvironmentStringsW GetVersionExW GetDriveTypeW FindFirstFileW GetLongPathNameW GetShortPathNameW GetFileAttributesExW SearchPathW LockResource GetSystemInfo LoadResource FindResourceW lstrcmpiW lstrcatW lstrcpyW ResumeThread TerminateProcess OpenEventW CreateEventW ResetEvent GetVolumeInformationW GetDiskFreeSpaceW GetCurrentThreadId GetComputerNameExW GlobalAlloc GlobalFree LoadLibraryExW LoadLibraryA WideCharToMultiByte TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetACP MultiByteToWideChar FindNextFileW FindClose LocalFileTimeToFileTime SystemTimeToFileTime GetSystemTime DosDateTimeToFileTime FileTimeToDosDateTime OpenMutexW SetFileTime GetFileTime RtlCaptureStackBackTrace

user32

CallWindowProcW DestroyWindow EndDialog LoadIconW SetWindowLongW DefWindowProcW UnregisterClassW GetActiveWindow GetWindowLongW FindWindowExW SendMessageW WaitForInputIdle wsprintfW GetPropW RemovePropW GetForegroundWindow SetPropW GetUserObjectInformationW GetProcessWindowStation GetAsyncKeyState GetFocus LoadStringW DestroyAcceleratorTable CreateAcceleratorTableW EnumThreadWindows RegisterWindowMessageW GetAncestor EmptyClipboard SetClipboardData CloseClipboard GetClipboardData IsClipboardFormatAvailable GetSysColor GetIconInfo DrawIconEx GetSystemMetrics GetKeyboardState GetCaretBlinkTime ToAscii SetForegroundWindow GetDesktopWindow SetCaretPos SetRectEmpty FillRect UpdateLayeredWindow SetRect LoadBitmapW LoadImageW AttachThreadInput SystemParametersInfoW MsgWaitForMultipleObjects UnionRect PtInRect GetClassLongW RegisterClassExW GetClassInfoExW GetWindowThreadProcessId GetWindowTextLengthW SetScrollInfo DeferWindowPos GetLastActivePopup GetSystemMenu AdjustWindowRectEx SetWindowWord ShowScrollBar GetUpdateRgn ShowWindowAsync GetWindow DlgDirListW GetMenu GetDC IsWindowVisible SetClipboardViewer MessageBoxW DialogBoxParamW SetWindowTextW CharNextW IsWindow PostMessageW PostQuitMessage TranslateMessage PeekMessageW DispatchMessageW GetMessageW GetCursorPos ReleaseDC IsIconic GetDCEx InvalidateRect GetParent IsZoomed GetClientRect SetCursor GetWindowDC LoadCursorW IntersectRect IsRectEmpty ClientToScreen CopyRect RedrawWindow OffsetRect CreateWindowExW EnumChildWindows EqualRect SetWindowPos GetWindowRect ReleaseCapture SetCapture TrackMouseEvent ScreenToClient GetKeyState GetWindowTextW EnableWindow GetWindowContextHelpId GetWindowRgn EndPaint GetNextDlgTabItem BeginPaint ChildWindowFromPoint UpdateWindow IsWindowUnicode ScrollWindow SetDlgItemInt SetScrollPos GetNextDlgGroupItem CheckDlgButton KillTimer ShowCaret HiliteMenuItem GetDlgItem SetScrollRange GetDlgItemInt EnableScrollBar DlgDirSelectComboBoxExW DrawMenuBar SetParent GetClassNameW ScrollWindowEx SetWindowContextHelpId GetUpdateRect BringWindowToTop SendNotifyMessageW SetFocus LockWindowUpdate FlashWindow WinHelpW IsDlgButtonChecked SetMenu MoveWindow IsWindowEnabled GetTopWindow DlgDirListComboBoxW DlgDirSelectExW SendDlgItemMessageW GetWindowWord GetDlgItemTextW ValidateRect SetWindowPlacement MapWindowPoints SetDlgItemTextW CreateCaret IsChild GetDlgCtrlID GetMonitorInfoW ChangeClipboardChain GetScrollRange IsDialogMessageW SetTimer OpenClipboard InvalidateRgn ShowWindow GetWindowPlacement GetScrollPos GetScrollInfo ChildWindowFromPointEx ArrangeIconicWindows ShowOwnedPopups HideCaret SetWindowRgn ValidateRgn SetActiveWindow MonitorFromWindow CheckRadioButton

gdi32

CreateFontIndirectW GetRgnBox DeleteObject SetViewportOrgEx CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt GetObjectW GetStockObject EnumFontsW CreatePolygonRgn CreateRectRgnIndirect SetWorldTransform SetGraphicsMode GetDeviceCaps CreateSolidBrush SetBkColor SetTextColor GetClipBox PtInRegion CreateRoundRectRgn CreateDIBSection GetDIBits CreateDCW ExtTextOutW DeleteDC

shell32

SHGetSpecialFolderPathW SHGetFolderPathW DragQueryFileW DragFinish DragAcceptFiles ShellExecuteW ord155 ord190 SHChangeNotify

ole32

CoInitializeEx PropVariantClear OleLockRunning CLSIDFromString CLSIDFromProgID StringFromGUID2 CoInitialize CoGetClassObject CreateStreamOnHGlobal CoTaskMemRealloc CoCreateInstance CoTaskMemAlloc CoTaskMemFree OleUninitialize CoUninitialize OleInitialize

oleaut32

VarUI4FromStr SysAllocString VariantClear SysAllocStringLen SysStringLen DispCallFunc OleCreateFontIndirect LoadTypeLi VariantInit LoadRegTypeLi SysFreeString

shlwapi

PathRemoveFileSpecW SHStrDupW StrDupW PathAppendW PathFindFileNameW StrToIntA ord12

comctl32

_TrackMouseEvent InitCommonControlsEx

msimg32

AlphaBlend

urlmon

CoInternetCreateZoneManager CoInternetCreateSecurityManager

psapi

GetModuleFileNameExW GetMappedFileNameW GetProcessImageFileNameW

imm32

ImmSetCompositionWindow ImmGetCompositionStringW ImmAssociateContextEx ImmNotifyIME ImmReleaseContext ImmGetContext

gdiplus

GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdipCloneBitmapAreaI GdipGetImagePixelFormat GdipSetStringFormatFlags GdipCloneRegion GdipGetFamilyName GdipDeleteMatrix GdipDrawImageRectRectI GdipSetStringFormatAlign GdipCreatePen1 GdipDeletePen GdipTranslateWorldTransform GdipGetFontSize GdipDeleteFont GdipDeleteStringFormat GdipDeleteGraphics ord1 GdipFillRectangleI GdipGetImageGraphicsContext GdipDeleteRegion GdipMeasureString GdipCloneBrush GdipRestoreGraphics GdipRotateWorldTransform GdipStringFormatGetGenericTypographic GdipGetCellAscent GdipSetTextRenderingHint GdipCloneStringFormat GdipGetMatrixElements GdipGetTextureTransform GdipCreateTexture GdipBeginContainer2 GdipFillEllipse GdipCreateFromHDC GdipGetClipBoundsI GdipSetImageAttributesWrapMode GdipDrawString GdipDrawPath GdipSetClipRegion GdipCreateImageAttributes GdipDrawArcI GdipGetSmoothingMode GdipClosePathFigure GdipSetClipRectI GdipScaleWorldTransform GdipSetPixelOffsetMode GdipDrawRectangle GdipCreateBitmapFromScan0 GdipSetPenDashStyle GdipGraphicsClear GdipMultiplyWorldTransform GdipGetPathWorldBounds GdipFillPath GdipTransformRegion GdipAlloc GdipCreateBitmapFromStreamICM GdipDisposeImage GdipFree GdipImageSelectActiveFrame GdipBitmapLockBits GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetImageWidth GdipGetPropertyItemSize GdiplusStartup GdipSetStringFormatTrimming GdipGetFontStyle GdipCreateSolidFill GdipCloneBitmapArea GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipCloneImage GdipGetCellDescent GdipSetInterpolationMode GdipSetLinePresetBlend GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipEndContainer GdipSetSmoothingMode GdipCreateMatrix GdipGetStringFormatAlign GdipDeletePath GdipDisposeImageAttributes GdipCreateMatrix2 GdipDeleteBrush GdipGetLineSpacing GdipSetLineWrapMode GdipBitmapUnlockBits GdipGetPropertyItem GdipCreateHBITMAPFromBitmap GdipSetCompositingMode GdipSetTextureTransform GdipSetLineTransform GdipGetBrushType GdipCombineRegionRegion GdipAddPathRectangleI GdipAddPathArcI GdipAddPathEllipseI GdipCombineRegionPath GdipAddPathBezierI GdipDrawLine GdipAddPathLineI GdipCreateLineBrushI GdipDrawImageRectRect GdipSaveGraphics GdipCreateFontFamilyFromName GdipGetEmHeight GdipGetStringFormatLineAlign GdipAddPathString GdipGetTextRenderingHint GdipGetFamily GdipSetCompositingQuality GdipSetImageAttributesColorMatrix GdipGetLineTransform GdipDeleteFontFamily GdipGetInterpolationMode GdipCreateRegionPath GdipCreateBitmapFromStream

winmm

timeGetTime

generic

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=27, id=241, version=40116,

count=168, id=243, version=40116,

count=35, id=242, version=40116,

count=2, productName=Unmarked objects (old),

count=3, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,

count=9, id=260, version=27035,

count=30, id=259, version=26706,

count=131, id=261, version=26706,

count=38, id=260, version=26706,

count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=671, id=1, productName=Unmarked objects,

count=6, id=261, productName=VS2017 v15.9.5 build 27026, version=27026,

count=295, id=265, version=27054,

count=1, id=255, version=27054,

count=2, id=151,

count=1, id=258, version=27054,