aedf68bdbb23f8def4ab5abfce1f0735878e061c50e4f18c21daf834864fb4ef

General

Target
aedf68bdbb23f8def4ab5abfce1f0735878e061c50e4f18c21daf834864fb4ef
Size 2.6MB
Sample260724-rphnmsgh39
SHA256 aedf68bdbb23f8def4ab5abfce1f0735878e061c50e4f18c21daf834864fb4ef
MD5 028f137d09b3dd73f089aa0e9a5dfb5b
SHA1 da31bdecfc759a54327fb181adf77f73d1dd5d2d
SHA512 aca30747a8a1e044d841bc7e9f367357390933e356200e268334c15f57990523ef3bdfcc133dae9e5d57ff3de0d14038a7293ed50a4253a9c1ef944f5b169c52
SSDEEP 24576:b6+XbZGQ2kxIwdgKdUtOGd6RI7DZGXyVHDMKrzwi3xhzm3qWtWitx:u+LW6FdgHtBdqI7EX6V3xhzm3DUS
TLSH
T19CC5CF07F26681F8C1BB8038C9536A6BE631380647615BDF1BD4D76A3E33BE14A7A351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aedf68bdbb23f8def4ab5abfce1f0735878e061c50e4f18c21daf834864fb4ef

File Explorer

aedf68bdbb23f8def4ab5abfce1f0735878e061c50e4f18c21daf834864fb4ef

.dll 2.6MB

aedf68bdbb23f8def4ab5abfce1f0735878e061c50e4f18c21daf834864fb4ef

IMPHASH a28dcfe7cedf142575ed4deb33ed6a69
SHA256 aedf68bdbb23f8def4ab5abfce1f0735878e061c50e4f18c21daf834864fb4ef
MD5 028f137d09b3dd73f089aa0e9a5dfb5b
SHA1 da31bdecfc759a54327fb181adf77f73d1dd5d2d
SHA512 aca30747a8a1e044d841bc7e9f367357390933e356200e268334c15f57990523ef3bdfcc133dae9e5d57ff3de0d14038a7293ed50a4253a9c1ef944f5b169c52
SSDEEP 24576:b6+XbZGQ2kxIwdgKdUtOGd6RI7DZGXyVHDMKrzwi3xhzm3qWtWitx:u+LW6FdgHtBdqI7EX6V3xhzm3DUS
TLSH
T19CC5CF07F26681F8C1BB8038C9536A6BE631380647615BDF1BD4D76A3E33BE14A7A351
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1122844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\academe_Jenkins\workspace\Academe-cci-Pipeline@2\65369\project\windows\x64\Release\AudioIntercom.pdb

winmm

mciGetErrorStringA timeEndPeriod waveOutGetNumDevs waveOutGetDevCapsA mciSendCommandA timeBeginPeriod

kernel32

ExitProcess SetEnvironmentVariableA WriteConsoleW GetStringTypeW OutputDebugStringW SetStdHandle HeapReAlloc Sleep FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryExA LoadLibraryA CreateFileA CreateFileW SetEndOfFile SetFilePointerEx CloseHandle GetLocalTime MapViewOfFile UnmapViewOfFile CreateFileMappingA MultiByteToWideChar IsBadReadPtr IsBadWritePtr SetThreadPriority WaitForSingleObject InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW EncodePointer DecodePointer RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetSystemTimeAsFileTime GetLastError HeapFree HeapAlloc WideCharToMultiByte ReadFile GetCommandLineA GetCurrentThreadId CreateThread ExitThread LoadLibraryExW IsDebuggerPresent IsProcessorFeaturePresent CreateDirectoryW GetModuleHandleExW AreFileApisANSI HeapSize GetConsoleMode ReadConsoleW SetLastError GetCurrentThread GetProcessHeap GetStdHandle WriteFile GetModuleFileNameW IsValidCodePage GetACP GetOEMCP GetCPInfo GetTimeZoneInformation GetFileType GetStartupInfoW FlushFileBuffers GetConsoleCP FatalAppExitA QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount CreateEventW GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount GetModuleHandleW CreateSemaphoreW SetConsoleCtrlHandler GetDateFormatW GetTimeFormatW CompareStringW

ole32

CoCreateInstance PropVariantClear CoInitialize CoUninitialize

AUDIOCOM_AudFileParamParse AUDIOCOM_CloseFile AUDIOCOM_ControlSound AUDIOCOM_CreateCaptureHandle AUDIOCOM_CreateCaptureHandleEx AUDIOCOM_CreateInterComHandle AUDIOCOM_CreatePlayFileHandle AUDIOCOM_CreatePlayHandle AUDIOCOM_CreatePlayHandleEx AUDIOCOM_DestroyPlayFileHandle AUDIOCOM_FilePlayGetVolume AUDIOCOM_FilePlaySetVolume AUDIOCOM_GetAgcParam AUDIOCOM_GetAlcParam AUDIOCOM_GetCaptureDeviceNum AUDIOCOM_GetDyComLoadStatus AUDIOCOM_GetEncodeOneFreamPcmLen AUDIOCOM_GetFileTime AUDIOCOM_GetLastError AUDIOCOM_GetMuxGlobalSystemTime AUDIOCOM_GetOneCaptureDeviceName AUDIOCOM_GetOnePlayDeviceName AUDIOCOM_GetOneSoundCardInfo AUDIOCOM_GetPlayBufferRemian AUDIOCOM_GetPlayDeviceNum AUDIOCOM_GetPlayedTime AUDIOCOM_GetSoundCardNum AUDIOCOM_GetVersion AUDIOCOM_GetVolume AUDIOCOM_InputStreamData AUDIOCOM_LoadAPMDLL AUDIOCOM_LoadAuRenderDLL AUDIOCOM_LoadAudioDLL AUDIOCOM_OpenAgc AUDIOCOM_OpenAlc AUDIOCOM_OpenFile AUDIOCOM_OpenHIKAEC AUDIOCOM_OpenPureAudioFile AUDIOCOM_OpenStream AUDIOCOM_OpenStreamEx AUDIOCOM_PauseSound AUDIOCOM_PlaySound AUDIOCOM_RegisterAdditionDataCallBack AUDIOCOM_RegisterAudioPlayDBCallBack AUDIOCOM_RegisterCaptureDataCallBack AUDIOCOM_RegisterCaptureDataCallBackEx AUDIOCOM_RegisterDecodeDataCallBack AUDIOCOM_RegisterDecodeDataCallBackEx AUDIOCOM_RegisterDevStateChangedCallBack AUDIOCOM_RegisterOutputDataCallBack AUDIOCOM_RegisterOutputDataCallBackEx AUDIOCOM_RegisterTimeFreqInfoCB AUDIOCOM_ReleaseCaptureHandle AUDIOCOM_ReleaseInterComHandle AUDIOCOM_ReleasePlayHandle AUDIOCOM_SetANRParam AUDIOCOM_SetAecDelayLen AUDIOCOM_SetAgcParam AUDIOCOM_SetAlcParam AUDIOCOM_SetCaptureStatus AUDIOCOM_SetFilePlayEndCallBack AUDIOCOM_SetFileRefCallBack AUDIOCOM_SetHSParam AUDIOCOM_SetLogFlag AUDIOCOM_SetMCIOperator AUDIOCOM_SetPlayEngine AUDIOCOM_SetPlayStatus AUDIOCOM_SetPlayedTime AUDIOCOM_SetVolume AUDIOCOM_SetWriteFileSwitch AUDIOCOM_StartCapture AUDIOCOM_StartPlay AUDIOCOM_StopCapture AUDIOCOM_StopPlay AUDIOCOM_StopSound AUDIOCOM_UnLoadAPMDLL AUDIOCOM_UnLoadAuRenderDLL AUDIOCOM_UnLoadAudioDLL AUDIOCOM_WriteCapFile hik_opus_decoder_get_size hik_opus_encoder_ctl hik_opus_encoder_get_size hik_opus_encoder_init hik_opus_repacketizer_init opus_decoder_init opus_packet_get_bandwidth opus_packet_get_nb_channels opus_packet_get_nb_frames opus_packet_get_samples_per_frame opus_repacketizer_cat_1

generic

count=2, id=199, version=41118,

count=60, id=225, version=20806,

count=164, id=224, version=20806,

count=32, id=223, version=20806,

count=1, id=207, version=65501,

count=1, id=206, version=65501,

count=4, id=203, version=65501,

count=3, id=260, version=27045,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=111, id=1, productName=Unmarked objects,

count=132, id=206, productName=VS2012 build 50727, version=50727,

count=27, id=132, productName=VS2008 build 21022, version=21022,

count=49, id=228, version=40629,

count=134, id=131, productName=VS2008 build 21022, version=21022,

count=43, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,

Sharing

General

Malware Config

Signatures

File Explorer

aedf68bdbb23f8def4ab5abfce1f0735878e061c50e4f18c21daf834864fb4ef

winmm

kernel32

ole32

generic