eService Free Temp[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
eService Free Temp.exe
Size 895KB
Sample260727-yan1fach85
SHA256 3d364ee5d54a242ce0a4817f366b461c34c7a6896eda12e22b68ad3c0c525ff4
MD5 1553f14bfc426970331bd3b732d8aead
SHA1 4881feb426f3a3e85ce8e8ddd3260ffa1e3be026
SHA512 fab0cebfd0b9ec9fdfec91817a74a35f048c2e3240e355553ec9e1893087e1bd797fa264e044d5fae6ad7ffbef3a531bb2685b48bc30e7a36fbee59900dea7bc
SSDEEP 24576:CFXvgLycE9Ks3pkYzhuGKFRnErvwNO5dL9iLz:a4JE9KwiNnKwQ5niLz
TLSH
T1AD15E195F3E440F9E067607AC466A707FBB57C4507208BDB33E406652FE71A24EAE352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eService Free Temp.exe

File Explorer

eService Free Temp.exe

.exe 895KB

eService Free Temp.exe

IMPHASH 3903e1790fea246cb0c6535eb6fd1c8c
SHA256 3d364ee5d54a242ce0a4817f366b461c34c7a6896eda12e22b68ad3c0c525ff4
MD5 1553f14bfc426970331bd3b732d8aead
SHA1 4881feb426f3a3e85ce8e8ddd3260ffa1e3be026
SHA512 fab0cebfd0b9ec9fdfec91817a74a35f048c2e3240e355553ec9e1893087e1bd797fa264e044d5fae6ad7ffbef3a531bb2685b48bc30e7a36fbee59900dea7bc
SSDEEP 24576:CFXvgLycE9Ks3pkYzhuGKFRnErvwNO5dL9iLz:a4JE9KwiNnKwQ5niLz
TLSH
T1AD15E195F3E440F9E067607AC466A707FBB57C4507208BDB33E406652FE71A24EAE352
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

268072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VerifyVersionInfoW QueryPerformanceCounter FindFirstFileA TerminateProcess WaitForMultipleObjects FindNextFileA FindClose WaitForSingleObject GetModuleHandleA Sleep GetSystemDirectoryA DeleteFileA CloseHandle CreateThread SetFileAttributesA RemoveDirectoryA CreateProcessA CreateDirectoryA GetTickCount SetEndOfFile WriteConsoleW HeapReAlloc HeapSize CreateFileW GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW GetModuleHandleW GetFileSizeEx GetConsoleOutputCP FlushFileBuffers LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx WriteFile GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GlobalUnlock WideCharToMultiByte GlobalLock ExitThread ReadFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GlobalFree GlobalAlloc FindFirstFileExW MultiByteToWideChar DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError GetLastError ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WaitForSingleObjectEx GetExitCodeThread TryAcquireSRWLockExclusive InitializeCriticalSectionEx RtlUnwindEx RtlPcToFileHeader RaiseException

user32

CloseClipboard OpenClipboard GetClipboardData ReleaseDC SetCursorPos IsIconic SetForegroundWindow EmptyClipboard SetClipboardData GetCursorPos ReleaseCapture GetWindowRect SetWindowRgn GetSystemMetrics DispatchMessageW PeekMessageW MessageBoxA TranslateMessage PostQuitMessage UpdateWindow GetWindowLongW DefWindowProcW AdjustWindowRectEx GetKeyState DestroyWindow GetDC SetWindowPos MonitorFromWindow EnumDisplayMonitors CreateWindowExW ScreenToClient UnregisterClassW SetWindowTextW RegisterClassExW WindowFromPoint ShowWindow GetCapture GetMonitorInfoW ClientToScreen IsChild GetForegroundWindow SetLayeredWindowAttributes SetFocus BringWindowToTop LoadCursorW SetCapture SetCursor SetWindowLongW GetClientRect

gdi32

CreateRoundRectRgn GetDeviceCaps

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA ShellExecuteExA

ole32

CoInitialize CoUninitialize

xinput1_3

ord4 ord2

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemory

urlmon

URLDownloadToFileA

Name

.text

Size

393KB

Virtual Size

393KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

231KB

Virtual Size

231KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

249KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

eService Free Temp.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

xinput1_3

imm32

d3d9

d3dx9_43

urlmon

generic