929543e30a49f0ae8709954b9bb551f03cfee0b8c75bdc93e735d75c80e67351

Sharing

Copy URL Twitter E-mail

General

Target
929543e30a49f0ae8709954b9bb551f03cfee0b8c75bdc93e735d75c80e67351
Size 4.2MB
Sample260801-mgxelshc42
SHA256 929543e30a49f0ae8709954b9bb551f03cfee0b8c75bdc93e735d75c80e67351
MD5 125d4103ae8ae47dd210331a991d211d
SHA1 f3af774e4edd6f2b002fc88ce89f9f1a05e4a365
SHA512 4e21057fa82de8e22aa115a82f110fd1a740e87995781ff6c025459e22f58d51841d20d9f6162ab9da6c8453a291879345c2f4670c1c66a5ce2d33e1e0452c90
SSDEEP 98304:78OMeY5tYYszAVALvpeGurBtXwZwn6gU023W:7jMeUtYYszAVALvcFp4W
TLSH
T1C6268E603686C135D66211BA4EBDBFBB8C1DA8251BB051CB92D58F6E28311D32F35F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
929543e30a49f0ae8709954b9bb551f03cfee0b8c75bdc93e735d75c80e67351

File Explorer

929543e30a49f0ae8709954b9bb551f03cfee0b8c75bdc93e735d75c80e67351

.exe 4.2MB

929543e30a49f0ae8709954b9bb551f03cfee0b8c75bdc93e735d75c80e67351

IMPHASH 8976d8d03da8a522c6b40328f9ee2d0f
SHA256 929543e30a49f0ae8709954b9bb551f03cfee0b8c75bdc93e735d75c80e67351
MD5 125d4103ae8ae47dd210331a991d211d
SHA1 f3af774e4edd6f2b002fc88ce89f9f1a05e4a365
SHA512 4e21057fa82de8e22aa115a82f110fd1a740e87995781ff6c025459e22f58d51841d20d9f6162ab9da6c8453a291879345c2f4670c1c66a5ce2d33e1e0452c90
SSDEEP 98304:78OMeY5tYYszAVALvpeGurBtXwZwn6gU023W:7jMeUtYYszAVALvcFp4W
TLSH
T1C6268E603686C135D66211BA4EBDBFBB8C1DA8251BB051CB92D58F6E28311D32F35F1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2040176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\buildagent-cd_8818\p4\989747040\services\AMTSW\Release\UNS\Release\lms.pdb

kernel32

GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW MultiByteToWideChar GetFileSizeEx SetEnvironmentVariableW SetStdHandle FindFirstFileExW IsValidCodePage LocalAlloc LocalFree FormatMessageW GetOEMCP GetFullPathNameW FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW VirtualQuery VirtualProtect GetCommandLineA VirtualAlloc GetModuleHandleExW FreeEnvironmentStringsW RtlUnwind GetCurrentDirectoryW SetConsoleCtrlHandler GetConsoleMode ReadConsoleW GetConsoleOutputCP HeapSize HeapReAlloc LCMapStringW lstrcmpiW FindResourceW GetDateFormatW WriteConsoleW LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary GetCurrentThreadId GetCurrentThread GetTimeFormatW OutputDebugStringW GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx GetLocaleInfoEx LCMapStringEx EncodePointer GetStringTypeW WaitForSingleObjectEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetFileInformationByHandle WaitForMultipleObjects WaitForMultipleObjectsEx QueryPerformanceFrequency SizeofResource CompareStringW GetTimeZoneInformation ExpandEnvironmentStringsW GetComputerNameExW WideCharToMultiByte CreateFileW GetFinalPathNameByHandleW LoadLibraryW CreateThread GetCurrentProcess CreateEventW lstrlenW WaitForSingleObject SetEvent DeleteCriticalSection IsWow64Process VerSetConditionMask OutputDebugStringA VerifyVersionInfoW GetSystemPowerStatus QueryPerformanceCounter GetComputerNameA GetSystemInfo GetACP GetCurrentProcessId InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapAlloc HeapFree GetProcessHeap GetSystemDefaultLCID GetSystemTime SetFilePointer SetEndOfFile CreateFileA CancelIo ReadFile WriteFile DeviceIoControl GetOverlappedResult InitializeCriticalSectionAndSpinCount FlushFileBuffers GlobalFree GlobalAlloc SetLastError InitializeCriticalSection TryEnterCriticalSection SetThreadPriority ResumeThread GetLastError RaiseException CloseHandle DuplicateHandle TlsAlloc TlsGetValue TlsSetValue TlsFree RegisterWaitForSingleObject UnregisterWait GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA LoadLibraryA TerminateProcess GetStdHandle DecodePointer GetCommandLineW SetDllDirectoryW Sleep ResetEvent ReleaseSemaphore ReleaseMutex CreateMutexW CreateEventA CreateSemaphoreW GetExitCodeThread SuspendThread GetThreadId GetSystemTimeAsFileTime FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetEnvironmentStringsW ExitProcess GetVersionExW LockFileEx SetFilePointerEx UnlockFileEx LoadLibraryExA

advapi32

RegCreateKeyW InitiateSystemShutdownExW LookupPrivilegeValueW AdjustTokenPrivileges SetEntriesInAclW RegSetKeySecurity RegDeleteKeyExW SetSecurityDescriptorDacl FreeSid AllocateAndInitializeSid ChangeServiceConfig2W CloseServiceHandle OpenProcessToken OpenThreadToken ControlService CreateServiceW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW CopySid GetLengthSid GetTokenInformation InitializeSecurityDescriptor IsValidSid SetSecurityDescriptorGroup SetSecurityDescriptorOwner RegCreateKeyExW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey ConvertSidToStringSidW LookupAccountSidW EqualSid CreateWellKnownSid StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW OpenServiceW OpenSCManagerW DeleteService ChangeServiceConfigW

user32

GetMessageW CharUpperW CharNextW PostThreadMessageW UnregisterDeviceNotification TranslateMessage LoadStringW DispatchMessageW RegisterDeviceNotificationW MessageBoxW

ole32

CoUninitialize CoCreateInstance StringFromGUID2 CoInitializeEx CoResumeClassObjects CoTaskMemFree CoAddRefServerProcess CoRegisterClassObject CoTaskMemAlloc PropVariantClear CoImpersonateClient CoRevertToSelf CoReleaseServerProcess CoRevokeClassObject CoTaskMemRealloc CoSetProxyBlanket CoInitializeSecurity

oleaut32

SysAllocStringByteLen SysStringByteLen VariantClear VariantChangeType VariantInit SysAllocString SysFreeString SysStringLen VarUI4FromStr LoadTypeLi RegisterTypeLi UnRegisterTypeLi VarBstrCat LoadRegTypeLi SafeArrayCreate SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SafeArrayUnlock SafeArrayPutElement SafeArrayCreateVector SysAllocStringLen

iphlpapi

IpRenewAddress GetInterfaceInfo GetPerAdapterInfo GetAdaptersInfo GetIpAddrTable CancelIPChangeNotify NotifyRouteChange CancelMibChangeNotify2 NotifyIpInterfaceChange GetAdaptersAddresses SetTcpEntry GetExtendedTcpTable

cfgmgr32

CM_Get_Device_Interface_ListA CM_Get_Device_Interface_List_SizeA

crypt32

CertCloseStore CryptMsgGetParam CryptMsgClose CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertOpenStore CertGetNameStringA CertFindCertificateInStore

ws2_32

WSAAddressToStringA freeaddrinfo getaddrinfo WSAAccept WSAGetLastError getsockopt shutdown setsockopt send inet_addr recv ntohs listen htons getsockname getpeername ioctlsocket connect closesocket bind __WSAFDIsSet inet_ntoa htonl gethostbyaddr gethostbyname getservbyport WSASend getservbyname WSAStartup accept WSACloseEvent WSACleanup gethostname WSASetLastError ntohl WSACreateEvent getnameinfo WSAEventSelect WSAEnumNetworkEvents select socket

wintrust

WinVerifyTrust

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpQueryAuthSchemes WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpSetCredentials WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse

shell32

SHGetSpecialFolderPathW

api-ms-win-power-setting-l1-1-0

PowerReadDCValue PowerReadACValue

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

powrprof

SetSuspendState

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

758KB

Virtual Size

757KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

173KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

828KB

Virtual Size

832KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=22, id=259, version=29395,

count=252, id=261, version=29395,

count=5, id=253, version=28518,

count=19, id=260, version=29804,

count=26, id=259, version=29804,

count=116, id=261, version=30152,

count=35, id=260, version=30152,

count=2, id=260, productName=VS2019 v16.8.4 build 29336, version=29336,

count=16, id=257, version=29395,

count=101, id=261, version=29804,

count=438, id=1, productName=Unmarked objects,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=31, id=260, version=29395,

count=385, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=29, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=256, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=255, productName=VS2019 v16.9.2 build 29913, version=29913,

count=2, id=151,

count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,