3314f2d0ebaa8a7f859048b79785a70904a713df3e485d4b6f65d99d393df103

General

Target
3314f2d0ebaa8a7f859048b79785a70904a713df3e485d4b6f65d99d393df103
Size 1.2MB
Sample260802-j83txsycnf
SHA256 3314f2d0ebaa8a7f859048b79785a70904a713df3e485d4b6f65d99d393df103
MD5 73c8421c4f64c64a7e1f0df6b130cd5f
SHA1 2bcf570b58c8e955d5dec450f24603f838b5f5b0
SHA512 fcac47557cdf79e922017b6303fa91897b211f8eef0b42562085bac9340100500759fc30d54de2ef894d2b6fb573624e97f7d1ec1096515ac41d946089856ef3
SSDEEP 24576:kjH/fOdKfKyPUHyDG5fGSXvaSvZ5erEq/zuTFWOT66RKECM97GtDT1:u/fOd7XHyDG5+MO3zBOTBR4M97GtDT1
TLSH
T186453B21B642C737E95140B0172D9E6A506879312B6288CBF3D81F2D78F1ED26B36F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3314f2d0ebaa8a7f859048b79785a70904a713df3e485d4b6f65d99d393df103

File Explorer

3314f2d0ebaa8a7f859048b79785a70904a713df3e485d4b6f65d99d393df103

.exe 1.2MB

3314f2d0ebaa8a7f859048b79785a70904a713df3e485d4b6f65d99d393df103

IMPHASH 1155b74d8da77d3e621933e1d450f72c
SHA256 3314f2d0ebaa8a7f859048b79785a70904a713df3e485d4b6f65d99d393df103
MD5 73c8421c4f64c64a7e1f0df6b130cd5f
SHA1 2bcf570b58c8e955d5dec450f24603f838b5f5b0
SHA512 fcac47557cdf79e922017b6303fa91897b211f8eef0b42562085bac9340100500759fc30d54de2ef894d2b6fb573624e97f7d1ec1096515ac41d946089856ef3
SSDEEP 24576:kjH/fOdKfKyPUHyDG5fGSXvaSvZ5erEq/zuTFWOT66RKECM97GtDT1:u/fOd7XHyDG5+MO3zBOTBR4M97GtDT1
TLSH
T186453B21B642C737E95140B0172D9E6A506879312B6288CBF3D81F2D78F1ED26B36F67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

750860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-recommendtools-build\RecommendTools\helper2345_x\bin\Win32\Release\pdb\AssistExplorer.pdb

kernel32

GetCurrentProcessId FreeLibrary ExpandEnvironmentStringsW GetFileAttributesW GetModuleHandleW GetVersionExW LockResource GetSystemInfo LoadResource FindResourceW lstrcmpiW FindFirstFileW GetLongPathNameW CreateFileW GetLastError GetFileAttributesExW CreateMutexW WaitForSingleObject ReleaseMutex Sleep CloseHandle QueryDosDeviceW GetCurrentProcess OpenProcess TerminateProcess WaitForMultipleObjects lstrlenW ReadFile WriteFile SetFilePointer SetEndOfFile DeleteFileW GetFileSizeEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection FindNextFileW FindClose LocalFree GetFileSize GetFileTime CreateDirectoryW GetFullPathNameW RemoveDirectoryW GetTempPathW SetFileAttributesW GetCurrentDirectoryW GetWindowsDirectoryW MoveFileExW GetTempFileNameW MoveFileW HeapFree GetCurrentThreadId GetComputerNameExW HeapAlloc GetProcessHeap GetLogicalDriveStringsW CreateProcessW GetExitCodeProcess FormatMessageW GetPrivateProfileStringW FileTimeToSystemTime SetEvent GetTickCount GetACP GlobalMemoryStatusEx InterlockedExchange SetLastError InterlockedExchangeAdd InitializeCriticalSectionAndSpinCount SwitchToThread GetProcAddress LoadLibraryW GetModuleFileNameW GetCommandLineW ExitThread FreeLibraryAndExitThread DeviceIoControl ResetEvent CreateEventW ResumeThread GetEnvironmentVariableW GetTimeZoneInformation SetFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA OutputDebugStringW CreateThread SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode HeapSize HeapReAlloc SetFilePointerEx WriteConsoleW DecodePointer

advapi32

RegCreateKeyExW

shell32

CommandLineToArgvW SHGetFolderPathW SHGetSpecialFolderPathW

imm32

ImmDisableIME

Sharing

General

Malware Config

Signatures

File Explorer

3314f2d0ebaa8a7f859048b79785a70904a713df3e485d4b6f65d99d393df103

kernel32

advapi32

shell32

imm32

generic