89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8

Sharing

Copy URL Twitter E-mail

General

Target
89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8
Size 1.7MB
Sample260803-bdmkfsvhmf
SHA256 89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8
MD5 ec7eb8b015f761e4b84467d5758fac04
SHA1 21568e160655809bdfb09d621c6d58bcd7006811
SHA512 0dbc660bc83c2461e6f10fff6369e96f73998c624cfc28942a37261dbcc82209cecbfdb58a7425c06e64da79dfa047d3bf6fc50402e9de0454372d1ca502da5f
SSDEEP 24576:Nf/CBAE+Fuf4owQ1HYBSiPZTPEGUOk5naB4H2+jTcMaZe3vPr8l:NnE1PfHYBDXXiq4H2ATzaZe/z8l
TLSH
T19F856D137661C021D4E40172935FBB2B50B86F706BE298CBB7C47A5959F09C29E3DF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8

File Explorer

89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8

.exe 1.7MB

89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8

IMPHASH 9f575aba4d4d00e68f0529dac4b1cea6
SHA256 89fe3488138656f7ae310d00b5e311d51b6ab51de14f15f7f06038928513e6a8
MD5 ec7eb8b015f761e4b84467d5758fac04
SHA1 21568e160655809bdfb09d621c6d58bcd7006811
SHA512 0dbc660bc83c2461e6f10fff6369e96f73998c624cfc28942a37261dbcc82209cecbfdb58a7425c06e64da79dfa047d3bf6fc50402e9de0454372d1ca502da5f
SSDEEP 24576:Nf/CBAE+Fuf4owQ1HYBSiPZTPEGUOk5naB4H2+jTcMaZe3vPr8l:NnE1PfHYBDXXiq4H2ATzaZe/z8l
TLSH
T19F856D137661C021D4E40172935FBB2B50B86F706BE298CBB7C47A5959F09C29E3DF2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

994944

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\7.Works\RAONK\K.Agent\bin\raonk.pdb

kernel32

RemoveDirectoryW GetFileAttributesExW DeleteFileW MoveFileW VerifyVersionInfoW GetDateFormatW GetNumberFormatW SetThreadLocale GetUserDefaultUILanguage GetUserDefaultLCID SetThreadUILanguage CreateToolhelp32Snapshot Process32FirstW Process32NextW LocalFileTimeToFileTime GetFileInformationByHandle GetFileSizeEx MapViewOfFile UnmapViewOfFile CreateFileMappingW SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW IsValidLocale MultiByteToWideChar ReadConsoleW GetConsoleMode GetACP GetStdHandle ExitProcess MoveFileExW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetWindowsDirectoryW ResetEvent SetEvent GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW GetCPInfo GetStringTypeW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent GetFileType GetCurrentDirectoryW GetTempPathW lstrcpynW CompareFileTime FileTimeToSystemTime FileTimeToLocalFileTime SystemTimeToFileTime GetSystemTime GetFileTime GetCurrentThread TerminateProcess GetCurrentProcess GetLongPathNameW VerSetConditionMask SetFilePointerEx GetVersionExW CopyFileW CreateFileW GetModuleFileNameW lstrcmpW GetTickCount MulDiv CloseHandle ReadFile WriteFile DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection SetLastError GetCurrentThreadId LockResource RaiseException GlobalUnlock GlobalHandle GlobalLock InterlockedDecrement InterlockedIncrement GetLastError GlobalFree GlobalSize GlobalReAlloc GlobalAlloc WideCharToMultiByte FindResourceExW FindResourceW SizeofResource LoadResource GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetFileAttributesW CreateDirectoryW GetSystemDirectoryW DosDateTimeToFileTime SetFileTime FindNextFileW FindFirstFileW FindClose GetFileAttributesW LoadLibraryExW lstrcmpiW DecodePointer FormatMessageW ResumeThread SuspendThread LocalAlloc SetFilePointer QueueUserWorkItem OutputDebugStringW ExpandEnvironmentStringsW CreateProcessW GetModuleHandleW LoadLibraryW CreateMutexW lstrlenW GetLocalTime WaitForSingleObject ReleaseMutex InitializeCriticalSection GetExitCodeThread TerminateThread OpenProcess LocalFree GetProcAddress FreeLibrary InterlockedExchange GetUserDefaultLangID Sleep WaitForSingleObjectEx FreeResource GetConsoleCP

user32

LoadImageW RegisterWindowMessageW SendMessageW DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW IsWindow IsChild DestroyWindow ShowWindow SetLayeredWindowAttributes GetMonitorInfoW DestroyIcon CreateIconFromResourceEx DrawIconEx CreateDialogIndirectParamW UpdateWindow TrackMouseEvent SetRect CopyRect SystemParametersInfoW IsMenu GetMenuDefaultItem SetMenuDefaultItem GetIconInfo MonitorFromPoint wsprintfW ReleaseDC GetDC MonitorFromWindow MapWindowPoints TrackPopupMenu SetActiveWindow GetForegroundWindow MessageBoxW GetCursorPos WindowFromPoint EnumChildWindows FindWindowW FindWindowExW GetSubMenu DestroyMenu LoadMenuW GetSystemMetrics MoveWindow SetWindowPos DialogBoxIndirectParamW EndDialog GetDlgItem OpenClipboard CloseClipboard GetClipboardData RegisterClipboardFormatW IsClipboardFormatAvailable CharNextW SetFocus GetFocus SetCapture ReleaseCapture SetTimer KillTimer CreateAcceleratorTableW DestroyAcceleratorTable DrawTextW BeginPaint EndPaint InvalidateRect InvalidateRgn RedrawWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW GetClientRect SetWindowContextHelpId SetCursor ClientToScreen ScreenToClient GetSysColor FillRect GetWindowLongW SetWindowLongW GetDesktopWindow GetParent GetClassNameW GetWindow LoadCursorW MapDialogRect BringWindowToTop GetCapture EnableWindow SetForegroundWindow GetWindowRect PtInRect IsDialogMessageW TranslateMessage GetWindowThreadProcessId SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx GetMessageW DispatchMessageW PeekMessageW SendMessageTimeoutW PostMessageW AttachThreadInput PostQuitMessage IsWindowVisible CreateDialogParamW DialogBoxParamW AddClipboardFormatListener RemoveClipboardFormatListener GetActiveWindow GetKeyState GetAsyncKeyState

gdi32

SetBkColor SelectClipRgn DeleteObject DeleteDC CreateSolidBrush CreateRectRgn CreateFontIndirectW GetObjectW PlayEnhMetaFile GetEnhMetaFileHeader GetEnhMetaFileW DeleteEnhMetaFile SetBkMode SelectPalette SelectObject RealizePalette PatBlt GetSystemPaletteEntries GetStockObject GetDIBits GetDeviceCaps GetClipBox CreatePalette CreateCompatibleDC CreateCompatibleBitmap BitBlt SetTextColor ExtTextOutW DPtoLP SetViewportOrgEx GetMetaFileBitsEx CopyEnhMetaFileW SetWinMetaFileBits EnumFontFamiliesExW

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

AllocateAndInitializeSid RegQueryValueExW OpenProcessToken GetTokenInformation GetUserNameW RegCloseKey RegOpenKeyExW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW DuplicateToken AccessCheck OpenThreadToken AdjustTokenPrivileges FreeSid GetLengthSid InitializeAcl AddAccessAllowedAce InitializeSecurityDescriptor IsValidSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner SetSecurityDescriptorGroup LookupPrivilegeValueW

shell32

SHGetMalloc SHGetFolderPathW Shell_NotifyIconW ord727 ord680 ShellExecuteW SHGetFileInfoW SHParseDisplayName SHBrowseForFolderW SHGetSpecialFolderLocation SHCreateShellItem SHGetPathFromIDListW ord155 DragQueryFileW SHGetSpecialFolderPathW DragFinish DragAcceptFiles ShellExecuteExW FindExecutableW

ole32

CoCreateGuid CoTaskMemRealloc OleRun CreateStreamOnHGlobal OleLockRunning OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CLSIDFromString CoCreateInstance CoGetClassObject CoUninitialize CoInitialize

oleaut32

CreateErrorInfo VarUI4FromStr VariantChangeType VariantCopy SysAllocStringByteLen SysStringByteLen OleCreateFontIndirect LoadRegTypeLi LoadTypeLi VariantClear VariantInit SafeArrayCreateVector SafeArrayAccessData SafeArrayDestroy SysStringLen SysFreeString SysAllocStringLen SysAllocString GetErrorInfo

shlwapi

PathFindFileNameW PathIsDirectoryW ord176 PathSearchAndQualifyW UrlGetPartW AssocQueryStringW PathAppendA PathCombineW ord219 PathFileExistsW

comctl32

ImageList_ReplaceIcon InitCommonControlsEx ImageList_Destroy

wininet

InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestExW HttpEndRequestW HttpQueryInfoW InternetWriteFile HttpSendRequestW InternetSetCookieW InternetGetCookieW InternetReadFile InternetConnectW InternetOpenW InternetCloseHandle

gdiplus

GdipSetPenColor GdipSetStringFormatMeasurableCharacterRanges GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdiplusStartup GdipDeleteStringFormat GdipCreateStringFormat GdipMeasureCharacterRanges GdipDrawImageRectRect GdipDrawImageI GdipFillRegion GdipDrawLineI GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipBitmapGetPixel GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipImageRotateFlip GdipSetSolidFillColor GdipDeleteRegion GdipCreateRegion GdipDrawString GdipDeleteFont GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDrawImageRectI GdipFillRectangle GdipGraphicsClear GdipDrawRectangleI GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipLoadImageFromFileICM GdipLoadImageFromFile GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipFree GdipAlloc GdipGetImageEncoders GdipGetImageEncodersSize GdipBitmapSetPixel GdipGetAllPropertyItems GdipGetPropertySize GdipGetImageRawFormat GdipSaveImageToFile GdipBitmapUnlockBits GdipBitmapLockBits GdipSetImagePalette GdipGetImagePixelFormat GdipGetImageFlags GdipSetStringFormatAlign GdiplusShutdown GdipCreateImageAttributes

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

ws2_32

accept bind closesocket getpeername getsockopt listen recv recvfrom select send sendto setsockopt shutdown socket gethostbyname gethostname WSAStartup WSACleanup WSASetLastError WSAGetLastError getaddrinfo freeaddrinfo getnameinfo ntohs

crypt32

CryptMsgGetParam CryptMsgClose PFXVerifyPassword PFXIsPFXBlob PFXImportCertStore CryptQueryObject CertOpenSystemStoreW CertAddCertificateContextToStore CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CertGetNameStringW

secur32

DeleteSecurityContext FreeContextBuffer QuerySecurityPackageInfoW InitSecurityInterfaceW

iphlpapi

GetAdaptersInfo

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

253KB

Virtual Size

252KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

460B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=16, id=241, version=40116,

count=173, id=243, version=40116,

count=31, id=242, version=40116,

count=2, id=199, version=41118,

count=27, id=259, version=24123,

count=6, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=36, id=260, version=24123,

count=73, id=261, version=24123,

count=3, id=261, version=23013,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=592, id=1, productName=Unmarked objects,

count=47, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,