58333473c038d017558d02c09b3bab38837947dbbb1e2e4bcf729aadb3003b39

Sharing

Copy URL Twitter E-mail

General

Target
58333473c038d017558d02c09b3bab38837947dbbb1e2e4bcf729aadb3003b39
Size 2.6MB
Sample260803-jgctesea67
SHA256 58333473c038d017558d02c09b3bab38837947dbbb1e2e4bcf729aadb3003b39
MD5 8f217e9c4f324f42179ec47ba0c1a56d
SHA1 b847adc0c87ccb3655f2ca50aad0c13900ab86d9
SHA512 3278208d6c5a73219c8cba2cb1a579248ac7ff4f9ed74011891459f692d41774cc67f9b96b8728324e26f6bcb0252540c27e86d7836c8745ab54871d870d79f5
SSDEEP 49152:UosYHC5iFQXy4QmC7wXG1yvsHYUGh8vHJxLPFQksUllYdThjOD+7sGb:UoJ5FQXy4Qh771yvsHY2vHJxLPFQksUM
TLSH
T1FAD59E227A91803DE1AF0271597D732DA1BCA6B00B3540C7A3D85F6D2DB58C3B639B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
58333473c038d017558d02c09b3bab38837947dbbb1e2e4bcf729aadb3003b39

File Explorer

58333473c038d017558d02c09b3bab38837947dbbb1e2e4bcf729aadb3003b39

.dll 2.6MB

58333473c038d017558d02c09b3bab38837947dbbb1e2e4bcf729aadb3003b39

IMPHASH 14d5edcbc49f61ff622e49c6811be693
SHA256 58333473c038d017558d02c09b3bab38837947dbbb1e2e4bcf729aadb3003b39
MD5 8f217e9c4f324f42179ec47ba0c1a56d
SHA1 b847adc0c87ccb3655f2ca50aad0c13900ab86d9
SHA512 3278208d6c5a73219c8cba2cb1a579248ac7ff4f9ed74011891459f692d41774cc67f9b96b8728324e26f6bcb0252540c27e86d7836c8745ab54871d870d79f5
SSDEEP 49152:UosYHC5iFQXy4QmC7wXG1yvsHYUGh8vHJxLPFQksUllYdThjOD+7sGb:UoJ5FQXy4Qh771yvsHY2vHJxLPFQksUM
TLSH
T1FAD59E227A91803DE1AF0271597D732DA1BCA6B00B3540C7A3D85F6D2DB58C3B639B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1730995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\MyCode\win_agent_tool\win_urd\urd\URD\BIN\x86\URDHelp_x86.pdb

kernel32

SetCurrentDirectoryW SetEnvironmentVariableA PeekNamedPipe ReadConsoleW SystemTimeToTzSpecificLocalTime FindFirstFileExW SetEnvironmentVariableW SetVolumeLabelW GetDriveTypeW WriteConsoleW FreeEnvironmentStringsW GetStdHandle GetConsoleMode GetConsoleCP GetStringTypeW EnumSystemLocalesW IsValidLocale LCMapStringW GetEnvironmentStringsW QueryPerformanceCounter GetModuleFileNameA GetTimeZoneInformation SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetOEMCP GetACP IsValidCodePage GetFileType SetStdHandle VirtualAlloc HeapQueryInformation RtlUnwind GetCommandLineA ExitThread AreFileApisANSI GetModuleHandleExW ExitProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime MoveFileExW FindResourceExW GetUserDefaultLCID GetDiskFreeSpaceW VirtualProtect SearchPathW GetProfileIntW GetTempPathW GetTempFileNameW VerifyVersionInfoW VerSetConditionMask lstrcpyW SetFileTime LocalFileTimeToFileTime GetFileTime GetCurrentDirectoryW MoveFileW lstrcmpiW DuplicateHandle UnlockFile SetFilePointer LockFile GetVolumeInformationW GetFullPathNameW GlobalFlags GetUserDefaultUILanguage GetLocaleInfoW CompareStringW ResumeThread SetThreadPriority LocalReAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection SystemTimeToFileTime GlobalGetAtomNameW lstrcmpA GetVersionExW FindNextFileW FindFirstFileW FindClose GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryExW GetModuleHandleA FreeResource GetSystemDirectoryW EncodePointer SetLastError CopyFileW MulDiv GlobalUnlock GlobalLock GlobalSize CreateMutexW DecodePointer HeapSize RaiseException InitializeCriticalSectionEx HeapReAlloc VirtualQueryEx LoadLibraryA OpenThread WinExec GetSystemInfo GetPrivateProfileStringW CreateDirectoryW GetFileAttributesW VirtualQuery LocalAlloc UnmapViewOfFile OpenFileMappingW MapViewOfFile CreateFileMappingW WaitForMultipleObjects OpenEventW GetCurrentThreadId GetCurrentProcess CreateProcessW CreateSemaphoreW GetStartupInfoW TerminateProcess QueryFullProcessImageNameW OpenProcess HeapFree GetProcessHeap HeapAlloc CreateThread GetModuleFileNameW LocalFree FormatMessageW GlobalFree GlobalAlloc GetWindowsDirectoryW ResetEvent GetLocalTime SetEvent CreateEventW OutputDebugStringA GetCurrentProcessId GetExitCodeProcess WaitForSingleObject GetProcessId FileTimeToSystemTime FileTimeToLocalFileTime GetFileSize FlushFileBuffers SetFileAttributesW GetFileAttributesExW FreeLibrary Process32NextW Process32FirstW CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount OutputDebugStringW MultiByteToWideChar WideCharToMultiByte GetTickCount64 GetProcAddress GetLastError LoadLibraryW GetModuleHandleW SetDllDirectoryW ReadFile FindResourceW LoadResource LockResource SizeofResource WritePrivateProfileStringW Sleep WriteFile GetFileSizeEx SetEndOfFile SetFilePointerEx CreateFileW GetTickCount DeleteFileW CloseHandle GetFileInformationByHandle

user32

DrawIconEx LoadImageW IsRectEmpty OffsetRect SetRectEmpty DrawFocusRect ReleaseCapture SetCapture GetNextDlgGroupItem IsIconic InvalidateRect KillTimer SetTimer DeleteMenu SetCursor ShowOwnedPopups CharUpperW DestroyIcon GetNextDlgTabItem EndDialog CreateDialogIndirectParamW IntersectRect RealChildWindowFromPoint GetActiveWindow SendDlgItemMessageA CopyImage InflateRect GetMenuItemInfoW DestroyMenu LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem LoadCursorW GetSysColorBrush WindowFromPoint FillRect ClientToScreen EndPaint BeginPaint ReleaseDC GetWindowDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassLongW PtInRect EqualRect CopyRect GetSysColor MapWindowPoints ScreenToClient AdjustWindowRectEx RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow ValidateRect SetForegroundWindow SetActiveWindow UpdateWindow GetIconInfo TrackPopupMenu SetMenu GetMenu GetCapture GetKeyState IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement MessageBeep GetAsyncKeyState EnableScrollBar CharToOemBuffA SendMessageW GetWindowThreadProcessId GetParent GetWindow GetWindowPlacement IsChild GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW PostMessageW GetMessageTime GetMessagePos PeekMessageW RegisterWindowMessageW IsDialogMessageW SetWindowLongW GetWindowLongW GetWindowTextLengthW SetWindowTextW IsWindowEnabled EnableWindow GetFocus SetFocus GetDlgCtrlID CheckDlgButton GetDlgItem MoveWindow ShowWindow IsWindow RemoveMenu AppendMenuW InsertMenuW GetMenuItemCount GetMenuItemID GetSubMenu GetMenuState GetMenuStringW DispatchMessageW TranslateMessage GetMessageW HideCaret InvertRect NotifyWinEvent CreatePopupMenu GetMenuDefaultItem MapVirtualKeyW LoadMenuW SetLayeredWindowAttributes EnumDisplayMonitors OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW DrawEdge DrawFrameControl SetWindowRgn SetParent UnionRect IsMenu UpdateLayeredWindow BringWindowToTop LoadAcceleratorsW TranslateAcceleratorW InsertMenuItemW SystemParametersInfoW GetWindowRect GetClientRect GetCursorPos MonitorFromPoint GetMonitorInfoW UnpackDDElParam ReuseDDElParam GetKeyNameTextW TrackMouseEvent GetComboBoxInfo IsZoomed GetDesktopWindow GetClassNameW GetWindowTextW SetWindowPos MessageBoxW GetForegroundWindow GetSystemMetrics DestroyWindow PostQuitMessage DefWindowProcW RegisterClassExW CreateWindowExW RegisterDeviceNotificationW GetSystemMenu PostThreadMessageW WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable CopyAcceleratorTableW SetCursorPos SetRect DrawIcon GetWindowRgn DestroyCursor MapDialogRect CreateMenu SubtractRect GetUpdateRect IsClipboardFormatAvailable TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar FrameRect CharUpperBuffW RegisterClipboardFormatW ModifyMenuW SetMenuDefaultItem CopyIcon GetDoubleClickTime SetClassLongW LockWindowUpdate OemToCharBuffA

gdi32

MoveToEx TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx GetTextExtentPoint32W CombineRgn CreateRectRgnIndirect PatBlt SetRectRgn DPtoLP GetTextMetricsW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette GetBkColor CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo SetPixel StretchBlt CreateDIBSection CreateEllipticRgn Ellipse GetTextColor CreatePolygonRgn Polygon Polyline Rectangle EnumFontFamiliesExW GetRgnBox OffsetRgn CreateRoundRectRgn RoundRect FrameRgn PtInRegion SetPixelV ExtFloodFill SetPaletteEntries FillRgn GetBoundsRect GetWindowOrgEx LPtoDP GetViewportOrgEx GetTextFaceW SetTextAlign SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetStockObject GetPixel GetObjectType GetClipBox ExcludeClipRect Escape DeleteObject DeleteDC CreateSolidBrush CreateRectRgn CreatePatternBrush CreateHatchBrush CreateBitmap BitBlt SetTextColor SetBkColor GetDeviceCaps CreateDCW CopyMetaFileW CreateCompatibleDC GetObjectW SetDIBColorTable CreatePen CreateFontIndirectW

msimg32

AlphaBlend TransparentBlt

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

OpenProcessToken RegQueryValueExW RegCloseKey RegCreateKeyExW RegSetValueExW RegDeleteKeyW StartServiceW SetSecurityDescriptorDacl InitializeSecurityDescriptor LookupAccountSidW CheckTokenMembership CreateWellKnownSid SetTokenInformation GetTokenInformation DuplicateTokenEx RegOpenKeyExW CreateProcessAsUserW QueryServiceStatusEx EnumDependentServicesW RegDeleteValueW SetServiceStatus QueryServiceStatus ControlService OpenServiceW CloseServiceHandle OpenSCManagerW RegEnumKeyExW

shell32

ShellExecuteExW SHGetFolderPathW ord680 SHBrowseForFolderW SHGetPathFromIDListW SHAppBarMessage DragFinish DragQueryFileW SHGetDesktopFolder SHGetSpecialFolderLocation ShellExecuteW SHGetFileInfoW

shlwapi

PathFindFileNameW PathRemoveFileSpecW PathIsUNCW StrFormatKBSizeW PathStripToRootW StrStrIW PathFindExtensionW

uxtheme

GetWindowTheme GetThemePartSize DrawThemeText DrawThemeParentBackground GetThemeSysColor IsThemeBackgroundPartiallyTransparent OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName IsAppThemed

ole32

OleLockRunning OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleGetClipboard CoLockObjectExternal RegisterDragDrop RevokeDragDrop DoDragDrop CoInitialize CoUninitialize CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree OleDuplicateData ReleaseStgMedium CoDisconnectObject CreateStreamOnHGlobal

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime VariantCopy VarBstrFromDate LoadTypeLi VariantChangeType VariantClear VariantInit SysAllocStringLen SysStringLen SysFreeString SysAllocString

iphlpapi

SetPerTcp6ConnectionEStats SetPerTcpConnectionEStats GetExtendedTcpTable

crypt32

CryptStringToBinaryA

ws2_32

ntohs getaddrinfo inet_ntop freeaddrinfo WSAStartup

wininet

InternetOpenA InternetGetLastResponseInfoA InternetConnectA HttpOpenRequestA InternetCloseHandle InternetSetOptionW InternetQueryOptionW InternetReadFile InternetQueryDataAvailable HttpSendRequestA

wtsapi32

WTSEnumerateProcessesW WTSFreeMemory

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

gdiplus

GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateFromHDC GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown GdipSetInterpolationMode GdipGetImagePaletteSize GdipDrawImageRectI

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

winmm

PlaySoundW

generic

count=9, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=13, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=10, id=206, version=65501,

count=1, id=207, version=65501,

count=2, id=208, version=65501,

count=47, id=203, version=65501,

count=879, id=1, productName=Unmarked objects,

count=2, id=199, version=41118,

count=79, id=225, productName=VS2013 build 21005, version=21005,

count=49, id=223, productName=VS2013 build 21005, version=21005,

count=265, id=224, productName=VS2013 build 21005, version=21005,

count=314, id=225, version=20806,

count=8, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,