AdobePlugin-Update[.]6[.]3[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AdobePlugin-Update.6.3.1.exe
Size 76.4MB
Sample260804-ttsqhsvbrc
SHA256 9dc938323f1b30d53702a96464af9c904498c6233c114bf1fcb93333f17b77ac
MD5 0d606ba1063f3e92c29b22f98a8e2cae
SHA1 1fcc26c5949c45a12290cea4f279525ad907c74a
SHA512 0f126634c6d3f4d2aa7fa9ebbf87b8c97e23ec61b5f058fe690cecb0ce73acf7f5a2f0ab060912128ee23395c3c9140b9e1990013ed7edd267e46576bce4db44
SSDEEP 1572864:9qnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovp5:9iLVelepClAy6uw3W0BEROh2nvvr
TLSH
T17B08011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AdobePlugin-Update.6.3.1.exe

File Explorer

AdobePlugin-Update.6.3.1.exe

.exe 76.4MB

AdobePlugin-Update.6.3.1.exe

IMPHASH 63c11544893457fb321a43dc42728c6a
SHA256 9dc938323f1b30d53702a96464af9c904498c6233c114bf1fcb93333f17b77ac
MD5 0d606ba1063f3e92c29b22f98a8e2cae
SHA1 1fcc26c5949c45a12290cea4f279525ad907c74a
SHA512 0f126634c6d3f4d2aa7fa9ebbf87b8c97e23ec61b5f058fe690cecb0ce73acf7f5a2f0ab060912128ee23395c3c9140b9e1990013ed7edd267e46576bce4db44
SSDEEP 1572864:9qnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovp5:9iLVelepClAy6uw3W0BEROh2nvvr
TLSH
T17B08011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

359528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Faronics\morocco\Faronics_Hg\Deploy\Faronics-Deploy_CloudAgent\Source\bin\Release\FaronicsDeployAgent\Win32\FaronicsDeployAgent.pdb

comctl32

ord17

shell32

SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteExW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

crypt32

CryptStringToBinaryA CryptBinaryToStringA

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

kernel32

LocalAlloc LockResource DeviceIoControl FindNextFileW LocalFree SetFilePointer SetEndOfFile InterlockedDecrement ReadFile GetCurrentProcess LoadLibraryW GetUserDefaultLangID SetLastError GetVersionExW GetExitCodeProcess TerminateProcess IsWow64Process ExpandEnvironmentStringsW GetCurrentProcessId Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GlobalLock GlobalAlloc GlobalUnlock GetComputerNameExW GlobalFree GetWindowsDirectoryW CreateThread GetSystemDefaultLCID GetLocaleInfoW GetTimeZoneInformation MapViewOfFile UnmapViewOfFile CreateFileMappingW MoveFileExW GetSystemWindowsDirectoryW FindClose GetPrivateProfileStringW CopyFileW GetFileAttributesW WritePrivateProfileStringW GetTempPathW GetPrivateProfileIntW CreateEventW RemoveDirectoryW GetSystemInfo LoadResource LeaveCriticalSection EnterCriticalSection SystemTimeToFileTime FileTimeToSystemTime InterlockedCompareExchange InterlockedExchange GetProcessHeap WriteConsoleW SetStdHandle HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize IsValidCodePage GetOEMCP GetACP GetCurrentThreadId TlsFree TlsSetValue TlsGetValue GetProcAddress SizeofResource GetSystemDirectoryW GetModuleHandleW WaitForSingleObject CreateDirectoryW CreateProcessW CloseHandle GetLocalTime CreateFileW WriteFile DeleteFileW OutputDebugStringA MoveFileW GetLastError lstrlenW MultiByteToWideChar GetBinaryTypeW GetModuleFileNameW Sleep WideCharToMultiByte OutputDebugStringW FindFirstFileW TlsAlloc FlushFileBuffers GetConsoleMode GetConsoleCP FindResourceW InitializeCriticalSection FindResourceExW ExitProcess HeapDestroy HeapCreate IsProcessorFeaturePresent GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringW HeapAlloc RtlUnwind RaiseException GetCPInfo GetStartupInfoW HeapSetInformation GetStringTypeW EncodePointer DecodePointer DeleteCriticalSection HeapFree GetSystemTimeAsFileTime GetCommandLineW InterlockedIncrement

user32

GetDesktopWindow EndDialog InvalidateRect LoadIconW PtInRect BeginPaint SetFocus GetClientRect DialogBoxParamW SetWindowPos GetWindowRect SetTimer SetWindowRgn EndPaint GetSystemMetrics ShowWindow SendMessageW SetWindowTextW MoveWindow wsprintfW MessageBoxExW ExitWindowsEx KillTimer

gdi32

SelectObject Rectangle CreateRoundRectRgn CreatePen CreateSolidBrush DeleteObject

advapi32

DeregisterEventSource RegCreateKeyExA ReportEventW RegOpenKeyExA RegisterEventSourceW RegCreateKeyA RegDeleteKeyW RegCreateKeyExW LookupAccountSidW ConvertStringSidToSidW RegQueryInfoKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken QueryServiceConfigW ControlService QueryServiceStatus StartServiceW OpenServiceW OpenSCManagerW CloseServiceHandle RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW

ole32

CreateStreamOnHGlobal CoInitializeEx CoSetProxyBlanket CLSIDFromProgID CoCreateInstance CoInitialize CoUninitialize

oleaut32

VariantTimeToSystemTime VarCmp SysStringByteLen VariantChangeType SysAllocStringByteLen SysStringLen SysFreeString VariantInit VariantClear SysAllocString VariantCopy

shlwapi

PathGetArgsW PathAddBackslashW StrTrimW PathRemoveFileSpecW StrStrIW PathUnquoteSpacesW PathQuoteSpacesW PathRemoveArgsW PathFileExistsW

winhttp

WinHttpSetCredentials WinHttpReadData WinHttpOpenRequest WinHttpOpen WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpSetOption WinHttpReceiveResponse WinHttpSendRequest

msi

ord119 ord163 ord17 ord160 ord20 ord158 ord125 ord115 ord32 ord118 ord8 ord92 ord159

gdiplus

GdiplusStartup GdipCreatePen1 GdipCreatePath GdipCloneImage GdipCreateFromHDC GdipCreateFontFamilyFromName GdipDrawString GdipDeletePath GdipCreateFont GdiplusShutdown GdipDeleteBrush GdipFree GdipDeletePen GdipCloneBrush GdipStartPathFigure GdipCreateBitmapFromStream GdipSetTextRenderingHint GdipDrawPath GdipDisposeImage GdipAlloc GdipDrawImageI GdipCreateSolidFill GdipAddPathArcI GdipDeleteFontFamily GdipAddPathLineI GdipClosePathFigure GdipSetSmoothingMode GdipDeleteGraphics GdipDeleteFont