Xyron_Free_Tweaker[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Xyron_Free_Tweaker.exe
Size 1.0MB
Sample260807-ppfsyadr2x
SHA256 772c7697877169fa756e55b266fe83e1a1fb1acf890f47fa5adcf7fa511a50de
MD5 6d2a3aff9900c1e551e8a722c587f74c
SHA1 4b72c0731bc45e5b38213e797d292dbc04fb3b0e
SHA512 57ce283223bf23232c2587ea4b8a6156f2da0e329fe5e26460f7e0dee3ddc2f89ed79430b4c52b3f000f05a2243da0883518adc6b9a52962c33eef2d0b936a52
SSDEEP 24576:SqarqHgcD9Bpsx1jnaYZRMxMmABlNGwBcDDLxY+W6Q:SqJD9BpsxFnausLm+WH
TLSH
T1D035AF23E3A002ADF023A9319A53D713A73378820B6197CB775414254FAB2E55FBBBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Xyron_Free_Tweaker.exe

File Explorer

Xyron_Free_Tweaker.exe

.exe 1.0MB

Xyron_Free_Tweaker.exe

IMPHASH d18a0c8b6dafe842931a2308e897edfd
SHA256 772c7697877169fa756e55b266fe83e1a1fb1acf890f47fa5adcf7fa511a50de
MD5 6d2a3aff9900c1e551e8a722c587f74c
SHA1 4b72c0731bc45e5b38213e797d292dbc04fb3b0e
SHA512 57ce283223bf23232c2587ea4b8a6156f2da0e329fe5e26460f7e0dee3ddc2f89ed79430b4c52b3f000f05a2243da0883518adc6b9a52962c33eef2d0b936a52
SSDEEP 24576:SqarqHgcD9Bpsx1jnaYZRMxMmABlNGwBcDDLxY+W6Q:SqJD9BpsxFnausLm+WH
TLSH
T1D035AF23E3A002ADF023A9319A53D713A73378820B6197CB775414254FAB2E55FBBBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

405824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

user32

PeekMessageA DispatchMessageA TranslateMessage GetClientRect SetCursorPos SetCursor GetCursorPos ClientToScreen ScreenToClient DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetLayeredWindowAttributes MoveWindow GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconA LoadCursorA SetWindowLongA GetWindowLongA GetWindowRect UpdateWindow GetSystemMetrics

gdiplus

GdipDisposeImage GdiplusShutdown GdipGetImageWidth GdiplusStartup GdipGetImageHeight GdipCreateBitmapFromFile GdipBitmapLockBits GdipBitmapUnlockBits GdipFree GdipCloneImage GdipAlloc

advapi32

RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegEnumKeyExA

shell32

ShellExecuteA

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ _Query_perf_frequency _Query_perf_counter ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPEBD@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_function_call@std@@YAXXZ

kernel32

Sleep GetFileAttributesA FindNextFileA FindFirstFileA FindClose GetEnvironmentVariableA QueryPerformanceFrequency WakeAllConditionVariable WideCharToMultiByte MultiByteToWideChar CreateProcessA K32GetModuleBaseNameA K32EnumProcessModules K32EnumProcesses GlobalLock GlobalUnlock GlobalAlloc LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary OpenProcess CloseHandle GetCurrentProcessId ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter WaitForSingleObject SleepConditionVariableSRW GetCurrentThreadId GlobalFree GetStartupInfoW GetModuleHandleW

imm32

ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow ImmGetContext

vcruntime140

__C_specific_handler memcmp memmove __current_exception __current_exception_context memchr strstr __std_terminate memset memcpy __std_exception_copy __std_exception_destroy _CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback system _set_app_type _initialize_onexit_table _beginthreadex _register_onexit_function _crt_atexit _seh_filter_exe _wassert exit _exit _configure_narrow_argv _initialize_narrow_environment _get_narrow_winmain_command_line _initterm terminate _initterm_e _c_exit _cexit

api-ms-win-crt-stdio-l1-1-0

fwrite __stdio_common_vfprintf fgets __p__commode ftell fseek __stdio_common_vsprintf _set_fmode fread __acrt_iob_func fflush fclose _wfopen feof __stdio_common_vsscanf _pclose _popen

api-ms-win-crt-math-l1-1-0

sqrtf acosf ceilf sinf roundf cosf fmodf __setusermatherr

api-ms-win-crt-string-l1-1-0

strncmp strcspn _strdup strlen strncpy strcmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale