ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05

Sharing

Copy URL Twitter E-mail

General

Target
ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05
Size 12.9MB
Sample260808-vbj64aed94
SHA256 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05
MD5 c7dca8acdc08f9739294fc286047634d
SHA1 b1c66576422d0018fbdbb44c8c1e5680b80b7355
SHA512 1f13ccc4bfdcfd534d56b35173194c7f32eadc4d87569fee188f77a7475a9c9dda9e293f6ab9a15b1f1e838f2f79d195c9a7bc1b64cfd7cf97fb2295dd571ae7
SSDEEP 393216:lpKIqKMMHrD6rO1ERNKSfC7Q7x/WN/7F3:LIKMGX6rwIK0C7Q7deDF3
TLSH
T160D63324B5D0D432E93365309B789ABA9878BC259B3181EFF3DC4A690F342D1D83A757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05

File Explorer

ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05

.exe 12.9MB

ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05

IMPHASH 77e82d910b00f5dda4227cfbcd1516ff
SHA256 ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05
MD5 c7dca8acdc08f9739294fc286047634d
SHA1 b1c66576422d0018fbdbb44c8c1e5680b80b7355
SHA512 1f13ccc4bfdcfd534d56b35173194c7f32eadc4d87569fee188f77a7475a9c9dda9e293f6ab9a15b1f1e838f2f79d195c9a7bc1b64cfd7cf97fb2295dd571ae7
SSDEEP 393216:lpKIqKMMHrD6rO1ERNKSfC7Q7x/WN/7F3:LIKMGX6rwIK0C7Q7deDF3
TLSH
T160D63324B5D0D432E93365309B789ABA9878BC259B3181EFF3DC4A690F342D1D83A757
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

148656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\cc-builds\apmclients722x-win\1352827\src\rh\TerminalProxy\MSI\setupstub\out\Release\setupstub.pdb

comctl32

InitCommonControlsEx

kernel32

GetCurrentProcess GetCurrentProcessId GetExitCodeProcess GetCurrentThreadId CreateProcessA GetSystemInfo GetSystemTime GetSystemDirectoryA GetWindowsDirectoryA GetVersionExA FreeLibrary GetModuleFileNameA GetModuleHandleA GetModuleHandleExA GetProcAddress LoadLibraryA LocalAlloc LocalFree FormatMessageA lstrcmpA lstrlenA CopyFileA VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoA GetSystemDefaultUILanguage GetUserDefaultUILanguage GetFullPathNameA SetDefaultDllDirectories lstrcpynA lstrcpyA lstrcatA CompareStringA GlobalAlloc GlobalFree VirtualProtect VirtualQuery GetModuleHandleW LoadLibraryExA GlobalUnlock GlobalLock FileTimeToLocalFileTime GetFileTime LocalFileTimeToFileTime SetEndOfFile SetFilePointer SetFileTime GetVolumeInformationA GetLocalTime GetVersion DosDateTimeToFileTime SetVolumeLabelA FileTimeToSystemTime SystemTimeToFileTime lstrcmpiA CreateDirectoryW GetFileAttributesExW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExA GetFullPathNameW GetCurrentDirectoryW HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeZoneInformation ReadConsoleW ReadFile SetFilePointerEx GetConsoleMode GetConsoleCP GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess HeapReAlloc SetStdHandle WriteConsoleW SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW GetCommandLineW GetCommandLineA GetFileType CreateEventA CreateMutexA WaitForSingleObject ReleaseMutex ResetEvent SetEvent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapFree HeapAlloc QueryPerformanceCounter GetLastError RaiseException CloseHandle DecodePointer OutputDebugStringA GetTempPathA SetFileAttributesW SetFileAttributesA RemoveDirectoryA GetLongPathNameA GetFileAttributesA FlushFileBuffers FindNextFileA FindFirstFileA FindClose DeleteFileW DeleteFileA CreateFileW CreateFileA CreateDirectoryA VerSetConditionMask GetDriveTypeA LoadLibraryExW RtlUnwind InitializeSListHead GetStartupInfoW WaitForSingleObjectEx IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount SetLastError EncodePointer OutputDebugStringW IsDebuggerPresent

user32

DispatchMessageA PeekMessageA DefWindowProcA DestroyWindow ShowWindow TranslateMessage SetWindowTextA GetWindowRect GetWindowLongA SetWindowLongA ExitWindowsEx CharPrevA LoadStringA CreateDialogParamA LoadIconA OemToCharA CharNextA wsprintfA MsgWaitForMultipleObjects SystemParametersInfoA IsDialogMessageA SetForegroundWindow GetSystemMetrics SetFocus SetDlgItemTextA GetDlgItem MoveWindow WaitMessage PostMessageA SendMessageA MessageBoxA

advapi32

LookupPrivilegeValueA SetKernelObjectSecurity IsValidSecurityDescriptor GetSecurityDescriptorControl GetKernelObjectSecurity AdjustTokenPrivileges ConvertStringSecurityDescriptorToSecurityDescriptorA RegQueryValueExA RegOpenKeyExA RegEnumValueA RegEnumKeyExA RegCloseKey GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority FreeSid AllocateAndInitializeSid OpenProcessToken

shell32

SHGetPathFromIDListA SHBrowseForFolderA

ole32

CoTaskMemFree CoCreateGuid StringFromGUID2

Name

.text

Size

276KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ef32f36c2c3f17c84136dd611d2bc7d415c36f6640faa1051b0b4f49ca203c05

comctl32

kernel32

user32

advapi32

shell32

ole32

generic