healingtouch_pure_en[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
healingtouch_pure_en.exe
Size 4.9MB
Sample260808-vlk65sam71
SHA256 424c6e0f8c9f93429ba086c87129a5a5278459ef9bf5086796f965de6bb590eb
MD5 cdfe3bfcffce37b735db28b990e0e75d
SHA1 10fcc72dbca613cdeb1688a1e81d57860e725391
SHA512 aa4fd30e7b65542707ff3d69762d76ffd20401fccc3a77700f32022e1502f808b5add83c53ca9d570e4598101347cf62bd0ccab9a837d4c9674f71bb03c2250a
SSDEEP 98304:7MKT/zrG7mUAEadvSo8GTeY7uOO+vWLZZZdZt8F:71zrG7mUAEadvSo47+eLZZZdZt8
TLSH
T134369E307306C1BEC98142F06D2D7A6F946C9B590BB44CD7E3D82E2D59B2AD22F33965
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
healingtouch_pure_en.exe

File Explorer

healingtouch_pure_en.exe

.exe 4.9MB

healingtouch_pure_en.exe

IMPHASH cdae7ded8e9a8ee6f5a56c5e89dc8376
SHA256 424c6e0f8c9f93429ba086c87129a5a5278459ef9bf5086796f965de6bb590eb
MD5 cdfe3bfcffce37b735db28b990e0e75d
SHA1 10fcc72dbca613cdeb1688a1e81d57860e725391
SHA512 aa4fd30e7b65542707ff3d69762d76ffd20401fccc3a77700f32022e1502f808b5add83c53ca9d570e4598101347cf62bd0ccab9a837d4c9674f71bb03c2250a
SSDEEP 98304:7MKT/zrG7mUAEadvSo8GTeY7uOO+vWLZZZdZt8F:71zrG7mUAEadvSo47+eLZZZdZt8
TLSH
T134369E307306C1BEC98142F06D2D7A6F946C9B590BB44CD7E3D82E2D59B2AD22F33965
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3392887

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize FindFirstFileW FindNextFileW FindClose GetFileAttributesW CreateDirectoryW RemoveDirectoryW FileTimeToSystemTime DeleteFileW FileTimeToLocalFileTime CopyFileW GetFileTime ExitProcess GlobalAlloc GlobalFree GlobalLock GlobalUnlock CreateMutexA GetLastError UnmapViewOfFile CreateFileMappingA OpenFileMappingA MapViewOfFile QueryPerformanceFrequency QueryPerformanceCounter SizeofResource FindResourceA LockResource LoadResource VerifyVersionInfoA GetLocaleInfoA GetNativeSystemInfo VerSetConditionMask GlobalMemoryStatusEx SetCurrentDirectoryW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle GetFileSizeEx FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleCP ReadConsoleW GetConsoleMode GetStdHandle GetFileType SetFilePointerEx GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx CreateFileW InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc GetVersionExW LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SwitchToThread SignalObjectAndWait CreateTimerQueue InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW GetCurrentThread WaitForSingleObjectEx DuplicateHandle GetModuleHandleW GetTickCount GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount SetLastError GetCPInfo TryEnterCriticalSection QueueUserWorkItem IsProcessorFeaturePresent RaiseException DecodePointer EncodePointer GetStringTypeW HeapFree SetFilePointer WriteFile ReadFile GetCurrentDirectoryW GetModuleFileNameW GetCurrentThreadId FreeLibrary LoadLibraryW GetProcAddress GetModuleHandleA WideCharToMultiByte MultiByteToWideChar GetProcessId Sleep WaitForMultipleObjects GetExitCodeProcess OpenProcess CreateEventA ResetEvent CloseHandle SetEvent WaitForSingleObject DeleteCriticalSection InitializeCriticalSection AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive LeaveCriticalSection EnterCriticalSection OutputDebugStringA K32GetProcessMemoryInfo GetCurrentProcess GetProcessHeap HeapAlloc HeapReAlloc QueryDepthSList WriteConsoleW

user32

SetActiveWindow GetWindow GetWindowThreadProcessId GetTopWindow GetCursorPos ShowCursor PtInRect GetClientRect GetForegroundWindow ScreenToClient UpdateWindow GetParent SendMessageA SetForegroundWindow DispatchMessageA TranslateMessage PeekMessageA GetKeyState LoadCursorA RegisterClassA CreateWindowExA UnregisterClassA SetTimer KillTimer SendMessageW CreatePopupMenu SetMenuItemInfoA GetMenuItemInfoA InsertMenuItemA ChangeDisplaySettingsA EnumDisplaySettingsA GetDesktopWindow DialogBoxParamA OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData TranslateAcceleratorA LoadAcceleratorsA EndDialog GetDlgItem EnableWindow IsDlgButtonChecked SetScrollInfo GetScrollInfo GetScrollPos SetScrollPos GetWindowPlacement GetDC DrawTextA ReleaseDC CloseWindow LoadMenuA OpenIcon GetMenu InsertMenuA FillRect SetKeyboardState GetKeyboardState GetSubMenu GetActiveWindow SetWindowLongA ClientToScreen GetWindowLongA ValidateRect SetWindowTextA MessageBoxA DestroyMenu SetCapture LoadIconA PostQuitMessage ReleaseCapture InvalidateRect IsIconic SetCursorPos BeginPaint EndPaint GetSystemMenu GetWindowRect DestroyWindow SetWindowPos PostMessageA GetSystemMetrics ShowWindow GetWindowTextA MoveWindow SetMenu DefWindowProcA SetFocus DrawMenuBar EnableMenuItem

gdi32

CreateFontA SelectObject CreateCompatibleDC DeleteDC SetTextColor DeleteObject BitBlt CreateCompatibleBitmap GetStockObject CreateFontIndirectA GetDeviceCaps CreateDIBSection TextOutA SetBkMode SetBkColor CreateSolidBrush

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegCloseKey RegOpenKeyExA

shell32

ShellExecuteW DragAcceptFiles DragFinish SHGetPathFromIDListA SHBrowseForFolderA SHGetMalloc DragQueryFileA SHGetFolderPathW ShellExecuteExA

ole32

CoUninitialize CoInitializeEx CoCreateInstance

imm32

ImmGetContext ImmReleaseContext ImmGetCandidateListA ImmSetCompositionWindow ImmGetOpenStatus ImmSetOpenStatus ImmNotifyIME ImmSetCompositionFontA

winmm

timeEndPeriod timeBeginPeriod timeGetTime timeGetDevCaps

wininet

HttpOpenRequestA InternetOpenA InternetAttemptConnect InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle

d3d11

D3D11CreateDevice

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

652KB

Virtual Size

652KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

108KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

493KB

Virtual Size

492KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

healingtouch_pure_en.exe

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

imm32

winmm

wininet

d3d11

generic