XyronMacroPremium[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
XyronMacroPremium.exe
Size 574KB
Sample260808-xgdydasgrd
SHA256 644ebe2f04f2f3da6c9f87a066ea0a2520db8442abe2a32c4975682c5ed25e81
MD5 1270b65e8696b54a991585bb7ef4a858
SHA1 a938fdabd87ed75ac0bcf43519e85bce525d96ec
SHA512 385aabe25c55fc55e1143ed676678b9914ef3d414da7df57598b9f8f3640d49d96ff50e780bbe92d289920d6e6e680f23caaff584a6db48b77fbf6317226f5b0
SSDEEP 6144:tjpsO5sR4Hx366Cgz8bhyu9uGJX9P93yvqTqb/c/PFcwcnoaHaiJCzf7lmCHQdHU:ti1xjz8IJNP93uvk3FcklV7oWQ9/4gZ
TLSH
T18CC4AE54A3E501FAE177D2B8CD675906EA7278460730AACF0390D9771F336D49A3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XyronMacroPremium.exe

File Explorer

XyronMacroPremium.exe

.exe 574KB

XyronMacroPremium.exe

IMPHASH 56cbb4152feb4be5f098544d685ff5a0
SHA256 644ebe2f04f2f3da6c9f87a066ea0a2520db8442abe2a32c4975682c5ed25e81
MD5 1270b65e8696b54a991585bb7ef4a858
SHA1 a938fdabd87ed75ac0bcf43519e85bce525d96ec
SHA512 385aabe25c55fc55e1143ed676678b9914ef3d414da7df57598b9f8f3640d49d96ff50e780bbe92d289920d6e6e680f23caaff584a6db48b77fbf6317226f5b0
SSDEEP 6144:tjpsO5sR4Hx366Cgz8bhyu9uGJX9P93yvqTqb/c/PFcwcnoaHaiJCzf7lmCHQdHU:ti1xjz8IJNP93uvk3FcklV7oWQ9/4gZ
TLSH
T18CC4AE54A3E501FAE177D2B8CD675906EA7278460730AACF0390D9771F336D49A3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

154608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt DeleteDC DeleteObject CreateCompatibleDC CreateCompatibleBitmap SelectObject GetStockObject

gdiplus

GdiplusStartup GdipCreateLineBrush GdipAddPathLine GdipSetStringFormatLineAlign GdipMeasureString GdipDrawImageRectI GdipFillEllipseI GdipDrawEllipseI GdipDrawLineI GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipGraphicsClear GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipFillPath GdipFillEllipse GdipFillRectangleI GdipDrawPath GdipDrawRectangleI GdipSetTextRenderingHint GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromFile GdipDisposeImage GdipCloneImage GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipAddPathArc GdipClosePathFigure GdipDeletePath GdipCreatePath GdipFree GdipAlloc GdiplusShutdown GdipDeleteFont

user32

FindWindowW DefWindowProcW PostQuitMessage RegisterClassExW DispatchMessageW DestroyWindow SetWindowPos OpenClipboard CloseClipboard MessageBoxW CreateWindowExW TranslateMessage SetClipboardData GetClipboardData EmptyClipboard SetCapture ReleaseDC GetMessageW UpdateLayeredWindow PeekMessageW GetClientRect PostMessageW SetWindowLongPtrW GetWindowLongPtrW SetLayeredWindowAttributes ShowWindow GetKeyNameTextW MapVirtualKeyW SendInput mouse_event GetAsyncKeyState LoadCursorW GetCursorPos GetWindowRect InvalidateRect EndPaint BeginPaint UpdateWindow GetSystemMetrics GetDC KillTimer SetTimer ReleaseCapture

winmm

timeBeginPeriod timeEndPeriod

shell32

ShellExecuteW SHGetFolderPathW

wininet

InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA InternetOpenW InternetConnectW HttpOpenRequestW HttpSendRequestW

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA RegOpenKeyExW RegQueryValueExW

vmprotectsdk64

VMProtectEnd VMProtectBeginUltra

iphlpapi

GetAdaptersInfo

kernel32

GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindFirstFileExW HeapReAlloc SetFilePointerEx GetFileSizeEx GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetProcAddress TerminateProcess GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlushFileBuffers FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCPInfo GetStringTypeW LCMapStringEx MultiByteToWideChar DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread GetCurrentThreadId SwitchToThread WaitForSingleObjectEx QueryPerformanceFrequency QueryPerformanceCounter GetModuleFileNameW ExitProcess GetCurrentProcessId WriteFile WritePrivateProfileStringW GetPrivateProfileStringW GetConsoleOutputCP GetConsoleMode HeapSize SetEndOfFile ReadFile ReadConsoleW GetPrivateProfileIntW GetFileAttributesW FindNextFileW WriteConsoleW FlsFree CreateFileW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetLastError ReleaseMutex CreateMutexW Sleep GetCurrentProcess GetModuleHandleW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentVariableW CreateDirectoryW GetVolumeInformationA GlobalAlloc GlobalUnlock GlobalLock WideCharToMultiByte GetTickCount64 DeleteFileW FindClose FindFirstFileW

Name

.text

Size

324KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

XyronMacroPremium.exe

gdi32

gdiplus

user32

winmm

shell32

wininet

advapi32

vmprotectsdk64

iphlpapi

kernel32

generic