8ebc676bfa549b69a5a6260d59066718fc07717f70a566d9832b90a12ff3dd26

Sharing

Copy URL Twitter E-mail

General

Target
8ebc676bfa549b69a5a6260d59066718fc07717f70a566d9832b90a12ff3dd26
Size 14.0MB
Sample260809-edagnsgr4x
SHA256 8ebc676bfa549b69a5a6260d59066718fc07717f70a566d9832b90a12ff3dd26
MD5 416b9753d46e4b8e91af3b60cc93052e
SHA1 143235bb56ededc720ff788e4b4a548748375747
SHA512 768ea538a497684cca482a4260cd060035be5b5ca636f602e0f1816b6a02684430b5d92241a79e46288fb9acd7a1f4a3db1863039d9ece4c9f7010edec1dac29
SSDEEP 196608:LdnUG2qhJUpzeKpM7sjX3fMKZoTUWkf+2M6ERPzpSWuLMbybnaVdLtwKz:LdnUNqcBeNsjX3fMKPdKOLMbinkLf
TLSH
T1A0E61212FB92C071E9D20071996DABBE0439AE254B24D5D397C43E3E5E312D1E73B78A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ebc676bfa549b69a5a6260d59066718fc07717f70a566d9832b90a12ff3dd26

File Explorer

8ebc676bfa549b69a5a6260d59066718fc07717f70a566d9832b90a12ff3dd26

.exe 14.0MB

8ebc676bfa549b69a5a6260d59066718fc07717f70a566d9832b90a12ff3dd26

IMPHASH 30f7d9d649cc7744b6d66ee726de5c35
SHA256 8ebc676bfa549b69a5a6260d59066718fc07717f70a566d9832b90a12ff3dd26
MD5 416b9753d46e4b8e91af3b60cc93052e
SHA1 143235bb56ededc720ff788e4b4a548748375747
SHA512 768ea538a497684cca482a4260cd060035be5b5ca636f602e0f1816b6a02684430b5d92241a79e46288fb9acd7a1f4a3db1863039d9ece4c9f7010edec1dac29
SSDEEP 196608:LdnUG2qhJUpzeKpM7sjX3fMKZoTUWkf+2M6ERPzpSWuLMbybnaVdLtwKz:LdnUNqcBeNsjX3fMKPdKOLMbinkLf
TLSH
T1A0E61212FB92C071E9D20071996DABBE0439AE254B24D5D397C43E3E5E312D1E73B78A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2178943

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\HxxGit\ZZDS_DataRecovery\ZDataRecovery\install\bin\ZDataRecovery_%s.pdb

ws2_32

WSACleanup recvfrom listen shutdown getnameinfo gethostbyname gethostname WSAStartup inet_ntoa WSAGetLastError socket __WSAFDIsSet select WSASetLastError recv send bind closesocket connect ioctlsocket accept sendto freeaddrinfo getaddrinfo WSAIoctl setsockopt ntohs htons getsockopt getsockname getpeername

kernel32

CreateMutexW FreeResource GetLastError LockResource LoadResource FindResourceW GlobalLock GlobalUnlock lstrcatW GetModuleHandleW GetModuleFileNameW MultiByteToWideChar GetCommandLineW CopyFileW GetStartupInfoW GetLogicalDrives lstrlenW WaitForSingleObject GlobalAlloc SetEnvironmentVariableA FreeEnvironmentStringsW EnumSystemLocalesW IsValidCodePage GetSystemDefaultLangID SizeofResource SetUnhandledExceptionFilter GetCurrentProcessId GetComputerNameW Sleep GetEnvironmentStringsW GetCommandLineA GetOEMCP GetTimeZoneInformation SetStdHandle FindFirstFileExW GetLocalTime HeapSize CloseHandle OutputDebugStringW GetCurrentThreadId CreateFileW OutputDebugStringA GetCurrentProcess FormatMessageW WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DuplicateHandle WaitForSingleObjectEx GetCurrentThread QueryPerformanceCounter QueryPerformanceFrequency SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetProcAddress EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo GetACP GetFileSize ReadFile LoadLibraryW SetCurrentDirectoryW GetCurrentDirectoryW ExitProcess MulDiv WriteFile SetFilePointer SetFileTime SystemTimeToFileTime LocalFileTimeToFileTime CreateDirectoryW GetFileAttributesW LocalFree RaiseException VerSetConditionMask VerifyVersionInfoW lstrcpynW InterlockedIncrement InterlockedDecrement lstrcmpiW lstrcpyW GetModuleFileNameA FindFirstFileW SetPriorityClass GetFullPathNameW FindNextFileW RemoveDirectoryW GetEnvironmentVariableW FindClose SetFileAttributesW DeleteFileA DeleteFileW SetFileAttributesA SetFilePointerEx GetModuleHandleA FreeLibrary TerminateProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetSystemDirectoryW MoveFileExW VirtualAlloc VirtualFree VirtualProtect HeapAlloc HeapFree GetProcessHeap LoadLibraryA IsBadReadPtr SetEndOfFile GetFileInformationByHandle GetStdHandle InitializeCriticalSection SleepEx ExpandEnvironmentStringsA WaitForMultipleObjects GetFileType PeekNamedPipe FormatMessageA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetModuleHandleExW SwitchToFiber DeleteFiber CreateFiber GetSystemTime ConvertFiberToThread ConvertThreadToFiber SetEvent ResetEvent InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetThreadTimes CreateTimerQueue SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread LoadLibraryExW GetVersionExW ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx GetUserDefaultLCID RtlUnwind ExitThread HeapReAlloc GetFileAttributesExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameA SetConsoleCtrlHandler GetConsoleCP FlushFileBuffers IsValidLocale WriteConsoleW

user32

BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect GetCursorPos CreateCaret GetCaretBlinkTime SetCaretPos ScreenToClient MapWindowPoints GetSysColor IntersectRect IsRectEmpty PtInRect GetParent GetWindow LoadImageW MonitorFromWindow GetMonitorInfoW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW EnableWindow SetPropW GetPropW SetWindowRgn MessageBoxW UpdateLayeredWindow GetWindowRgn ReleaseDC CharPrevW IsZoomed FillRect SetRect GetAsyncKeyState EnableMenuItem AppendMenuW TrackPopupMenu HideCaret ShowCaret GetCaretPos ClientToScreen IsWindowEnabled EqualRect SetWindowTextW GetWindowTextW GetWindowTextLengthW wsprintfA DrawTextA CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo GetKeyboardLayout GetKeyNameTextW MapVirtualKeyExW GetForegroundWindow AttachThreadInput GetWindowThreadProcessId CharUpperW GetProcessWindowStation GetUserObjectInformationW IsWindowVisible DestroyWindow IsWindow GetDC ReleaseCapture SetCapture GetKeyState GetFocus GetActiveWindow SetFocus CharNextW SetForegroundWindow FindWindowW CreateWindowExW SendMessageW DispatchMessageW TranslateMessage GetMessageW LoadCursorW GetClipboardData CloseClipboard OffsetRect OpenClipboard ShowWindow DestroyMenu UnionRect InflateRect SetCursor DrawTextW wsprintfW GetWindowLongW SetWindowLongW GetWindowRect SetWindowPos SetTimer MoveWindow KillTimer IsIconic PostMessageW CreatePopupMenu

advapi32

ReportEventW RegQueryValueExW RegOpenKeyW RegCloseKey RegOpenKeyExA RegQueryValueExA CryptEnumProvidersW CryptSignHashW RegOpenKeyExW RegSetValueExW RegCreateKeyExW DeregisterEventSource RegisterEventSourceW GetUserNameW CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash

shell32

SHGetSpecialFolderPathW SHGetPathFromIDListW ShellExecuteExW SHBrowseForFolderW ShellExecuteA DragQueryFileW ShellExecuteW CommandLineToArgvW

ole32

CoInitializeSecurity CoSetProxyBlanket OleLockRunning CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal ReleaseStgMedium OleDuplicateData DoDragDrop RegisterDragDrop CoInitialize CoUninitialize CoCreateGuid CoCreateInstance

wldap32

ord167 ord142 ord79 ord127 ord147 ord301 ord27 ord26 ord118 ord41 ord216 ord208 ord14 ord46 ord219 ord133 ord145

dbghelp

MiniDumpWriteDump

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileA

iphlpapi

GetAdaptersAddresses GetAdaptersInfo

shlwapi

PathFileExistsW PathFileExistsA PathRemoveFileSpecA

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

crypt32

CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateContext CertGetCertificateContextProperty CertDuplicateCertificateContext

gdi32

SetTextColor CreateCompatibleBitmap CreateCompatibleDC CreateDIBitmap CreateFontIndirectW CreatePen DeleteDC DeleteObject GetDeviceCaps GetStockObject AddFontMemResourceEx RemoveFontMemResourceEx Rectangle RestoreDC SaveDC SelectObject CloseEnhMetaFile CreateEnhMetaFileW GetEnhMetaFileHeader PlayEnhMetaFile GetTextMetricsW GetObjectW SetWindowOrgEx CreateRoundRectRgn CreateRectRgn PtInRegion CreateDIBSection CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode GetObjectA TextOutW GdiFlush CreatePatternBrush GetTextExtentPointA GetBitmapBits SetBitmapBits BitBlt

oleaut32

SysAllocString SysFreeString VariantInit VariantClear SysAllocStringLen SysStringLen

comctl32

InitCommonControlsEx ord17 _TrackMouseEvent

gdiplus

GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipImageGetFrameDimensionsList GdipDrawImageRectI GdipTranslateWorldTransform GdipGetPropertyItem GdipImageGetFrameCount GdipImageGetFrameDimensionsCount GdipRotateWorldTransform GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathLineI GdipAddPathArcI GdipCloneBrush GdipDeleteBrush GdipCreateTexture GdipCloneImage GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipFillPath GdipCreateSolidFill GdipCreateLineBrushFromRect GdipSetLinePresetBlend GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipSetTextRenderingHint GdipSetInterpolationMode GdipDrawLineI GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipDrawImageRectRectI GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipMeasureString GdipStringFormatGetGenericTypographic GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

711KB

Virtual Size

711KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

110.4MB

Virtual Size

110.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

127KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=26, id=241, version=40116,

count=190, id=243, version=40116,

count=32, id=242, version=40116,

count=7, id=199, version=41118,

count=28, id=259, version=24237,

count=21, productName=Unmarked objects (old),

count=74, id=261, version=24234,

count=656, id=260, version=24234,

count=52, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=39, id=260, version=24237,

count=128, id=261, version=24237,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=601, id=1, productName=Unmarked objects,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=24, id=265, version=24247,

count=1, id=255, version=24247,

count=1, id=151,

count=1, id=258, version=24247,