a4801d3617fd73d8612ba951c6587e574239e00d69c7c6fc36c87e5a6370e522

Sharing

Copy URL Twitter E-mail

General

Target
a4801d3617fd73d8612ba951c6587e574239e00d69c7c6fc36c87e5a6370e522
Size 2.3MB
Sample260812-njdkyswald
SHA256 a4801d3617fd73d8612ba951c6587e574239e00d69c7c6fc36c87e5a6370e522
MD5 504cba923c234973c8207cf3b161e84a
SHA1 928e7e9767522d2ca67981c1334d263c94d26d2a
SHA512 9431c6446d053b54ea08ca8d6813cb24b773944ed14f943ae7b9b087a5726b240ef602ed20872156cb650987fd08ebd6209772bf1fdd0bccc3d76f58f5e183bb
SSDEEP 49152:Ci+tM69wzGGfZaxHUGdyzC+cc9tcUEoU4lAFPL7KZFMMFP:Ci+2SwzPsx0GM++zGoU4eF+
TLSH
T142B59D20B561C232F8BB01F2DBBD5D9E952CAE71032414DB93C8586E9AB5CF27B31617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4801d3617fd73d8612ba951c6587e574239e00d69c7c6fc36c87e5a6370e522

File Explorer

a4801d3617fd73d8612ba951c6587e574239e00d69c7c6fc36c87e5a6370e522

.dll 2.3MB

a4801d3617fd73d8612ba951c6587e574239e00d69c7c6fc36c87e5a6370e522

IMPHASH 4bcc0f783474e1343e0ab6e3e3e963b1
SHA256 a4801d3617fd73d8612ba951c6587e574239e00d69c7c6fc36c87e5a6370e522
MD5 504cba923c234973c8207cf3b161e84a
SHA1 928e7e9767522d2ca67981c1334d263c94d26d2a
SHA512 9431c6446d053b54ea08ca8d6813cb24b773944ed14f943ae7b9b087a5726b240ef602ed20872156cb650987fd08ebd6209772bf1fdd0bccc3d76f58f5e183bb
SSDEEP 49152:Ci+tM69wzGGfZaxHUGdyzC+cc9tcUEoU4lAFPL7KZFMMFP:Ci+2SwzPsx0GM++zGoU4eF+
TLSH
T142B59D20B561C232F8BB01F2DBBD5D9E952CAE71032414DB93C8586E9AB5CF27B31617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1336167

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\Project\general_use\mg_faiconshelper\Release\BwSystemHelper.pdb

kernel32

EnterCriticalSection InitializeCriticalSection DeleteCriticalSection GetCurrentThreadId MultiByteToWideChar WideCharToMultiByte CloseHandle GetCurrentProcess CreateProcessW GetStartupInfoW GetTickCount64 FindResourceExW GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc K32GetProcessImageFileNameW lstrcpyW lstrcmpiW QueryDosDeviceW LeaveCriticalSection CreateDirectoryW SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA GetConsoleMode GetDynamicTimeZoneInformation GetCurrentProcessId WriteFile GetStdHandle GetTickCount CreateThread Sleep CreateMutexW ReleaseMutex WaitForMultipleObjects CreateEventW WaitForSingleObject SetEvent Process32NextW Process32FirstW CreateToolhelp32Snapshot WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW VirtualFreeEx VirtualAllocEx OpenProcess LoadLibraryW GetLogicalDriveStringsW InitializeCriticalSectionEx FreeLibrary WriteConsoleW SetEndOfFile HeapDestroy SetLastError GetLastError RaiseException FindResourceW QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete GetStringTypeW WaitForSingleObjectEx GetExitCodeThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime LocalFree EncodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA IsDebuggerPresent OutputDebugStringW GetACP VerSetConditionMask MulDiv VerifyVersionInfoW GetCurrentDirectoryW CreateFileW GetFileSize ReadFile GlobalUnlock GlobalLock lstrlenW ExitProcess GetFileAttributesW LocalFileTimeToFileTime SetFilePointer SetFileTime SystemTimeToFileTime FormatMessageW InitializeCriticalSectionAndSpinCount FreeResource GlobalAlloc lstrcmpW GetLocalTime lstrcpynW DeleteFileW FlushFileBuffers UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess CreateFileA FindClose FindFirstFileA FindNextFileA MapViewOfFile UnmapViewOfFile CreateFileMappingA GetSystemWindowsDirectoryW GetVersionExW LoadLibraryExW DeviceIoControl lstrcmpA GetFileType GetModuleHandleA GetFileSizeEx FindNextFileW RtlUnwind InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetFilePointerEx GetConsoleOutputCP GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW MoveFileExW GetFullPathNameW SetStdHandle ReadConsoleW FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW DecodePointer

user32

GetSysColor IntersectRect IsRectEmpty PtInRect SetWindowRgn UpdateLayeredWindow MoveWindow IsWindowEnabled GetWindowRgn CharPrevW DrawTextW FillRect SetRect CreatePopupMenu DestroyMenu EnableMenuItem AppendMenuW TrackPopupMenu CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen UpdateWindow ScreenToClient SetWindowTextW GetWindowTextLengthW wsprintfA DrawTextA CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo SetForegroundWindow GetKeyboardLayout GetParent MapVirtualKeyExW GetProcessWindowStation GetUserObjectInformationW MessageBoxA InflateRect CallWindowProcW GetPropW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW GetCursorPos InvalidateRect GetUpdateRect EndPaint BeginPaint ReleaseCapture SetCapture GetKeyState GetFocus GetActiveWindow SetPropW EnableWindow MapWindowPoints IsZoomed IsIconic MonitorFromPoint MessageBoxW OffsetRect EqualRect SetCursor SetFocus ShowWindow RegisterClassW UnionRect CharNextW SendMessageW MonitorFromWindow ReleaseDC GetDC PostThreadMessageW PeekMessageW GetWindowTextW IsWindowVisible PostQuitMessage DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW GetWindowThreadProcessId FindWindowExW FindWindowW SendMessageTimeoutW GetClientRect SetWindowPos PostMessageW LoadCursorW SetWindowLongW GetWindowLongW GetWindowRect KillTimer SetTimer DestroyWindow IsWindow GetMonitorInfoW LoadImageW DefWindowProcW GetWindow wsprintfW GetKeyNameTextW

gdi32

CreatePatternBrush BitBlt CreateCompatibleBitmap CreateDIBitmap CreateFontIndirectW CreatePen DeleteObject GetStockObject AddFontMemResourceEx RemoveFontMemResourceEx Rectangle RestoreDC SaveDC SelectObject CloseEnhMetaFile CreateEnhMetaFileW GetEnhMetaFileHeader PlayEnhMetaFile GetTextMetricsW GetObjectW SetWindowOrgEx CreateRoundRectRgn CreateRectRgn PtInRegion CreateDIBSection CombineRgn CreatePenIndirect CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo SelectClipRgn ExtSelectClipRgn SetBkColor GetBitmapBits GetTextExtentPointA GdiFlush TextOutW GetDeviceCaps DeleteDC CreateCompatibleDC SetBkMode StretchBlt SetStretchBltMode SetTextColor MoveToEx SetBitmapBits

advapi32

RegCreateKeyExW ReportEventA RegisterEventSourceA DeregisterEventSource RegSetValueExW GetTokenInformation RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey OpenProcessToken

shell32

DragQueryFileW ShellExecuteW SHCreateDirectoryExW

ole32

CoCreateGuid CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoInitialize CoUninitialize OleLockRunning CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal ReleaseStgMedium OleDuplicateData DoDragDrop

oleaut32

SysAllocStringLen SysStringLen VariantClear VariantInit SysFreeString SysAllocString

shlwapi

PathFileExistsW PathRemoveFileSpecW SHGetValueW PathFindFileNameW PathRemoveExtensionW PathAppendW StrStrIW StrCmpNIW StrTrimA StrStrIA StrCmpIW PathIsDirectoryW PathIsRelativeW PathIsRootW PathCombineW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

gdiplus

GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipSetPenStartCap GdipImageGetFrameDimensionsCount GdipGetPropertyItem GdipSetPenEndCap GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipDrawImageRectI GdiplusStartup GdiplusShutdown GdipCreateFromHDC GdipDeleteGraphics GdipSetTextRenderingHint GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipMeasureString GdipGetImageHeight GdipTranslateWorldTransform GdipRotateWorldTransform GdipDrawLine GdipCreatePen2 GdipDeletePen GdipAlloc GdipFree GdipCreatePath GdipDeletePath GdipAddPathLine GdipAddPathArc GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipGetImageWidth GdipSetPenMode GdipSetPenDashStyle GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipCloneImage GdipDisposeImage GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipReleaseDC GdipSetSmoothingMode GdipSetWorldTransform GdipResetWorldTransform GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipFillPath GdipDrawImageRectRect GdipDrawImageI

ws2_32

gethostbyname gethostname WSAStartup

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

comctl32

_TrackMouseEvent ord17 InitCommonControlsEx

msimg32

AlphaBlend

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

generic

count=38, id=259, version=30795,

count=223, id=261, version=30795,

count=3, productName=Unmarked objects (old),

count=21, id=260, version=35211,

count=1, id=261, version=35211,

count=11, id=260, version=35213,

count=21, id=260, version=35207,

count=6, id=265, version=35228,

count=25, id=261, version=35213,

count=1, id=263, version=30795,

count=27, id=259, version=35207,

count=98, id=261, version=35207,

count=46, id=260, version=30795,

count=1, id=262, version=30795,

count=37, id=257, version=30795,

count=526, id=1, productName=Unmarked objects,

count=69, id=261, version=35228,

count=1, id=256, version=35228,

count=1, id=255, version=35228,

count=1, id=151,

count=1, id=258, version=35228,