AT - Admin Password HG6145F1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AT - Admin Password HG6145F1.exe
Size 4.2MB
Sample260818-ss7mlsdk2x
SHA256 086e87e5847d6d196dabb23a5f04bde383ea5c223a5060e2b1417efd0492ef2d
MD5 4bfaef27cae5963f479a60d811d2542c
SHA1 84a22a744e3efd250d74eb6a0e93fcd5f685eca5
SHA512 40c130b75a3b478987705a31e066892137ff8ecc126ce3c39710d2da5e3ab2521d79d409ff4a9fad9b27e5aad81616d47c7a855c8ea8f9bf29ac07c5d6d7611e
SSDEEP 49152:alP2ZKLboaVbo+KwJg58ipsn7HQCJMCFeFiSod4WCxDIbStqzm3+g:aow+8HHuozSTO
TLSH
T15716296B62A4916AC12EC13AC0E3CB72D433BCB51733C5DB52D00EA77E1A6C55E7E261
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AT - Admin Password HG6145F1.exe

File Explorer

AT - Admin Password HG6145F1.exe

.exe 4.2MB

AT - Admin Password HG6145F1.exe

IMPHASH 62e18812468319ff5ac5a5f3816851a4
SHA256 086e87e5847d6d196dabb23a5f04bde383ea5c223a5060e2b1417efd0492ef2d
MD5 4bfaef27cae5963f479a60d811d2542c
SHA1 84a22a744e3efd250d74eb6a0e93fcd5f685eca5
SHA512 40c130b75a3b478987705a31e066892137ff8ecc126ce3c39710d2da5e3ab2521d79d409ff4a9fad9b27e5aad81616d47c7a855c8ea8f9bf29ac07c5d6d7611e
SSDEEP 49152:alP2ZKLboaVbo+KwJg58ipsn7HQCJMCFeFiSod4WCxDIbStqzm3+g:aow+8HHuozSTO
TLSH
T15716296B62A4916AC12EC13AC0E3CB72D433BCB51733C5DB52D00EA77E1A6C55E7E261
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3356752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW GetDefaultPrinterW EnumPrintersW

comdlg32

FindTextW GetSaveFileNameW GetOpenFileNameW

comctl32

ImageList_GetImageInfo FlatSB_SetScrollInfo ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB ImageList_Copy FlatSB_GetScrollInfo ImageList_Write ImageList_DrawIndirect ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_Replace ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_LoadImageW ImageList_Draw ImageList_Remove ImageList_ReplaceIcon ImageList_SetOverlayImage

shell32

Shell_NotifyIconW SHAppBarMessage

user32

CopyImage CreateWindowExW GetMenuItemInfoW SetMenuItemInfoW DefFrameProcW GetDCEx PeekMessageW MonitorFromWindow GetDlgCtrlID GetUpdateRect SetTimer WindowFromPoint BeginPaint RegisterClipboardFormatW FrameRect MapVirtualKeyW IsWindowUnicode RegisterWindowMessageW FillRect GetMenuStringW DispatchMessageW CreateAcceleratorTableW SendMessageA DefMDIChildProcW EnumWindows GetClassInfoW ShowOwnedPopups GetSystemMenu GetScrollRange GetScrollPos SetScrollPos GetActiveWindow SetActiveWindow DrawEdge GetKeyboardLayoutList LoadBitmapW DrawFocusRect EnumChildWindows GetScrollBarInfo ReleaseCapture UnhookWindowsHookEx LoadCursorW GetCapture SetCapture CreatePopupMenu ScrollWindow ShowCaret GetMenuItemID GetLastActivePopup CharLowerBuffW GetSystemMetrics PostMessageW DrawMenuBar SetParent IsZoomed CharUpperBuffW GetClientRect IsChild GetClassLongPtrW SetClassLongPtrW ClientToScreen GetClipboardData SetClipboardData SetWindowPlacement IsIconic CallNextHookEx GetMonitorInfoW ShowWindow CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow SetForegroundWindow GetWindowTextW EnableWindow DestroyWindow IsDialogMessageW EndMenu RegisterClassW CharNextW GetWindowThreadProcessId RedrawWindow GetDC GetFocus SetFocus EndPaint ReleaseDC MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW ActivateKeyboardLayout GetParent DrawTextW SetScrollRange MonitorFromRect InsertMenuItemW PeekMessageA GetPropW MessageBoxW MessageBeep SetPropW RemovePropW UpdateWindow GetSubMenu MsgWaitForMultipleObjects DestroyMenu DestroyIcon SetWindowsHookExW EmptyClipboard IsWindowVisible GetDlgItem DispatchMessageA UnregisterClassW GetTopWindow SendMessageW AdjustWindowRectEx DrawIcon IsWindow EnumThreadWindows InvalidateRect GetKeyboardState DrawFrameControl ScreenToClient GetWindowLongPtrW SetWindowLongPtrW BringWindowToTop SetCursor CreateIcon CreateMenu LoadStringW CharLowerW SetWindowPos SetWindowRgn GetMenuItemCount RemoveMenu GetSysColorBrush GetKeyboardLayoutNameW GetWindowDC TranslateMessage OpenClipboard DrawTextExW MapWindowPoints EnumDisplayMonitors CallWindowProcW CloseClipboard DestroyCursor GetScrollInfo SetWindowTextW GetMessageExtraInfo EnableScrollBar GetSysColor TrackPopupMenu CopyIcon DrawIconEx PostQuitMessage GetClassNameW ShowScrollBar EnableMenuItem GetIconInfo GetMessagePos SetScrollInfo GetKeyNameTextW GetDesktopWindow GetCursorPos SetCursorPos HideCaret GetMenu GetMenuState SetMenu SetRect GetKeyState FindWindowExW MonitorFromPoint ValidateRect SystemParametersInfoW LoadIconW GetCursor GetWindow GetWindowRect InsertMenuW KillTimer WaitMessage IsWindowEnabled IsDialogMessageA TranslateMDISysAccel GetWindowPlacement CreateIconIndirect FindWindowW DeleteMenu GetKeyboardLayout

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

SafeArrayPutElement GetErrorInfo VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantChangeType

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

advapi32

RegSetValueExW RegConnectRegistryW RegEnumKeyExW RegLoadKeyW RegDeleteKeyW RegOpenKeyExW RegQueryInfoKeyW RegUnLoadKeyW RegSaveKeyW RegDeleteValueW RegReplaceKeyW RegFlushKey RegQueryValueExW RegEnumValueW RegCloseKey RegCreateKeyExW RegRestoreKeyW

kernel32

RtlUnwindEx GetACP CloseHandle LocalFree GetCurrentProcessId SizeofResource QueryPerformanceFrequency IsDebuggerPresent VirtualFree GetFullPathNameW GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy ReadFile GetLastError GetModuleFileNameW SetLastError GlobalAlloc GlobalUnlock FindResourceW CreateThread CompareStringW LoadLibraryA ResetEvent MulDiv FreeResource GetVersion RaiseException GlobalAddAtomW FormatMessageW OpenProcess SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery GlobalFindAtomW VirtualQueryEx GlobalFree Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetStartupInfoW GlobalDeleteAtom GetFileAttributesW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority GlobalLock AllocConsole VirtualAlloc GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage SetConsoleTitleW lstrlenW QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW EnumResourceNamesW FreeConsole GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection TlsGetValue GetDateFormatW SetErrorMode IsValidLocale TlsSetValue GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc CreateEventW WaitForMultipleObjectsEx SetThreadLocale GetThreadLocale

ole32

IsEqualGUID OleInitialize OleUninitialize CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree CoTaskMemAlloc

api-ms-win-crt-string-l1-1-0

memset

gdi32

Pie SetBkMode CreateCompatibleBitmap GetEnhMetaFileHeader RectVisible AngleArc ResizePalette SetAbortProc SetTextColor StretchBlt RoundRect RestoreDC SetRectRgn GetTextMetricsW GetWindowOrgEx CreatePalette PolyBezierTo CreateICW CreateDCW GetStockObject CreateSolidBrush Polygon MoveToEx PlayEnhMetaFile Ellipse StartPage GetBitmapBits StartDocW AbortDoc GetSystemPaletteEntries GetEnhMetaFileBits GetEnhMetaFilePaletteEntries CreatePenIndirect CreateFontIndirectW PolyBezier EndDoc GetObjectW GetWinMetaFileBits SetROP2 GetEnhMetaFileDescriptionW ArcTo Arc SelectPalette ExcludeClipRect MaskBlt SetWindowOrgEx EndPage DeleteEnhMetaFile Chord SetDIBits SetViewportOrgEx CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable CreateBrushIndirect PatBlt SetEnhMetaFileBits Rectangle SaveDC DeleteDC FrameRgn BitBlt GetDeviceCaps GetTextExtentPoint32W GetClipBox IntersectClipRect Polyline CreateBitmap SetWinMetaFileBits CombineRgn GetStretchBltMode CreateDIBitmap SetStretchBltMode GetDIBits CreateDIBSection LineTo GetRgnBox EnumFontsW CreateHalftonePalette SelectObject DeleteObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW SetBkColor CreateCompatibleDC GetBrushOrgEx GetCurrentPositionEx GetNearestPaletteIndex GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel GdiFlush SetPixel EnumFontFamiliesExW StretchDIBits GetPaletteEntries

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

300KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

52KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

113B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

640B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

109B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pdata

Size

185KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

248KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AT - Admin Password HG6145F1.exe

winspool.drv

comdlg32

comctl32

shell32

user32

version

oleaut32

wtsapi32

advapi32

kernel32

ole32

api-ms-win-crt-string-l1-1-0

gdi32

generic