support[.]client[.]exe

General

Target
support.client.exe
Size 84KB
Sample260820-akqd9ack41
SHA256 9ea45ee70ae09b37383def89cc8243fc08fd0d3aca88aac7b87e2f4db95b65b7
MD5 714c29deab67d5ca51f5be5aa754fab9
SHA1 a2cdef7651e86df056bbaede76ac9c922690d1ee
SHA512 9fb0c65d1c0b120545dfac3873a56e459d1bf365bd4defbe935d031309d3e5c1f628701cf6692a8613a29fe9faa9386100c2df67d21f925a51d8addb59ef6a02
SSDEEP 1536:sXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWvlD:6E3x5KBDYiKWm/iSw0fRMvygtD
TLSH
T1EC837B43B5D19C71E9721D3124B1C9A15A3FBA111E748EBB239802AE5F341D0AE35FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
support.client.exe

File Explorer

support.client.exe

.exe 84KB

support.client.exe

IMPHASH 1273eaec87da7c0a308253f29e7857eb
SHA256 9ea45ee70ae09b37383def89cc8243fc08fd0d3aca88aac7b87e2f4db95b65b7
MD5 714c29deab67d5ca51f5be5aa754fab9
SHA1 a2cdef7651e86df056bbaede76ac9c922690d1ee
SHA512 9fb0c65d1c0b120545dfac3873a56e459d1bf365bd4defbe935d031309d3e5c1f628701cf6692a8613a29fe9faa9386100c2df67d21f925a51d8addb59ef6a02
SSDEEP 1536:sXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWvlD:6E3x5KBDYiKWm/iSw0fRMvygtD
TLSH
T1EC837B43B5D19C71E9721D3124B1C9A15A3FBA111E748EBB239802AE5F341D0AE35FBB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\jmorgan\Source\ScreenConnectWork\Misc\Bootstrapper\Release\ClickOnceRunner.pdb

crypt32

CertOpenSystemStoreA CryptMsgClose CertFreeCertificateContext CertDeleteCertificateFromStore CryptQueryObject CertCloseStore CryptMsgGetParam CertAddCertificateContextToStore CertCreateCertificateContext

kernel32

SetFilePointer LocalAlloc CreateFileW Sleep LoadLibraryA CloseHandle GetProcAddress LocalFree UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer RaiseException ReadFile GetModuleFileNameA

advapi32

SystemFunction036

Sharing