5c9fd4652eee430ce5553e7602fceaa7e8e28777ab92d76b7d79d5111ecb8c13

Sharing

Copy URL Twitter E-mail

General

Target
5c9fd4652eee430ce5553e7602fceaa7e8e28777ab92d76b7d79d5111ecb8c13
Size 6.3MB
Sample260822-xp45jayble
SHA256 5c9fd4652eee430ce5553e7602fceaa7e8e28777ab92d76b7d79d5111ecb8c13
MD5 f258fbafac5dab130aa8589f959a0a1d
SHA1 f00bde520ecb327e2107737a8d990aead5b2bbf9
SHA512 8de66630ea108c34a46a5dd881d8fcd429637fd8291a523b91c93c9b566b26ba372a3c72f3d874161eee65aff725e151eb5521e50af186a1e1dff58bfad28e43
SSDEEP 98304:uMuL80j6p4wGNusLsUyxlkvVYdJi5Ah1NS699xzPrP7FgG1:u3j6nEusfVYdJi2P9BnFgG1
TLSH
T185669E02B9E18435E5730232766573A6EDBDB9A29B3194CBB39C122F0F709C54B3BB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c9fd4652eee430ce5553e7602fceaa7e8e28777ab92d76b7d79d5111ecb8c13

File Explorer

5c9fd4652eee430ce5553e7602fceaa7e8e28777ab92d76b7d79d5111ecb8c13

.exe 6.3MB

5c9fd4652eee430ce5553e7602fceaa7e8e28777ab92d76b7d79d5111ecb8c13

IMPHASH b1c5b00705207dd0cd7732257f84f8dc
SHA256 5c9fd4652eee430ce5553e7602fceaa7e8e28777ab92d76b7d79d5111ecb8c13
MD5 f258fbafac5dab130aa8589f959a0a1d
SHA1 f00bde520ecb327e2107737a8d990aead5b2bbf9
SHA512 8de66630ea108c34a46a5dd881d8fcd429637fd8291a523b91c93c9b566b26ba372a3c72f3d874161eee65aff725e151eb5521e50af186a1e1dff58bfad28e43
SSDEEP 98304:uMuL80j6p4wGNusLsUyxlkvVYdJi5Ah1NS699xzPrP7FgG1:u3j6nEusfVYdJi2P9BnFgG1
TLSH
T185669E02B9E18435E5730232766573A6EDBDB9A29B3194CBB39C122F0F709C54B3BB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1546268

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

CareUEyes.pdb

winmm

timeSetEvent mciSendStringW timeKillEvent

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

kernel32

FindNextFileW GetFileAttributesExW GetCurrentDirectoryW MapViewOfFile GetVolumeInformationW GetFileAttributesW GetTempPathW CreateDirectoryW SetFilePointerEx SetEndOfFile FlushFileBuffers GetFileInformationByHandle CreateToolhelp32Snapshot GetFileSizeEx FormatMessageW TryEnterCriticalSection GetSystemTimeAsFileTime SystemTimeToFileTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetVersionExW GetSystemInfo GetSystemDirectoryW GetTimeZoneInformation GetUserDefaultLangID FindFirstChangeNotificationW FindCloseChangeNotification WaitForMultipleObjects FindNextChangeNotification Process32FirstW Process32NextW ResetEvent OpenFileMappingW IsBadReadPtr GetSystemTime GetCurrentDirectoryA GetModuleFileNameA GetVersionExA HeapCreate FreeResource GetFullPathNameW SleepEx VerSetConditionMask QueryPerformanceFrequency VerifyVersionInfoW QueryPerformanceCounter MoveFileExA CompareFileTime GetFileType GetStdHandle PeekNamedPipe FormatMessageA InterlockedDecrement WriteFile UnmapViewOfFile SuspendThread GetThreadContext lstrlenA InterlockedIncrement VirtualFree GlobalAlloc VirtualAlloc FlushInstructionCache VirtualProtect GetEnvironmentVariableW GetEnvironmentVariableA CreateProcessW ResumeThread TerminateProcess FindFirstFileW ReadProcessMemory LoadLibraryExA LoadLibraryA GetComputerNameA OutputDebugStringW IsBadWritePtr SetLastError ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber ReadConsoleA SetConsoleMode WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode GetACP GetDriveTypeW SetStdHandle GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetStartupInfoW UnhandledExceptionFilter LocalFree GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW GetExitCodeThread SwitchToThread WaitForSingleObjectEx DuplicateHandle IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent lstrcmpW ExitProcess GlobalAddAtomA Sleep InterlockedCompareExchange GetModuleHandleA SetEvent CreateEventW WaitForSingleObject InitializeCriticalSection GetProcessHeap FindClose ReadFile CreateFileMappingW GetFileSize GlobalLock GlobalUnlock MulDiv WideCharToMultiByte OutputDebugStringA DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateThread LoadLibraryW GetProcAddress FreeLibrary GetLastError CloseHandle SetUnhandledExceptionFilter GetCurrentProcess GetCurrentProcessId GetCommandLineA GetModuleHandleW GetLocalTime GetTickCount HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetCommandLineW SetCurrentDirectoryW InitializeCriticalSectionAndSpinCount lstrcmpiW LockResource SizeofResource FindResourceExW DecodePointer RaiseException MultiByteToWideChar DeleteFileW LoadResource FindResourceW LoadLibraryExW GetCurrentThread GetModuleFileNameW VirtualQuery GetCurrentThreadId CreateFileW

user32

ReleaseDC MessageBoxW GetActiveWindow IsWindowVisible GetFocus GetParent ShowWindow SetWindowPos DestroyWindow SendMessageW UnregisterClassW CharNextW PtInRect GetDC OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindow MsgWaitForMultipleObjects CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW SetClassLongW GetClassLongW RemovePropW GetPropW SetPropW SetMenuContextHelpId GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenu AppendMenuW GetMenuItemCount DestroyMenu DrawTextW SystemParametersInfoA CharLowerBuffW MapVirtualKeyA UpdateLayeredWindow OffsetRect DispatchMessageW FindWindowW GetWindowRect MonitorFromRect PostMessageW UnhookWinEvent SetWinEventHook GetForegroundWindow GetCursorPos WindowFromPoint GetMonitorInfoW BringWindowToTop GetUserObjectInformationW GetProcessWindowStation DrawIconEx SetWindowLongW SetForegroundWindow MonitorFromPoint GetSystemMetrics GetAsyncKeyState UnregisterHotKey RegisterHotKey EnumDisplayMonitors CopyRect ScreenToClient GetWindowLongW MonitorFromWindow GetClassNameW GetShellWindow GetAncestor LockWorkStation GetWindowThreadProcessId SystemParametersInfoW AttachThreadInput SetCapture GetCapture ReleaseCapture ClientToScreen InvalidateRect SetCursor SetActiveWindow PostQuitMessage GetDesktopWindow CreateWindowExW SetWindowTextW GetWindowTextW GetWindowTextLengthW MoveWindow GetClientRect BeginPaint EndPaint InvalidateRgn RedrawWindow SetFocus GetWindow IsChild GetDlgCtrlID GetDlgItem GetSysColor DestroyAcceleratorTable FillRect CreateAcceleratorTableW DefWindowProcW RegisterWindowMessageW GetClassInfoExW LoadCursorW CreatePopupMenu IsMenu IsWindowEnabled EnableWindow LoadImageW CreateIconFromResource LoadBitmapW GetIconInfo MapWindowPoints SetCaretPos HideCaret GetCaretBlinkTime CreateCaret UpdateWindow AnimateWindow TrackMouseEvent PeekMessageW EnableMenuItem TranslateMessage RegisterClassExW CallWindowProcW SetTimer KillTimer GetWindowLongA SetLayeredWindowAttributes IsIconic EnumDisplayDevicesW DestroyIcon SendMessageA GetWindowDC GetWindowRgn IsZoomed SetSysColors DestroyCursor GetMessageW EqualRect IsRectEmpty UnionRect IntersectRect InflateRect SetRect GetKeyState

gdi32

SetDeviceGammaRamp GetObjectW GetStockObject DeleteDC CreateCompatibleBitmap CreateSolidBrush DeleteObject SelectObject SetBkMode SaveDC SetViewportOrgEx CreateFontIndirectW EnumFontsW CreateRectRgn CreatePen SetROP2 CreateHatchBrush FrameRgn Rectangle SetGraphicsMode CreateRoundRectRgn ExcludeClipRect GetDeviceCaps RestoreDC ExtCreateRegion GetRegionData IntersectClipRect SelectClipRgn CreateDIBSection GetCurrentObject GetViewportOrgEx CreateBitmap StretchBlt GetFontUnicodeRanges GetGlyphIndicesW GetTextExtentPointI AddFontMemResourceEx RemoveFontMemResourceEx SetTextColor SetTextAlign GetTextMetricsW SetWorldTransform ExtTextOutW GetTextFaceW GdiFlush BitBlt CreateCompatibleDC EnumFontFamiliesExW GetCharABCWidthsW GetFontData GetGlyphOutlineW GetOutlineTextMetricsW

comdlg32

GetOpenFileNameW ChooseColorW

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegNotifyChangeKeyValue RegQueryValueExW GetUserNameA RegDeleteValueW RegCreateKeyExW RegSetValueExW CryptEnumProvidersW

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW Shell_NotifyIconW SHFileOperationW SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderLocation ord680 ShellExecuteW

ole32

CoTaskMemAlloc CoCreateInstance OleUninitialize CoTaskMemRealloc CLSIDFromString CLSIDFromProgID CoGetClassObject CoTaskMemFree OleLockRunning IIDFromString CoCreateGuid CreateBindCtx StringFromGUID2 CreateStreamOnHGlobal OleInitialize

oleaut32

SysAllocString VarUI4FromStr VariantTimeToSystemTime SystemTimeToVariantTime VarBstrFromDate SysAllocStringLen SysStringLen LoadTypeLi VariantInit VariantClear OleCreateFontIndirect DispCallFunc SysFreeString LoadRegTypeLi VarUdateFromDate

shlwapi

PathFileExistsW PathIsDirectoryW PathFindExtensionW PathRemoveFileSpecW PathAppendW StrToIntExW PathQuoteSpacesW

gdiplus

GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipAlloc GdipFree GdipImageGetFrameCount GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipGraphicsClear GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipBitmapLockBits

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeA GetFileVersionInfoA GetFileVersionInfoSizeW

dwmapi

DwmGetWindowAttribute

ws2_32

getsockname getpeername connect bind WSAGetLastError send recv closesocket getsockopt htons ntohs setsockopt WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl listen ioctlsocket __WSAFDIsSet select getaddrinfo freeaddrinfo recvfrom shutdown sendto gethostname socket getnameinfo

iphlpapi

GetAdaptersInfo

imm32

ImmGetContext ImmReleaseContext ImmAssociateContext

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore

wldap32

ord208 ord41 ord46 ord145 ord216 ord14 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord301 ord133 ord147 ord219

usp10

ScriptShape ScriptItemize ScriptFreeCache

generic

count=41, id=241, version=40116,

count=206, id=243, version=40116,

count=41, id=242, version=40116,

count=9, id=199, version=41118,

count=28, id=259, version=26706,

count=8, id=261, productName=VS2017 v15.9.7 build 27027, version=27027,

count=22, id=260, version=27041,

count=41, id=260, version=26706,

count=136, id=261, version=26706,

count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=13, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=21, productName=Unmarked objects (old),

count=658, id=260, version=27038,

count=5, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=49, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=689, id=1, productName=Unmarked objects,

count=344, id=261, version=27041,

count=85, id=261, version=27054,

count=7, id=261, version=27051,

count=144, id=265, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,