SecsToTool[.]Net_v3[.]2[.]5[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SecsToTool.Net_v3.2.5.exe
Size 60.0MB
Sample260826-phs5padb89
SHA256 f5456097e957ad2492ba146586e6637b94538461e597c092521d8bbe43deabdd
MD5 dfa89c8b82d5e42959dbd27bbb016cbb
SHA1 e8d10a0477c02e4f0c90516251909a09fe0f60af
SHA512 29bd255045cbae5630ae1dae5fbb925f779d47e0a4266df8703759117f00d04a459224419ad0aa8b276ec565f63c587fca673f8a8f4e260ca4b5f861dff00a01
SSDEEP 1572864:SSbp940J2Q/2+Zrqr2mxtoZYPinkJI104:So4m2QDqiwoZaisI104
TLSH
T128D73327609A01DEC47A85768D1F0D31E7A13C534B3182AB7671FD962EFB6907E2B708
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecsToTool.Net_v3.2.5.exe

File Explorer

SecsToTool.Net_v3.2.5.exe

.exe 60.0MB

SecsToTool.Net_v3.2.5.exe

IMPHASH 14b74988216179cd0a33117abbbaefac
SHA256 f5456097e957ad2492ba146586e6637b94538461e597c092521d8bbe43deabdd
MD5 dfa89c8b82d5e42959dbd27bbb016cbb
SHA1 e8d10a0477c02e4f0c90516251909a09fe0f60af
SHA512 29bd255045cbae5630ae1dae5fbb925f779d47e0a4266df8703759117f00d04a459224419ad0aa8b276ec565f63c587fca673f8a8f4e260ca4b5f861dff00a01
SSDEEP 1572864:SSbp940J2Q/2+Zrqr2mxtoZYPinkJI104:So4m2QDqiwoZaisI104
TLSH
T128D73327609A01DEC47A85768D1F0D31E7A13C534B3182AB7671FD962EFB6907E2B708
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

329088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\CodeBases\isdev\redist\Language Independent\x64\setup.pdb

comctl32

ord17

kernel32

SetFileAttributesW WaitForSingleObject GetSystemTimeAsFileTime GetPrivateProfileStringW MoveFileW GetSystemInfo MulDiv RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadLibraryExW GetVersion GetLocalTime IsValidLocale GetCommandLineW GetFileAttributesW GlobalAlloc GlobalFree FlushFileBuffers VirtualQuery IsBadReadPtr GetDiskFreeSpaceExW GetDriveTypeW GetCurrentProcess GetExitCodeProcess GetCurrentThread GetLocaleInfoW VirtualProtect LoadLibraryExA GetModuleHandleW GetProcAddress GetSystemDirectoryA LoadLibraryA GetLastError SetLastError CreateFileW GetFileSize CloseHandle CreateFileMappingW MapViewOfFile UnmapViewOfFile lstrlenA MultiByteToWideChar WideCharToMultiByte ReadFile SetFilePointer WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW LCMapStringW HeapReAlloc HeapSize GetStringTypeW GetFileType GetACP GetStdHandle GetModuleHandleExW ExitProcess GetFullPathNameW RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RtlPcToFileHeader RtlUnwindEx InitializeCriticalSectionEx LocalAlloc FindFirstFileW FindClose CreateDirectoryW CompareFileTime VerLanguageNameW GetUserDefaultLangID GetSystemDefaultLangID lstrcmpiW lstrcmpW LoadLibraryW FreeLibrary CompareStringA CompareStringW lstrcatW GetVersionExW CreateEventW QueryPerformanceFrequency GetTempFileNameW CopyFileW GetTickCount GetExitCodeThread CreateThread FindResourceW GlobalUnlock FindNextFileW GlobalLock SizeofResource LockResource LoadResource lstrcpyW SetErrorMode GetTempPathW ExpandEnvironmentStringsW FormatMessageW LocalFree GetWindowsDirectoryW GetSystemDirectoryW CreateProcessW Sleep RemoveDirectoryW DeleteFileW lstrlenW lstrcpynW GetModuleFileNameW GetProcessHeap HeapFree HeapAlloc WriteFile SystemTimeToFileTime lstrcmpA ResetEvent SetEvent GetTimeFormatW GetDateFormatW FindResourceExW OpenProcess GetProcessTimes SetFileTime GetCurrentDirectoryW InitializeSListHead GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext OutputDebugStringW IsDebuggerPresent

user32

PostMessageW DefWindowProcW PostQuitMessage DispatchMessageW TranslateMessage GetMessageW CreateWindowExW CharPrevW SendDlgItemMessageW wvsprintfW LoadImageW CreateDialogParamW MoveWindow SetCursor GetWindow GetDlgItemTextW EnableWindow SetFocus SetForegroundWindow SetActiveWindow RegisterClassW IsDialogMessageW FindWindowW SubtractRect IntersectRect SetRect FillRect GetSysColorBrush GetSysColor GetWindowRect GetDC GetSystemMetrics GetDlgCtrlID CreateDialogIndirectParamW DestroyWindow IsWindow SendMessageW MessageBoxW CharNextW WaitForInputIdle SetWindowLongPtrW GetWindowLongPtrW GetClientRect EndPaint BeginPaint ReleaseDC GetWindowDC SetWindowPos SetWindowTextW GetDlgItem EndDialog DialogBoxIndirectParamW ShowWindow ExitWindowsEx CharUpperW GetDesktopWindow MsgWaitForMultipleObjects PeekMessageW wsprintfW LoadIconW LoadCursorW KillTimer SetTimer SetDlgItemTextW

gdi32

TranslateCharsetInfo UnrealizeObject CreateHalftonePalette GetDIBColorTable SelectPalette RealizePalette GetSystemPaletteEntries CreatePalette CreateFontW GetObjectW SetTextColor SetBkMode GetDeviceCaps CreateSolidBrush CreateFontIndirectW SetStretchBltMode StretchBlt SelectObject DeleteDC CreateDIBitmap CreateCompatibleDC BitBlt DeleteObject GetStockObject

advapi32

GetTokenInformation RegOpenKeyExW CryptDestroyHash CryptCreateHash CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegOpenKeyW RegOverridePredefKey LookupPrivilegeValueW AdjustTokenPrivileges RegQueryValueExW RegCloseKey FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken OpenProcessToken SetEntriesInAclW SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateWellKnownSid RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegSetValueExW RegEnumValueW RegCreateKeyExW RegDeleteValueW

shell32

SHGetMalloc SHBrowseForFolderW SHGetPathFromIDListW SHGetFolderPathW ShellExecuteW CommandLineToArgvW ShellExecuteExW

ole32

StringFromGUID2 CoCreateGuid CLSIDFromProgID CoTaskMemAlloc CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeSecurity CoInitialize CoTaskMemRealloc

oleaut32

VarUI4FromStr GetErrorInfo RegisterTypeLi LoadTypeLi SetErrorInfo SystemTimeToVariantTime CreateErrorInfo VarBstrFromDate UnRegisterTypeLi SysAllocStringLen SysFreeString VarBstrCat SysAllocStringByteLen SysStringByteLen SysAllocString SysStringLen SysReAllocStringLen

shlwapi

PathFileExistsW

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

Name

.text

Size

530KB

Virtual Size

530KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

188KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

504B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

308KB

Virtual Size

307KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SecsToTool.Net_v3.2.5.exe

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

rpcrt4

generic