c7971028c0f93c8bdce44474f486123b3b59311f10fc9749a92d1a1601afbb11

Sharing

Copy URL Twitter E-mail

General

Target
c7971028c0f93c8bdce44474f486123b3b59311f10fc9749a92d1a1601afbb11
Size 391KB
Sample260826-pl8dsadm9x
SHA256 c7971028c0f93c8bdce44474f486123b3b59311f10fc9749a92d1a1601afbb11
MD5 71e15d94c3d6eda476df11425c339b6f
SHA1 ce3888b1d49af1afd22d33956518c6f2c889b93c
SHA512 5e4b7ed4f1225b8670af1140ed861056533e5d6265b8d1ad59393e97002fc40cf7d61477d310cbbebf535672a9b05e38d04426211c4ae80aa83d5fef09a42d13
SSDEEP 6144:/eqEXMvL8OFtTRZE9NxsQOuFuUfGx+zRbh7JenKSyqghmRdZPfpBVObqwhXsWCD:I+E9UuFuUGx+zR5JeKsghsBOqwh8
TLSH
T152847D017790DF31E2AF0536996996B45A6F7C208F248BCB63943F2DBE306C1A935B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c7971028c0f93c8bdce44474f486123b3b59311f10fc9749a92d1a1601afbb11

File Explorer

c7971028c0f93c8bdce44474f486123b3b59311f10fc9749a92d1a1601afbb11

.exe 391KB

c7971028c0f93c8bdce44474f486123b3b59311f10fc9749a92d1a1601afbb11

IMPHASH 481dfec080ea1b845561b0861ed6d245
SHA256 c7971028c0f93c8bdce44474f486123b3b59311f10fc9749a92d1a1601afbb11
MD5 71e15d94c3d6eda476df11425c339b6f
SHA1 ce3888b1d49af1afd22d33956518c6f2c889b93c
SHA512 5e4b7ed4f1225b8670af1140ed861056533e5d6265b8d1ad59393e97002fc40cf7d61477d310cbbebf535672a9b05e38d04426211c4ae80aa83d5fef09a42d13
SSDEEP 6144:/eqEXMvL8OFtTRZE9NxsQOuFuUfGx+zRbh7JenKSyqghmRdZPfpBVObqwhXsWCD:I+E9UuFuUGx+zR5JeKsghsBOqwh8
TLSH
T152847D017790DF31E2AF0536996996B45A6F7C208F248BCB63943F2DBE306C1A935B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

220218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb

psapi

GetModuleBaseNameW EnumProcessModules EnumProcesses GetModuleFileNameExW

msi

ord88 ord16 ord131 ord205 ord141 ord159 ord160 ord92 ord118 ord32 ord8

userenv

UnloadUserProfile CreateEnvironmentBlock DestroyEnvironmentBlock

kernel32

SetEvent CreateEventW GetCurrentDirectoryW ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead LCMapStringW GetStdHandle ExitProcess GetCommandLineW GetCommandLineA GetModuleHandleExW HeapQueryInformation GetFileType SetStdHandle RtlUnwind OutputDebugStringW GetFileTime GetFileSizeEx GetFileAttributesExW GetCurrentProcessId LocalReAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection CompareStringW GlobalFindAtomW GlobalAddAtomW GlobalDeleteAtom FreeLibrary GetSystemDirectoryW GetCurrentThreadId EncodePointer FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindNextFileW FileTimeToLocalFileTime LoadLibraryA LoadLibraryExW DuplicateHandle UnlockFile SetEndOfFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers GlobalFree GlobalUnlock GlobalLock GlobalAlloc LoadLibraryW GetModuleHandleA GetModuleFileNameW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetACP WideCharToMultiByte lstrcmpW lstrcmpA LocalAlloc FindResourceExW SetFilePointer FindFirstFileW FindClose Process32NextW Process32FirstW CreateToolhelp32Snapshot MultiByteToWideChar CopyFileW GetProcAddress GetModuleHandleW GetWindowsDirectoryW GetTickCount64 OpenProcess Sleep WaitForSingleObject RemoveDirectoryW ReadFile GetLongPathNameW MoveFileW FormatMessageW LocalFree FindResourceW SizeofResource LockResource LoadResource GetLocalTime GlobalFlags DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError RaiseException DecodePointer GetTempPathW SetFileAttributesW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenW GetCurrentThread GetCurrentProcess GetLastError CloseHandle WriteFile GetFileAttributesW DeleteFileW CreateFileW GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx GetDriveTypeW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW TerminateProcess WriteConsoleW

user32

PostQuitMessage LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem DestroyMenu RealChildWindowFromPoint ClientToScreen TabbedTextOutW GrayStringW DrawTextExW LoadCursorW GetSysColorBrush ReleaseDC GetDC GetWindowThreadProcessId SetWindowTextW IsWindowEnabled GetForegroundWindow MessageBoxW GetMonitorInfoW MonitorFromWindow WinHelpW LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassNameW GetClassLongW SetWindowLongW PtInRect CopyRect GetSysColor MapWindowPoints ScreenToClient AdjustWindowRectEx GetWindowRect RemovePropW DrawTextW GetClientRect GetClassInfoW SetRectEmpty OffsetRect GetParent GetSubMenu GetMenuItemID GetMenuItemCount CharUpperW GetSystemMetrics SendMessageW GetScrollPos GetWindowTextW GetWindowLongW GetWindow RegisterWindowMessageW DispatchMessageW PeekMessageW GetMessagePos GetMessageTime PostMessageW DefWindowProcW CallWindowProcW GetPropW SetPropW RedrawWindow ValidateRect EndPaint BeginPaint SetForegroundWindow SetMenu GetMenu EnableWindow GetCapture GetKeyState GetFocus GetDlgCtrlID GetDlgItem IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPos DestroyWindow IsMenu IsWindow CreateWindowExW GetClassInfoExW RegisterClassW

gdi32

ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW SetMapMode SelectObject SaveDC RestoreDC RectVisible PtVisible GetStockObject DeleteDC GetDeviceCaps SetBkColor SetTextColor CreateBitmap GetClipBox DeleteObject Escape

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

LookupAccountSidW OpenThreadToken CheckTokenMembership CopySid DuplicateToken GetLengthSid GetSidLengthRequired GetSidSubAuthority InitializeSid IsValidSid RegSetValueExW RegDeleteValueW RegCreateKeyExW RegCreateKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation GetSidSubAuthorityCount DuplicateTokenEx CreateProcessAsUserW RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken

shell32

SHGetFolderPathW ShellExecuteW SHCreateDirectoryExW

shlwapi

PathStripToRootW PathFindFileNameW PathIsUNCW

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

VariantClear VariantChangeType VariantInit

crypt32

CryptDecodeObject CryptMsgClose CryptMsgGetParam CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject

wintrust

WinVerifyTrust

oleacc

LresultFromObject CreateStdAccessibleObject

Sharing

General

Malware Config

Signatures

File Explorer

c7971028c0f93c8bdce44474f486123b3b59311f10fc9749a92d1a1601afbb11

psapi

msi

userenv

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

crypt32

wintrust

oleacc

generic