Touch365ChangeCode[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Touch365ChangeCode.exe
Size 110KB
Sample260901-z3kddsxeqb
SHA256 e690085ad76710c3591c4badc4aeb715cc08ad51f869d478b02e5f2de8d07bb3
MD5 075fa5156626895f1fa0cd4bdd1d4fb8
SHA1 a1ad5e000a5aa8cb030c64efe998cdb8def0bb24
SHA512 6323ac13e5f46a78a950f2cd37f86bd937ac40cb74e0d75cfa1b2972ec776c6b77a6f57c7ed252b4cf7a9587cf6432e9cd08cb1ed05782c74ece31328de77a18
SSDEEP 3072:x+KtvoZ37VnuE45iccj/B9KmoY4CHrvSYWxJVZDHC:x+MvoJXl3p74CHjmVBi
TLSH
T144B3F114B3C4C476E2665B701D3BA7B26AE2E91202B45B870760FF7FB932181D90FB56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
Touch365ChangeCode.exe
unpack001/Touch365ChangeCode.exe

File Explorer

Touch365ChangeCode.exe

.exe 110KB
Touch365ChangeCode.exe

.exe 172KB
Touch365ChangeCode.exe.config

.xml 1KB

Touch365ChangeCode.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 e690085ad76710c3591c4badc4aeb715cc08ad51f869d478b02e5f2de8d07bb3
MD5 075fa5156626895f1fa0cd4bdd1d4fb8
SHA1 a1ad5e000a5aa8cb030c64efe998cdb8def0bb24
SHA512 6323ac13e5f46a78a950f2cd37f86bd937ac40cb74e0d75cfa1b2972ec776c6b77a6f57c7ed252b4cf7a9587cf6432e9cd08cb1ed05782c74ece31328de77a18
SSDEEP 3072:x+KtvoZ37VnuE45iccj/B9KmoY4CHrvSYWxJVZDHC:x+MvoJXl3p74CHjmVBi
TLSH
T144B3F114B3C4C476E2665B701D3BA7B26AE2E91202B45B870760FF7FB932181D90FB56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

Touch365ChangeCode.exe

SHA256 c437eb5b451cbf5cd332d8c03dbdaaa46cd25af6ad9c3b8128b46fafd4de177f
MD5 3233d3a22f79a48b615838dc2c639e93
SHA1 af908477efcdd8fd1de478acb5c65f3424454c95
SHA512 4119d0f25fbbcc2df6a7df12ed88d02bd299646512e9b75c7f7cf1799b8dc8f5ee2a2e85c2c413303ecd744a4329df87008c49ea5a9802da9db6b2fd3eb01f4b
SSDEEP 3072:8BQySLc2ySX3p/99eaJjf0gfMN47FThADf6SOq/eX3+eKjTbT8w:8BQySLc2ySX3p/99eaJjf0gfc6FThALs
TLSH
T19F04A5057AF91616D9BD7DF40FF8D1948BB6E8299677C6AE1D90A0DB22A4F008B01733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\VB13 PROGS\MYPOS\myPOS Utilities\Change Code\obj\Release\Touch365ChangeCode.pdb

Touch365ChangeCode.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

Touch365ChangeCode.exe

generic

Touch365ChangeCode.exe.config