e93d60d8fa2f358e310f1c9d657bbc19b092dc9bc2900011f2ebbc54d6559230

Sharing

Copy URL Twitter E-mail

General

Target
e93d60d8fa2f358e310f1c9d657bbc19b092dc9bc2900011f2ebbc54d6559230
Size 13.2MB
Sample260903-yncjkaep7y
SHA256 e93d60d8fa2f358e310f1c9d657bbc19b092dc9bc2900011f2ebbc54d6559230
MD5 9c895ad76db0264108ba8211467fdb2f
SHA1 5259a5a5385b6d2166dd8d5f1ef718020a18f286
SHA512 644503e13d07a007754874e551592954bb2e731f057e180c1a65808520c249941781d31811c73268704db573f03fc2fd0122a79f55fed5f3ccb25445ee7ae29e
SSDEEP 393216:tbJjO9JwYjEZfN4fX2DCKeEGGgCsdi6N0cp:tbJkJ9QZfN4fGDCOGGEA6Vp
TLSH
T129D6F1207D874051D062257A1C6CBFF4C1667EA36EED7CA792A07F0DAAF1BD14923236
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e93d60d8fa2f358e310f1c9d657bbc19b092dc9bc2900011f2ebbc54d6559230

File Explorer

e93d60d8fa2f358e310f1c9d657bbc19b092dc9bc2900011f2ebbc54d6559230

.exe 13.2MB

e93d60d8fa2f358e310f1c9d657bbc19b092dc9bc2900011f2ebbc54d6559230

IMPHASH 705b1c0cec6340cb804ca45ad5a88bac
SHA256 e93d60d8fa2f358e310f1c9d657bbc19b092dc9bc2900011f2ebbc54d6559230
MD5 9c895ad76db0264108ba8211467fdb2f
SHA1 5259a5a5385b6d2166dd8d5f1ef718020a18f286
SHA512 644503e13d07a007754874e551592954bb2e731f057e180c1a65808520c249941781d31811c73268704db573f03fc2fd0122a79f55fed5f3ccb25445ee7ae29e
SSDEEP 393216:tbJjO9JwYjEZfN4fX2DCKeEGGgCsdi6N0cp:tbJkJ9QZfN4fGDCOGGEA6Vp
TLSH
T129D6F1207D874051D062257A1C6CBFF4C1667EA36EED7CA792A07F0DAAF1BD14923236
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

843927

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\kv_svn\Presenter-Windows\branches\PresenterC\Bin\Release\NorwiiPresenter.pdb

hiddevice

hid_close UsbDeviceChange GetConnectDevices GetSpecialInfo CloseDevicePath InitHidDevice GetDeviceInfoEx SendHidCommand OpenDevicePath EnumeratePaths hid_read_timeout hid_open_path hid_write SetPathKeyword

libcurl

curl_easy_init curl_formadd curl_slist_free_all curl_easy_cleanup curl_easy_setopt curl_formfree curl_global_init curl_global_cleanup curl_easy_strerror curl_slist_append curl_easy_perform

kernel32

FindClose GetFileAttributesW DeleteFileW CreateEventW SetEvent ResetEvent WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FlushFileBuffers ReadConsoleW HeapReAlloc SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapFree HeapAlloc FindNextFileW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RaiseException RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread SetLastError GetCPInfo DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection FindFirstFileW RemoveDirectoryW TerminateThread InitializeCriticalSectionAndSpinCount GetStdHandle InterlockedDecrement CreateMutexW WaitForSingleObject ReleaseMutex CloseHandle lstrlenW Sleep WriteFile CreateFileW GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetTickCount OutputDebugStringA OutputDebugStringW GetLocalTime GetLastError SizeofResource GetCurrentProcess TerminateProcess GetModuleFileNameW GetUserDefaultUILanguage GetEnvironmentVariableW OpenProcess CreateToolhelp32Snapshot Process32NextW FileTimeToSystemTime Process32FirstW LoadResource FindResourceW SystemTimeToFileTime GetTickCount64 CreateProcessW GetModuleHandleW lstrcpyW LoadLibraryW GetProcAddress FreeLibrary CreateFileA CancelIoEx GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter GetCurrentDirectoryW GetACP MultiByteToWideChar FreeResource LockResource ExitProcess GetFileSize InterlockedIncrement WideCharToMultiByte CreateDirectoryW DosDateTimeToFileTime DuplicateHandle SetFileTime SetFilePointer GetFileType GetVersionExW MulDiv ReadFile SetEndOfFile

user32

GetPropW SetPropW GetMenu EnableWindow GetClassInfoExW OffsetRect SetCursor wvsprintfW GetWindow IsRectEmpty UnionRect IntersectRect MapWindowPoints GetUpdateRect ReleaseCapture AdjustWindowRectEx GetActiveWindow SetFocus IsZoomed IsIconic IsWindowVisible DispatchMessageW TranslateMessage GetMessageW PtInRect CallNextHookEx GetAsyncKeyState UnhookWindowsHookEx SetWindowsHookExW CreatePopupMenu GetSysColor SystemParametersInfoW GetClientRect MonitorFromWindow CharPrevW SetRect MonitorFromPoint SetWindowTextW SetCapture SetWindowLongW wsprintfW SendMessageW SetWindowPos PostMessageW GetWindowLongW SetForegroundWindow UpdateWindow LoadCursorW CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo MsgWaitForMultipleObjects GetCaretBlinkTime GetForegroundWindow RegisterClassW ShowWindow CreateWindowExW GetDC DestroyWindow DefWindowProcW GetWindowTextW EndPaint BeginPaint InvalidateRect DrawTextW TrackMouseEvent GetSystemMetrics FillRect CallWindowProcW CharNextW KillTimer GetCursorPos SetCursorPos mouse_event keybd_event GetKeyState SetTimer ReleaseDC GetDesktopWindow SetClipboardData EmptyClipboard CloseClipboard OpenClipboard EnumDisplaySettingsW EnumDisplayDevicesW GetMonitorInfoW EnumDisplayMonitors FindWindowW IsWindow GetWindowRect FindWindowExW SetLayeredWindowAttributes ScreenToClient ClientToScreen GetParent GetFocus MessageBoxW ShowCaret UpdateLayeredWindow MoveWindow CreateDialogParamW GetDlgItem SetClassLongW DestroyCursor SetWindowRgn RegisterClassExW PostQuitMessage AppendMenuW LoadIconW RegisterDeviceNotificationW TrackPopupMenu GetWindowTextLengthW GetCaretPos CreateCaret HideCaret SetCaretPos

gdi32

GetDeviceCaps CreateDCW CreateDIBSection CreateFontIndirectW GetObjectW CreateFontW SetTextColor SetBkMode SetBkColor DeleteObject CreateSolidBrush GetObjectA BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject GetDIBits GetTextExtentPoint32W CreatePatternBrush GdiFlush ExtTextOutW TextOutW MoveToEx SetStretchBltMode StretchBlt ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetClipBox GetCharABCWidthsW CreateRectRgnIndirect CreatePenIndirect CombineRgn CreateRoundRectRgn SetWindowOrgEx GetTextMetricsW SaveDC RestoreDC Rectangle CreatePen GetPixel Ellipse DeleteDC

comdlg32

GetOpenFileNameW

advapi32

RegCreateKeyExW RegQueryValueExW RegDeleteValueW RegGetValueW RegOpenKeyExW RegSetValueExW RegCloseKey

shell32

ShellExecuteExW Shell_NotifyIconW SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW CommandLineToArgvW

ole32

CreateStreamOnHGlobal CoUninitialize CoCreateGuid CoInitialize OleLockRunning CoCreateInstance CLSIDFromString CLSIDFromProgID

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

gdiplus

GdipDrawImage GdipGraphicsClear GdipDrawImageRectRectI GdipLoadImageFromStream GdipDeleteFontFamily GdipDeleteFont GdipSetCompositingMode GdipDeleteStringFormat GdipDeleteGraphics GdipLoadImageFromStreamICM GdipGetImageWidth GdipGetFamily GdipSetStringFormatAlign GdipGetImageGraphicsContext GdipCreateLineBrushI GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipBitmapLockBits GdipCloneBrush GdipSetTextRenderingHint GdipLoadImageFromFile GdipImageGetFrameDimensionsCount GdipGetPropertyItem GdipImageSelectActiveFrame GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetPropertyItemSize GdipSetClipPath GdipSetPenDashStyle GdipCreateBitmapFromHBITMAP GdipClosePathFigure GdipStartPathFigure GdipCloneImage GdipAddPathEllipseI GdipDrawEllipseI GdipDisposeImage GdipFillPath GdipGetSmoothingMode GdipCreateTexture GdipDrawLineI GdipCreateBitmapFromScan0 GdipAddPathArcI GdipDeletePath GdipCreatePath GdipAddPathLineI GdipDrawPath GdipDeletePen GdipCreatePen1 GdipCreateStringFormat GdipGetImageHeight GdipSetCompositingQuality GdipCreateFontFromLogfontA GdipDeleteBrush GdipAlloc GdipDrawImageRectI GdipSetSmoothingMode GdipSetStringFormatLineAlign GdipSetInterpolationMode GdipCreateSolidFill GdipSetPixelOffsetMode GdipCreateFontFromDC GdipFree GdipDrawString GdipCreateFromHDC GdipFillEllipseI

winmm

mciSendStringW

setupapi

SetupDiEnumDeviceInterfaces SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

hid

HidD_FreePreparsedData HidD_GetPreparsedData HidP_GetCaps HidD_SetOutputReport HidD_GetInputReport

imm32

ImmSetCompositionWindow ImmSetCompositionFontW ImmGetContext ImmReleaseContext

comctl32

_TrackMouseEvent ord17

Sharing

General

Malware Config

Signatures

File Explorer

e93d60d8fa2f358e310f1c9d657bbc19b092dc9bc2900011f2ebbc54d6559230

hiddevice

libcurl

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

gdiplus

winmm

setupapi

hid

imm32

comctl32

generic