1bc1aa02b1018c8fe133d22eebed6852ee71b37d2a2f4cb1f6807898275b28cf

Sharing

Copy URL Twitter E-mail

General

Target
1bc1aa02b1018c8fe133d22eebed6852ee71b37d2a2f4cb1f6807898275b28cf
Size 4.2MB
Sample260907-p24ersvybw
SHA256 1bc1aa02b1018c8fe133d22eebed6852ee71b37d2a2f4cb1f6807898275b28cf
MD5 94bd4b5c118d71822301c7e2b62b53ea
SHA1 87edc2f435f134c448719686c128153de90acbad
SHA512 7d1e9ffb2d65ede5c9847b36542b70e8199a36ef3abea84446cdf1496e35c8ce215f2e9cc9e5c03e1e75b344db455b9a4d43469b7465e1fa7825bf4a5ed3f3ee
SSDEEP 98304:N8OMeY5tYYszAVALvpeGurBtXwZwn6HD527BWG:NjMeUtYYszAVALvcMVQBWG
TLSH
T135268E603686C135D672117A4EBDBFBB8C1DA8251BB051CB92C58F6E29211D32F36F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bc1aa02b1018c8fe133d22eebed6852ee71b37d2a2f4cb1f6807898275b28cf

File Explorer

1bc1aa02b1018c8fe133d22eebed6852ee71b37d2a2f4cb1f6807898275b28cf

.exe 4.2MB

1bc1aa02b1018c8fe133d22eebed6852ee71b37d2a2f4cb1f6807898275b28cf

IMPHASH 8976d8d03da8a522c6b40328f9ee2d0f
SHA256 1bc1aa02b1018c8fe133d22eebed6852ee71b37d2a2f4cb1f6807898275b28cf
MD5 94bd4b5c118d71822301c7e2b62b53ea
SHA1 87edc2f435f134c448719686c128153de90acbad
SHA512 7d1e9ffb2d65ede5c9847b36542b70e8199a36ef3abea84446cdf1496e35c8ce215f2e9cc9e5c03e1e75b344db455b9a4d43469b7465e1fa7825bf4a5ed3f3ee
SSDEEP 98304:N8OMeY5tYYszAVALvpeGurBtXwZwn6HD527BWG:NjMeUtYYszAVALvcMVQBWG
TLSH
T135268E603686C135D672117A4EBDBFBB8C1DA8251BB051CB92C58F6E29211D32F36F1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2040176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\buildagent-cd_8818\p4\989747040\services\AMTSW\Release\UNS\Release\lms.pdb

kernel32

GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW MultiByteToWideChar GetFileSizeEx SetEnvironmentVariableW SetStdHandle FindFirstFileExW IsValidCodePage LocalAlloc LocalFree FormatMessageW GetOEMCP GetFullPathNameW FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW VirtualQuery VirtualProtect GetCommandLineA VirtualAlloc GetModuleHandleExW FreeEnvironmentStringsW RtlUnwind GetCurrentDirectoryW SetConsoleCtrlHandler GetConsoleMode ReadConsoleW GetConsoleOutputCP HeapSize HeapReAlloc LCMapStringW lstrcmpiW FindResourceW GetDateFormatW WriteConsoleW LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary GetCurrentThreadId GetCurrentThread GetTimeFormatW OutputDebugStringW GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx GetLocaleInfoEx LCMapStringEx EncodePointer GetStringTypeW WaitForSingleObjectEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetFileInformationByHandle WaitForMultipleObjects WaitForMultipleObjectsEx QueryPerformanceFrequency SizeofResource CompareStringW GetTimeZoneInformation ExpandEnvironmentStringsW GetComputerNameExW WideCharToMultiByte CreateFileW GetFinalPathNameByHandleW LoadLibraryW CreateThread GetCurrentProcess CreateEventW lstrlenW WaitForSingleObject SetEvent DeleteCriticalSection IsWow64Process VerSetConditionMask OutputDebugStringA VerifyVersionInfoW GetSystemPowerStatus QueryPerformanceCounter GetComputerNameA GetSystemInfo GetACP GetCurrentProcessId InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapAlloc HeapFree GetProcessHeap GetSystemDefaultLCID GetSystemTime SetFilePointer SetEndOfFile CreateFileA CancelIo ReadFile WriteFile DeviceIoControl GetOverlappedResult InitializeCriticalSectionAndSpinCount FlushFileBuffers GlobalFree GlobalAlloc SetLastError InitializeCriticalSection TryEnterCriticalSection SetThreadPriority ResumeThread GetLastError RaiseException CloseHandle DuplicateHandle TlsAlloc TlsGetValue TlsSetValue TlsFree RegisterWaitForSingleObject UnregisterWait GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA LoadLibraryA TerminateProcess GetStdHandle DecodePointer GetCommandLineW SetDllDirectoryW Sleep ResetEvent ReleaseSemaphore ReleaseMutex CreateMutexW CreateEventA CreateSemaphoreW GetExitCodeThread SuspendThread GetThreadId GetSystemTimeAsFileTime FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetEnvironmentStringsW ExitProcess GetVersionExW LockFileEx SetFilePointerEx UnlockFileEx LoadLibraryExA

advapi32

RegCreateKeyW InitiateSystemShutdownExW LookupPrivilegeValueW AdjustTokenPrivileges SetEntriesInAclW RegSetKeySecurity RegDeleteKeyExW SetSecurityDescriptorDacl FreeSid AllocateAndInitializeSid ChangeServiceConfig2W CloseServiceHandle OpenProcessToken OpenThreadToken ControlService CreateServiceW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW CopySid GetLengthSid GetTokenInformation InitializeSecurityDescriptor IsValidSid SetSecurityDescriptorGroup SetSecurityDescriptorOwner RegCreateKeyExW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey ConvertSidToStringSidW LookupAccountSidW EqualSid CreateWellKnownSid StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW OpenServiceW OpenSCManagerW DeleteService ChangeServiceConfigW

user32

GetMessageW CharUpperW CharNextW PostThreadMessageW UnregisterDeviceNotification TranslateMessage LoadStringW DispatchMessageW RegisterDeviceNotificationW MessageBoxW

ole32

CoUninitialize CoCreateInstance StringFromGUID2 CoInitializeEx CoResumeClassObjects CoTaskMemFree CoAddRefServerProcess CoRegisterClassObject CoTaskMemAlloc PropVariantClear CoImpersonateClient CoRevertToSelf CoReleaseServerProcess CoRevokeClassObject CoTaskMemRealloc CoSetProxyBlanket CoInitializeSecurity

oleaut32

SysAllocStringByteLen SysStringByteLen VariantClear VariantChangeType VariantInit SysAllocString SysFreeString SysStringLen VarUI4FromStr LoadTypeLi RegisterTypeLi UnRegisterTypeLi VarBstrCat LoadRegTypeLi SafeArrayCreate SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SafeArrayUnlock SafeArrayPutElement SafeArrayCreateVector SysAllocStringLen

iphlpapi

IpRenewAddress GetInterfaceInfo GetPerAdapterInfo GetAdaptersInfo GetIpAddrTable CancelIPChangeNotify NotifyRouteChange CancelMibChangeNotify2 NotifyIpInterfaceChange GetAdaptersAddresses SetTcpEntry GetExtendedTcpTable

cfgmgr32

CM_Get_Device_Interface_ListA CM_Get_Device_Interface_List_SizeA

crypt32

CertCloseStore CryptMsgGetParam CryptMsgClose CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertOpenStore CertGetNameStringA CertFindCertificateInStore

ws2_32

WSAAddressToStringA freeaddrinfo getaddrinfo WSAAccept WSAGetLastError getsockopt shutdown setsockopt send inet_addr recv ntohs listen htons getsockname getpeername ioctlsocket connect closesocket bind __WSAFDIsSet inet_ntoa htonl gethostbyaddr gethostbyname getservbyport WSASend getservbyname WSAStartup accept WSACloseEvent WSACleanup gethostname WSASetLastError ntohl WSACreateEvent getnameinfo WSAEventSelect WSAEnumNetworkEvents select socket

wintrust

WinVerifyTrust

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpQueryAuthSchemes WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpSetCredentials WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse

shell32

SHGetSpecialFolderPathW

api-ms-win-power-setting-l1-1-0

PowerReadDCValue PowerReadACValue

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

powrprof

SetSuspendState

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

758KB

Virtual Size

757KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

173KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

828KB

Virtual Size

832KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=22, id=259, version=29395,

count=252, id=261, version=29395,

count=5, id=253, version=28518,

count=19, id=260, version=29804,

count=26, id=259, version=29804,

count=116, id=261, version=30152,

count=35, id=260, version=30152,

count=2, id=260, productName=VS2019 v16.8.4 build 29336, version=29336,

count=16, id=257, version=29395,

count=101, id=261, version=29804,

count=438, id=1, productName=Unmarked objects,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=31, id=260, version=29395,

count=385, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=29, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=256, productName=VS2019 v16.9.2 build 29913, version=29913,

count=1, id=255, productName=VS2019 v16.9.2 build 29913, version=29913,

count=2, id=151,

count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,