0a62b1f3f9f804840315f022817cd80fc555517912bc4c2ef06e9bcaa19ddbd8

Sharing

Copy URL Twitter E-mail

General

Target
0a62b1f3f9f804840315f022817cd80fc555517912bc4c2ef06e9bcaa19ddbd8
Size 2.5MB
Sample260909-ej63tsbk6w
SHA256 0a62b1f3f9f804840315f022817cd80fc555517912bc4c2ef06e9bcaa19ddbd8
MD5 ea2d2200e42cc88d76836671f6fec870
SHA1 e8ee3aebc57a4f5592e705e0981fd9c4e4576f79
SHA512 1168d2eb1b140e08d400b0b8afeb8d2d62ee448c226198b0b7dfa5587171cd9357e5dccbcb4eacd2215bf966e6376a3a83e0a76288751ba5eccbddf27c305776
SSDEEP 49152:0s7FdtlSF1EzOB5BZlNpA2Xg0Gu+4vCgOgc/9J5TmkMQVLKT:PtO7pAY8u+ZjXYkMuK
TLSH
T156C5AF26DEB512B8C2ABF07A854BAA02DAE538475F356BEB0150455B3E739F036FD301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a62b1f3f9f804840315f022817cd80fc555517912bc4c2ef06e9bcaa19ddbd8

File Explorer

0a62b1f3f9f804840315f022817cd80fc555517912bc4c2ef06e9bcaa19ddbd8

.exe 2.5MB

0a62b1f3f9f804840315f022817cd80fc555517912bc4c2ef06e9bcaa19ddbd8

IMPHASH d588afe69fc2b393c97137f752cedac2
SHA256 0a62b1f3f9f804840315f022817cd80fc555517912bc4c2ef06e9bcaa19ddbd8
MD5 ea2d2200e42cc88d76836671f6fec870
SHA1 e8ee3aebc57a4f5592e705e0981fd9c4e4576f79
SHA512 1168d2eb1b140e08d400b0b8afeb8d2d62ee448c226198b0b7dfa5587171cd9357e5dccbcb4eacd2215bf966e6376a3a83e0a76288751ba5eccbddf27c305776
SSDEEP 49152:0s7FdtlSF1EzOB5BZlNpA2Xg0Gu+4vCgOgc/9J5TmkMQVLKT:PtO7pAY8u+ZjXYkMuK
TLSH
T156C5AF26DEB512B8C2ABF07A854BAA02DAE538475F356BEB0150455B3E739F036FD301
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

788980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\data\landun\workspace\CommonComponent\ACE-Guard\1.compile_source\output\x64\Release\SGuardSvc64.pdb

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

shlwapi

PathRemoveFileSpecW PathFindFileNameA PathAppendW PathFindFileNameW PathFileExistsW

wtsapi32

WTSQueryUserToken

ws2_32

htonl htons freeaddrinfo WSAStartup getaddrinfo WSACleanup sendto socket

crypt32

CryptMsgGetParam CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgClose CertCloseStore CryptQueryObject

kernel32

FreeLibraryAndExitThread GetCurrentThread CreateThread RtlPcToFileHeader RtlUnwindEx ExitThread GetFileAttributesExW ExitProcess GetStdHandle CreateFileW GetFileAttributesW AreFileApisANSI CloseHandle RaiseException GetLastError SetLastError HeapAlloc HeapReAlloc HeapFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent ReleaseMutex WaitForSingleObject WaitForSingleObjectEx CreateMutexA CreateMutexW CreateEventW Sleep TerminateProcess GetThreadTimes GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW GetACP LocalFree CreateFileMappingA GetTimeZoneInformation CompareStringW MultiByteToWideChar WideCharToMultiByte LCMapStringW GetLocaleInfoW GetUserDefaultLCID EnumSystemLocalesW HeapSize DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap GetPrivateProfileIntW WaitForMultipleObjects SwitchToThread GetCurrentProcessId OpenEventW GetExitCodeProcess GetCurrentProcess SetCurrentDirectoryW GetFileSize CreateDirectoryW FindNextFileW GetModuleHandleExW ExpandEnvironmentStringsW FindClose OpenProcess DeleteFileW VerSetConditionMask GetModuleHandleW VerifyVersionInfoW Process32NextW Process32FirstW WTSGetActiveConsoleSessionId GetModuleFileNameA Module32FirstW Module32NextW SetUnhandledExceptionFilter GetCommandLineA ResumeThread ReadFile WriteFile SetFilePointerEx SystemTimeToFileTime GetSystemTime InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext OutputDebugStringW IsDebuggerPresent GetFileType IsValidLocale FlushFileBuffers GetConsoleCP GetConsoleMode FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA OutputDebugStringA SetStdHandle WriteConsoleW ReadConsoleW SetEndOfFile HeapCreate GetFullPathNameW GetDiskFreeSpaceW LockFile InitializeCriticalSection SetFilePointer GetFullPathNameA UnlockFileEx GetTempPathW HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile CreateFileA LoadLibraryA DeleteFileA HeapCompact UnlockFile LockFileEx FormatMessageA LocalAlloc CreateToolhelp32Snapshot GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc QueryPerformanceCounter EncodePointer GetCurrentThreadId TryEnterCriticalSection GetStringTypeW FormatMessageW

advapi32

SetServiceStatus StartServiceCtrlDispatcherW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW SetTokenInformation ChangeServiceConfig2W DeleteService ControlService StartServiceW CreateProcessAsUserW ConvertSidToStringSidW OpenServiceW DuplicateTokenEx SetFileSecurityW AllocateAndInitializeSid SetEntriesInAclW FreeSid GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor RegisterServiceCtrlHandlerExW

wintrust

WinVerifyTrust

Name

.text

Size

897KB

Virtual Size

897KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

202KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

652B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.tvm0

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

0a62b1f3f9f804840315f022817cd80fc555517912bc4c2ef06e9bcaa19ddbd8

userenv

shlwapi

wtsapi32

ws2_32

crypt32

kernel32

advapi32

wintrust

generic