aa4e267403bd21f1ea40b48aabd9be4dea5662f962de388427410ebd84b3e079

Sharing

Copy URL Twitter E-mail

General

Target
aa4e267403bd21f1ea40b48aabd9be4dea5662f962de388427410ebd84b3e079
Size 4.8MB
Sample260916-2nn45sfb97
SHA256 aa4e267403bd21f1ea40b48aabd9be4dea5662f962de388427410ebd84b3e079
MD5 e0992e3728f4825d27472e4975c164ae
SHA1 16e7a74fe20fe2724c9f6a1587df296f7342de21
SHA512 7a50e11f999dd708cadf9f0b51b28ea1ff8c8f84ed9f78202d2421f46c9128c0c697f439a68224ca2389e48b0577ccf7f10a3de8585d322a024a98234065f8da
SSDEEP 98304:wXgtk2GSdUtMUNbl9m09XbQ9wnY34ZAhwaInrpKY+yb6rrtWujTZJbt:wXI7jOLN9c96PZdaInVM1rhTZ9t
TLSH
T1F53633E69383A3AAE0B1543669B50E28C558FCF1E170CF671305BB6AF9330435667AF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
aa4e267403bd21f1ea40b48aabd9be4dea5662f962de388427410ebd84b3e079
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$_20_/NDP471-KB4033342-x86-x64-AllOS-ENU.exe

File Explorer

aa4e267403bd21f1ea40b48aabd9be4dea5662f962de388427410ebd84b3e079

.exe 4.8MB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-header.bmp

25KB
$PLUGINSDIR/modern-wizard.bmp

152KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$_20_/NDP471-KB4033342-x86-x64-AllOS-ENU.exe

.exe 4.5MB

aa4e267403bd21f1ea40b48aabd9be4dea5662f962de388427410ebd84b3e079

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 aa4e267403bd21f1ea40b48aabd9be4dea5662f962de388427410ebd84b3e079
MD5 e0992e3728f4825d27472e4975c164ae
SHA1 16e7a74fe20fe2724c9f6a1587df296f7342de21
SHA512 7a50e11f999dd708cadf9f0b51b28ea1ff8c8f84ed9f78202d2421f46c9128c0c697f439a68224ca2389e48b0577ccf7f10a3de8585d322a024a98234065f8da
SSDEEP 98304:wXgtk2GSdUtMUNbl9m09XbQ9wnY34ZAhwaInrpKY+yb6rrtWujTZJbt:wXI7jOLN9c96PZdaInVM1rhTZ9t
TLSH
T1F53633E69383A3AAE0B1543669B50E28C558FCF1E170CF671305BB6AF9330435667AF1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_20_/NDP471-KB4033342-x86-x64-AllOS-ENU.exe

IMPHASH 9b2f6a441f9ff8df98ae6e9e6b5d4271
SHA256 9e6c03d0eee9241df3115097809935a7d98b7b09ee96ce1d2c70a98a46a88ffd
MD5 1bd2db8982ee5fed6acb799bbf9a505f
SHA1 a13143f4c987ecd06cd86d2a129ca50a630f5a82
SHA512 9a37264ae4e4abd46834de3a080d2056c40aaa4b98ea715658f18b30b02ebb10b25502807d4527237e8f445f213e06cfeb2aed0de05b30909e25f1ff3b51eb57
SSDEEP 98304:7L3s0F7Q5o4YRv7xCfrouYfyV36jZ7nctkL2GMaT1f7uMKeHksxw5k+2lk6zSvLH:P80iTeCfYfI3617lhhfaoQH
TLSH
T1C62633132270E072E1F72671DA79DAF595683B50427CE41FBB906F3D2E70250B8BA35A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

102119

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb

advapi32

CreateWellKnownSid InitializeSecurityDescriptor SetEntriesInAclW SetSecurityDescriptorDacl SetSecurityDescriptorOwner CryptAcquireContextW CryptGenRandom CryptReleaseContext DecryptFileW

kernel32

GetTickCount SetEnvironmentVariableW GetLastError ExpandEnvironmentStringsW CreateProcessW Sleep WaitForSingleObject GetExitCodeProcess CloseHandle SetFileAttributesW InitializeCriticalSection CreateEventW GetEnvironmentVariableW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent GetCommandLineW lstrlenW CompareStringW LocalFree CreateDirectoryW QueryDosDeviceW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetDriveTypeW CreateFileW DeviceIoControl SetErrorMode RemoveDirectoryW MoveFileExW GetProcAddress GetSystemDirectoryW LoadLibraryW GetModuleHandleW CreateThread LocalAlloc RaiseException ExitThread WaitForMultipleObjects ResetEvent CreateEventA GetSystemInfo FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime GetModuleHandleA GetVersionExA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetEndOfFile DuplicateHandle ReadFile SetFilePointerEx GlobalFree GetCommandLineA HeapSetInformation GetStartupInfoW SetUnhandledExceptionFilter ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc LCMapStringW FreeLibrary InterlockedExchange RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar GetStringTypeW HeapSize HeapReAlloc IsProcessorFeaturePresent SetStdHandle WriteConsoleW FlushFileBuffers CreateFileA GetLocalTime GetComputerNameW lstrlenA FormatMessageW GetSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime DeleteFileW GetFileAttributesW FindFirstFileW FindNextFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW GetProcessHeap GlobalAlloc LoadLibraryA

comctl32

ord17

rpcrt4

UuidToStringW UuidCreate RpcStringFreeW

shell32

CommandLineToArgvW SHBrowseForFolderW SHGetPathFromIDListW

shlwapi

PathRemoveExtensionW

user32

MessageBoxW GetTopWindow GetWindowThreadProcessId GetWindow SendMessageW PostMessageW DialogBoxParamW GetDlgItem SetWindowTextW EndDialog PostQuitMessage LoadStringW SetWindowLongW GetWindowLongW CharUpperW

oleaut32

SysAllocString VariantClear

aa4e267403bd21f1ea40b48aabd9be4dea5662f962de388427410ebd84b3e079

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$_20_/NDP471-KB4033342-x86-x64-AllOS-ENU.exe

advapi32

kernel32

comctl32

rpcrt4

shell32

shlwapi

user32

oleaut32

generic