7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe

Sharing

Copy URL Twitter E-mail

General

Target
7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe
Size 1.0MB
Sample260916-ppp2lszgnf
SHA256 7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe
MD5 0965df96c0d74634399f5f4fe3a093bb
SHA1 aa9df708213e4142a446ece2f94f718c30c78009
SHA512 6e002b0d13dd850150af50c049d5138af3e984161b9d6a93cf5001dea88f16535c0bb38dd4136e74a9973af037aa01c99595d20436235dfd8334767f9fd81860
SSDEEP 24576:MFoH6ThNF4Xx7AYIaPZ7KSltdMosreGOL3Lm:8oHGFEBAnQJlGrelL3K
TLSH
T13935D089A75440E0E1B6C13889439846F6717C015B71EBDF13E8E63A2F776E19E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe

File Explorer

7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe

.exe 1.0MB

7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe

IMPHASH 6d75a4165c79a384f12ac557b9baac3b
SHA256 7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe
MD5 0965df96c0d74634399f5f4fe3a093bb
SHA1 aa9df708213e4142a446ece2f94f718c30c78009
SHA512 6e002b0d13dd850150af50c049d5138af3e984161b9d6a93cf5001dea88f16535c0bb38dd4136e74a9973af037aa01c99595d20436235dfd8334767f9fd81860
SSDEEP 24576:MFoH6ThNF4Xx7AYIaPZ7KSltdMosreGOL3Lm:8oHGFEBAnQJlGrelL3K
TLSH
T13935D089A75440E0E1B6C13889439846F6717C015B71EBDF13E8E63A2F776E19E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

165280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Workspace\sgorenbo\9.5_COMMON\SW\Src\Apps\PAVP2\PAVP30\IntelCpHeciSvc\x64\one_core_release\IntelCpHeciSvc.pdb

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle GetCommandLineW SetStdHandle ExpandEnvironmentStringsW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

WaitForSingleObject ResetEvent DeleteCriticalSection WaitForMultipleObjectsEx SetEvent InitializeCriticalSection EnterCriticalSection InitializeCriticalSectionEx InitializeCriticalSectionAndSpinCount LeaveCriticalSection TryEnterCriticalSection CreateEventW WaitForSingleObjectEx

api-ms-win-core-processthreads-l1-1-0

CreateThread ResumeThread TerminateProcess TlsSetValue GetCurrentThreadId GetStartupInfoW OpenThreadToken OpenProcessToken GetCurrentThread GetCurrentProcess GetCurrentProcessId TlsGetValue ExitProcess TlsAlloc TlsFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter GetLastError UnhandledExceptionFilter SetLastError RaiseException

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW LoadStringW LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW SizeofResource FreeLibrary GetModuleFileNameW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW CharUpperW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar GetStringTypeW

api-ms-win-core-registry-l1-1-0

RegCloseKey RegQueryValueExA RegQueryValueExW RegSetValueExA RegEnumKeyExW RegOpenKeyExW RegCreateKeyExW RegQueryInfoKeyW RegDeleteValueW RegSetValueExW

api-ms-win-core-registry-l2-1-0

RegOpenKeyW RegDeleteKeyW

api-ms-win-core-com-l1-1-0

CoInitializeSecurity CoTaskMemFree StringFromGUID2 CoReleaseServerProcess CoUninitialize CoInitializeEx CoRegisterClassObject CoRevokeClassObject CoCreateInstance CoResumeClassObjects CoTaskMemRealloc CoTaskMemAlloc CoAddRefServerProcess

oleaut32

LoadRegTypeLi LoadTypeLi SafeArrayDestroy SafeArrayRedim SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SafeArrayUnlock VarUI4FromStr SafeArrayCopy UnRegisterTypeLi RegisterTypeLi SysAllocString SafeArrayGetVartype VariantInit VariantClear SysFreeString SysStringLen SafeArrayCreate

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-devices-config-l1-1-1

CM_Unregister_Notification CM_Get_Device_Interface_ListW CM_Register_Notification CM_Get_Device_Interface_List_SizeW

api-ms-win-core-file-l1-1-0

SetFilePointerEx FindClose CreateFileW ReadFile WriteFile FindFirstFileExW FindNextFileW GetFileType FlushFileBuffers SetEndOfFile

api-ms-win-core-io-l1-1-0

DeviceIoControl GetOverlappedResult

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-heap-l1-1-0

HeapAlloc HeapReAlloc GetProcessHeap HeapFree HeapSize

api-ms-win-security-base-l1-1-0

MakeAbsoluteSD SetSecurityDescriptorGroup SetSecurityDescriptorOwner InitializeSecurityDescriptor GetTokenInformation CopySid GetLengthSid GetSecurityDescriptorLength IsValidSid

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-service-management-l2-1-0

QueryServiceConfigW ChangeServiceConfigW

api-ms-win-service-management-l1-1-0

OpenServiceW CloseServiceHandle CreateServiceW DeleteService OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

user32

PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW

api-ms-win-core-localization-l1-2-0

GetCPInfo EnumSystemLocalesW GetUserDefaultLCID LCMapStringW IsValidLocale GetLocaleInfoW GetOEMCP IsValidCodePage GetACP

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-console-l1-1-0

ReadConsoleW GetConsoleCP GetConsoleMode WriteConsoleW

Name

.text

Size

290KB

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

592KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

7e6d6b8536b8ab1ae7413da451928f02b499817ceea7aafe524479bf261c6efe

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-security-sddl-l1-1-0

user32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-console-l1-1-0

generic