9467bb225f04bc41764ffa52bb919b7db1d8d1a69617edf6b15b92ec36afcb70

Sharing

Copy URL Twitter E-mail

General

Target
9467bb225f04bc41764ffa52bb919b7db1d8d1a69617edf6b15b92ec36afcb70
Size 5.2MB
Sample260916-s7m7hssejb
SHA256 9467bb225f04bc41764ffa52bb919b7db1d8d1a69617edf6b15b92ec36afcb70
MD5 4aa2002c6ba941f602312511ff6dd67e
SHA1 56c09f66381510e1cd2c4eedd1750dc07c13f37d
SHA512 0d72f14f4bc9f7ee6160ccf3873bbf8f41ae6ffa6b610fc7a43ba9be1a6e5b3d99ce9a3a59ae85231bbd175f4e8541bb239f08976b63f85bd23d16a196b0980d
SSDEEP 98304:/6ot44wGJGswP5FDm81lr9kY/mnlsdor1XwU/Ohz2WvJtQ6lJSB:/6otLwGwP55Br9kCmlwe1Xf/Ohz2+tQP
TLSH
T16946AD22F6A092B1F5A33172B93C67394D737E619B3589CB87806C986FB03D1253935B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9467bb225f04bc41764ffa52bb919b7db1d8d1a69617edf6b15b92ec36afcb70

File Explorer

9467bb225f04bc41764ffa52bb919b7db1d8d1a69617edf6b15b92ec36afcb70

.exe 5.2MB

9467bb225f04bc41764ffa52bb919b7db1d8d1a69617edf6b15b92ec36afcb70

IMPHASH c922bbce49c63077ca9e386c72d29334
SHA256 9467bb225f04bc41764ffa52bb919b7db1d8d1a69617edf6b15b92ec36afcb70
MD5 4aa2002c6ba941f602312511ff6dd67e
SHA1 56c09f66381510e1cd2c4eedd1750dc07c13f37d
SHA512 0d72f14f4bc9f7ee6160ccf3873bbf8f41ae6ffa6b610fc7a43ba9be1a6e5b3d99ce9a3a59ae85231bbd175f4e8541bb239f08976b63f85bd23d16a196b0980d
SSDEEP 98304:/6ot44wGJGswP5FDm81lr9kY/mnlsdor1XwU/Ohz2WvJtQ6lJSB:/6otLwGwP55Br9kCmlwe1Xf/Ohz2+tQP
TLSH
T16946AD22F6A092B1F5A33172B93C67394D737E619B3589CB87806C986FB03D1253935B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1877440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\b\s\w\ir\cache\builder\src\out\Release\updater.exe.pdb

advapi32

AddAce AllocateAndInitializeSid BuildExplicitAccessWithNameW BuildSecurityDescriptorW BuildTrusteeWithSidW ChangeServiceConfigW CheckTokenMembership CloseServiceHandle ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateServiceW DeleteService DuplicateTokenEx EqualSid FreeSid GetAce GetAclInformation GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorLength GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityInfo GetSidIdentifierAuthority GetSidLengthRequired GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle ImpersonateLoggedOnUser ImpersonateNamedPipeClient InitializeAcl InitializeSecurityDescriptor InitializeSid IsValidAcl IsValidSecurityDescriptor IsValidSid LookupAccountSidW MakeAbsoluteSD MakeSelfRelativeSD OpenProcessToken OpenSCManagerW OpenServiceW OpenThreadToken QueryServiceConfigW RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegSetValueExW RegisterServiceCtrlHandlerW RegisterTraceGuidsW RevertToSelf SetEntriesInAclW SetNamedSecurityInfoW SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityInfo SetServiceStatus StartServiceCtrlDispatcherW TraceEvent UnregisterTraceGuids

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

gdi32

BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreateRectRgn CreateRectRgnIndirect CreateSolidBrush DPtoLP DeleteDC DeleteObject ExtTextOutW FillRgn GetDeviceCaps GetObjectW GetRegionData GetStockObject GetTextMetricsW OffsetRgn SelectObject SetBkColor SetTextColor SetViewportOrgEx

msimg32

GradientFill

oleaut32

LoadRegTypeLi LoadTypeLi OleCreateFontIndirect OleLoadPicturePath SafeArrayAccessData SafeArrayCreateVector SafeArrayDestroy SafeArrayGetDim SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetVartype SafeArrayUnaccessData SysAllocString SysAllocStringByteLen SysAllocStringLen SysFreeString SysStringLen SystemTimeToVariantTime VariantClear VariantInit

shell32

CommandLineToArgvW ord680 SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

user32

AllowSetForegroundWindow BeginPaint CallWindowProcW CharNextW CharUpperW ClientToScreen CopyImage CopyRect CreateAcceleratorTableW CreateDialogIndirectParamW CreateWindowExW DefWindowProcW DestroyAcceleratorTable DestroyIcon DestroyWindow DispatchMessageW EnableMenuItem EnableWindow EndDialog EndPaint EnumChildWindows FillRect FrameRect GetActiveWindow GetClassInfoExW GetClassNameW GetClientRect GetCursorPos GetDC GetDesktopWindow GetDlgItem GetFocus GetMenuState GetMessageW GetMonitorInfoW GetParent GetQueueStatus GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetTopWindow GetWindow GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW InflateRect InvalidateRect InvalidateRgn IsChild IsDialogMessageW IsMenu IsRectEmpty IsWindow IsWindowVisible KillTimer LoadCursorW LoadImageW MapDialogRect MapWindowPoints MonitorFromWindow MoveWindow MsgWaitForMultipleObjectsEx OffsetRect PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RedrawWindow RegisterClassExW RegisterClassW RegisterWindowMessageW ReleaseCapture ReleaseDC ScreenToClient SendDlgItemMessageW SendMessageW SetActiveWindow SetCapture SetDlgItemTextW SetFocus SetForegroundWindow SetTimer SetWindowContextHelpId SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TranslateMessage UnregisterClassW UpdateWindow

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AssignProcessToJobObject CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateNamedPipeW CreatePipe CreateProcessW CreateSemaphoreA CreateSemaphoreW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FindResourceExW FindResourceW FlushFileBuffers FlushInstructionCache FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessMitigationPolicy GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadLocale GetThreadPreferredUILanguages GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserPreferredUILanguages GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalHandle GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock InterlockedPopEntrySList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockFileEx LockResource MapViewOfFile MoveFileExW MoveFileW MulDiv MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus Process32FirstW Process32NextW ProcessIdToSessionId QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ReplaceFileW ResetEvent ResumeThread RtlCaptureStackBackTrace RtlUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetNamedPipeHandleState SetProcessShutdownParameters SetStdHandle SetThreadInformation SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SleepEx SuspendThread SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WTSGetActiveConsoleSessionId WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpW

ole32

CLSIDFromProgID CLSIDFromString CoAddRefServerProcess CoCreateGuid CoCreateInstance CoGetClassObject CoImpersonateClient CoInitializeEx CoInitializeSecurity CoRegisterClassObject CoRegisterInitializeSpy CoReleaseServerProcess CoResumeClassObjects CoRevertToSelf CoRevokeClassObject CoRevokeInitializeSpy CoSetProxyBlanket CoTaskMemAlloc CoTaskMemFree CoUninitialize CreateStreamOnHGlobal IIDFromString OleInitialize OleLockRunning OleUninitialize StringFromGUID2

secur32

GetUserNameExW

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQuerySessionInformationW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock EnterCriticalPolicySection LeaveCriticalPolicySection UnloadUserProfile

comctl32

InitCommonControlsEx _TrackMouseEvent

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpGetProxyForUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpWriteData

uxtheme

SetWindowTheme

shlwapi

ord437 PathMatchSpecW

ntdll

NtDeleteKey

winmm

timeBeginPeriod timeEndPeriod timeGetTime

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize

Name

.text

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

642KB

Virtual Size

642KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

369B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

507KB

Virtual Size

507KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

672KB

Virtual Size

676KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

9467bb225f04bc41764ffa52bb919b7db1d8d1a69617edf6b15b92ec36afcb70

advapi32

dbghelp

gdi32

msimg32

oleaut32

shell32

user32

kernel32

ole32

secur32

wtsapi32

userenv

comctl32

winhttp

uxtheme

shlwapi

ntdll

winmm

version

api-ms-win-core-winrt-l1-1-0

generic