8aeffa858a5a419a50e01552e6919d69e32046f465b75d96c754fd8050d8f07a

Sharing

Copy URL Twitter E-mail

General

Target
8aeffa858a5a419a50e01552e6919d69e32046f465b75d96c754fd8050d8f07a
Size 2.0MB
Sample260917-3db79sec52
SHA256 8aeffa858a5a419a50e01552e6919d69e32046f465b75d96c754fd8050d8f07a
MD5 968ba13f0200f5d004d1fa6eb00eacb6
SHA1 286de0688478e95b86a5ab706f51032708b6d7e8
SHA512 05fd29a1c018416736fe69c46ef281d8c32db91809c7d0daae988f60475c3ffffb62bf28390d6edc4e5214b979e2d7d75abcb94ed31dd40ee10f002b9dddcff1
SSDEEP 49152:wvqhm669V5wvm32twyygs/iHymA/gWoNkKj6EcyZZD1GEsYLf9Ckt7c20+9qNxUW:Bm669fhyoiHI/gWoNkKj6Ecy0EsYfEkM
TLSH
T1BFA57D012AE821A8E1F7F2B8C9AB450AD6B37C451F3186DF2254695E1F376E09D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8aeffa858a5a419a50e01552e6919d69e32046f465b75d96c754fd8050d8f07a

File Explorer

8aeffa858a5a419a50e01552e6919d69e32046f465b75d96c754fd8050d8f07a

.exe 2.0MB

8aeffa858a5a419a50e01552e6919d69e32046f465b75d96c754fd8050d8f07a

IMPHASH a4d2ce82c94a38d518776b53fac5f493
SHA256 8aeffa858a5a419a50e01552e6919d69e32046f465b75d96c754fd8050d8f07a
MD5 968ba13f0200f5d004d1fa6eb00eacb6
SHA1 286de0688478e95b86a5ab706f51032708b6d7e8
SHA512 05fd29a1c018416736fe69c46ef281d8c32db91809c7d0daae988f60475c3ffffb62bf28390d6edc4e5214b979e2d7d75abcb94ed31dd40ee10f002b9dddcff1
SSDEEP 49152:wvqhm669V5wvm32twyygs/iHymA/gWoNkKj6EcyZZD1GEsYLf9Ckt7c20+9qNxUW:Bm669fhyoiHI/gWoNkKj6Ecy0EsYfEkM
TLSH
T1BFA57D012AE821A8E1F7F2B8C9AB450AD6B37C451F3186DF2254695E1F376E09D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

626592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\1\s\x64\Release\HotkeyServiceUWP.pdb

rpcrt4

RpcServerUseProtseqEpW RpcServerListen RpcServerRegisterIf3 RpcServerUnregisterIf RpcMgmtStopServerListening NdrClientCall3 NdrServerCallAll NdrServerCall2

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW SetStdHandle ExpandEnvironmentStringsW GetCommandLineW FreeEnvironmentStringsW GetStdHandle GetEnvironmentVariableW GetCommandLineA GetEnvironmentStringsW

api-ms-win-core-errorhandling-l1-1-0

SetLastError SetUnhandledExceptionFilter RaiseException GetLastError UnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable Sleep InitializeConditionVariable SleepConditionVariableCS

api-ms-win-core-libraryloader-l1-2-0

LoadStringW GetModuleHandleW LoadLibraryExW GetProcAddress FreeLibraryAndExitThread LoadResource LockResource FreeLibrary GetModuleHandleExW FindResourceExW SizeofResource GetModuleFileNameW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar CompareStringW CompareStringEx WideCharToMultiByte GetStringTypeW

api-ms-win-core-com-l1-1-0

CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

oleaut32

SafeArrayPutElement SafeArrayDestroy SafeArrayCreateVector GetErrorInfo SafeArrayGetElement VariantClear VariantInit SysAllocString SysFreeString

api-ms-win-core-handle-l1-1-0

CloseHandle SetHandleInformation

api-ms-win-core-processthreads-l1-1-0

TlsAlloc QueueUserAPC CreateProcessW GetExitCodeProcess CreateProcessAsUserW TlsSetValue TlsFree ProcessIdToSessionId ExitThread GetCurrentProcess GetCurrentThread TerminateProcess GetThreadId CreateThread OpenThreadToken OpenProcessToken GetStartupInfoW GetCurrentThreadId TlsGetValue GetCurrentProcessId ExitProcess

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent

api-ms-win-security-base-l1-1-0

FreeSid GetLengthSid AdjustTokenPrivileges DuplicateTokenEx GetAclInformation GetAce ImpersonateLoggedOnUser AddAccessAllowedAce AddAce CopySid GetTokenInformation RevertToSelf AllocateAndInitializeSid CreateWellKnownSid SetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor InitializeAcl

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW WTSGetActiveConsoleSessionId

userenv

DestroyEnvironmentBlock GetUserProfileDirectoryW CreateEnvironmentBlock

api-ms-win-core-synch-l1-1-0

SleepEx CreateMutexW TryEnterCriticalSection WaitForSingleObjectEx WaitForSingleObject CreateEventW ReleaseSRWLockExclusive InitializeSRWLock InitializeCriticalSectionAndSpinCount WaitForMultipleObjectsEx AcquireSRWLockExclusive ReleaseMutex EnterCriticalSection LeaveCriticalSection InitializeCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReleaseSemaphore ResetEvent SetEvent

api-ms-win-core-registry-l1-1-0

RegCloseKey RegOpenKeyExW RegGetValueW RegCreateKeyExW RegQueryValueExW RegNotifyChangeKeyValue RegSetValueExW

api-ms-win-core-file-l1-1-0

RemoveDirectoryW GetFileType GetFullPathNameW DeleteFileW GetFileAttributesW ReadFile WriteFile CreateDirectoryW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle FlushFileBuffers CreateFileW GetTempFileNameW FindClose FindFirstFileW GetLongPathNameW SetEndOfFile GetFileSizeEx SetFilePointerEx

api-ms-win-core-io-l1-1-0

DeviceIoControl GetOverlappedResult

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-core-localization-l1-2-0

FormatMessageW GetLocaleInfoW GetOEMCP GetACP IsValidCodePage GetCPInfo LCMapStringEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoEx LCMapStringW FormatMessageA

api-ms-win-core-sidebyside-l1-1-0

CreateActCtxW DeactivateActCtx ActivateActCtx ReleaseActCtx

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-service-management-l1-1-0

DeleteService OpenSCManagerW OpenServiceW CreateServiceW CloseServiceHandle

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx ChangeServiceConfig2W QueryServiceConfigW

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFolderPathW

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW Process32NextW CreateToolhelp32Snapshot

api-ms-win-core-file-l2-1-0

MoveFileExW CreateSymbolicLinkW ReadDirectoryChangesW CreateHardLinkW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-namedpipe-l1-1-0

CreatePipe

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW WaitForMultipleObjects

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW lstrlenW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork SubmitThreadpoolWork

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW DeregisterEventSource ReportEventW

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

ControlService QueryServiceStatus

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

user32

MsgWaitForMultipleObjectsEx

ole32

OleRun

hppkanalyticclientlib

?GetInstance@CAnalyticsManager@Analytics@ProgrammableKey@@SAPEAV123@XZ ?InitializeAnalyticsSession@CAnalyticsManager@Analytics@ProgrammableKey@@QEAAXXZ ?RegisterDataClass@CAnalyticsManager@Analytics@ProgrammableKey@@QEAA?AW4AnalyticsResult@Emitters@2HP@@XZ ?CollectAndSendEvent@CAnalyticsManager@Analytics@ProgrammableKey@@QEAA?AW4AnalyticsResult@Emitters@2HP@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?GenerateProgKeyJsonString@AnalyticsEventFactory@Analytics@ProgrammableKey@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@U_PROGKEY_EVENTDATA_@23@@Z ?ReleaseAnalyticsManager@CAnalyticsManager@Analytics@ProgrammableKey@@SAXXZ

notificationmanager

?BroadcastEvent@EventHandler@ServiceNotification@@SAXW4ServiceEvent@2@PEB_W@Z ?Subscribe@CallbackSubscriber@ServiceNotification@@SA_N_JV?$vector@W4ServiceEvent@ServiceNotification@@V?$allocator@W4ServiceEvent@ServiceNotification@@@std@@@std@@@Z ?UnSubscribe@CallbackSubscriber@ServiceNotification@@SA_N_J@Z ?Notify@EventHandler@ServiceNotification@@SAH_JP6AHIPEA_W0@Z@Z

wtsapi32

WTSQuerySessionInformationW WTSQueryUserToken WTSFreeMemory WTSEnumerateProcessesW WTSEnumerateSessionsW WTSSendMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-fibers-l1-1-0

FlsSetValue FlsGetValue FlsFree FlsAlloc

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetLocalTime

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader RtlVirtualUnwind RtlUnwindEx RtlUnwind RtlLookupFunctionEntry RtlCaptureContext

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiBuildDriverInfoList SetupDiEnumDriverInfoW

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

api-ms-win-core-console-l1-1-0

GetConsoleMode ReadConsoleW WriteConsoleW GetConsoleOutputCP

shlwapi

StrCmpNIW StrTrimW

??0AnalyticsSession@@QEAA@$$QEAV0@@Z ??0AnalyticsSession@@QEAA@AEBV0@@Z ??0AppSession@Session@Analytics@HP@@QEAA@$$QEAV0123@@Z ??0AppSession@Session@Analytics@HP@@QEAA@AEBV0123@@Z ??0BaseDataClass@DataClass@Analytics@HP@@QEAA@$$QEAV0123@@Z ??0BaseDataClass@DataClass@Analytics@HP@@QEAA@AEBV0123@@Z ??0ConsentObject@@QEAA@$$QEAV0@@Z ??0ConsentObject@@QEAA@AEBV0@@Z ??0DataClassFieldInfo@DataClass@Analytics@HP@@QEAA@$$QEAV0123@@Z ??0DataClassFieldInfo@DataClass@Analytics@HP@@QEAA@AEBV0123@@Z ??0DataClassFieldInfo@DataClass@Analytics@HP@@QEAA@XZ ??0PrivacyDocuments@@QEAA@$$QEAV0@@Z ??0PrivacyDocuments@@QEAA@AEBV0@@Z ??1AnalyticsSession@@QEAA@XZ ??1AppSession@Session@Analytics@HP@@QEAA@XZ ??1BaseDataClass@DataClass@Analytics@HP@@QEAA@XZ ??1ConsentObject@@QEAA@XZ ??1DataClassFieldInfo@DataClass@Analytics@HP@@QEAA@XZ ??1PrivacyDocuments@@QEAA@XZ ??4AnalyticsSession@@QEAAAEAV0@$$QEAV0@@Z ??4AnalyticsSession@@QEAAAEAV0@AEBV0@@Z ??4AppSession@Session@Analytics@HP@@QEAAAEAV0123@$$QEAV0123@@Z ??4AppSession@Session@Analytics@HP@@QEAAAEAV0123@AEBV0123@@Z ??4BaseDataClass@DataClass@Analytics@HP@@QEAAAEAV0123@$$QEAV0123@@Z ??4BaseDataClass@DataClass@Analytics@HP@@QEAAAEAV0123@AEBV0123@@Z ??4ConsentObject@@QEAAAEAV0@$$QEAV0@@Z ??4ConsentObject@@QEAAAEAV0@AEBV0@@Z ??4DataClassFieldInfo@DataClass@Analytics@HP@@QEAAAEAV0123@$$QEAV0123@@Z ??4DataClassFieldInfo@DataClass@Analytics@HP@@QEAAAEAV0123@AEBV0123@@Z ??4PrivacyDocuments@@QEAAAEAV0@$$QEAV0@@Z ??4PrivacyDocuments@@QEAAAEAV0@AEBV0@@Z ??4ProcessingPermissions@@QEAAAEAV0@$$QEAV0@@Z ??4ProcessingPermissions@@QEAAAEAV0@AEBV0@@Z ??_7BaseDataClass@DataClass@Analytics@HP@@6B@ ?__autoclassinit2@AnalyticsSession@@QEAAX_K@Z

Name

.text

Size

934KB

Virtual Size

933KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

311KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

154KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

8aeffa858a5a419a50e01552e6919d69e32046f465b75d96c754fd8050d8f07a

rpcrt4

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

userenv

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-synch-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-security-base-l1-2-2

api-ms-win-security-provider-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-util-l1-1-0

user32

ole32

hppkanalyticclientlib

notificationmanager

wtsapi32

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

setupapi

api-ms-win-core-realtime-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

shlwapi

generic