d3a9191963836a096219a63f6b3013265e819b57119dc99d538b804987e49f34

Sharing

Copy URL Twitter E-mail

General

Target
d3a9191963836a096219a63f6b3013265e819b57119dc99d538b804987e49f34
Size 2.9MB
Sample260922-kpvvmsca47
SHA256 d3a9191963836a096219a63f6b3013265e819b57119dc99d538b804987e49f34
MD5 a0def058b9e252ad6d2ea9d2385c601f
SHA1 58fa8d9d6a72bf285b7b189432370d847a2adb50
SHA512 698778c10815d60588b964991ed7fd4136b75b421ed248ea0b58ba1d12065209be575aeac02cae5bc4a623a8f2798e8a8cc860e6e0931570215e32ce9cf3ce47
SSDEEP 49152:DNihygJmsRDudlePbBjAsbOmH2wJjGfBRrda0+eZ32kUHeIL/B:DNom0bK4/2wJq/rGeZ32kUH
TLSH
T1C6E5BE21BB04C236D4A101F19D3D7BAF956DAE38076844DBA3C43E2E5C745D26E3266F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3a9191963836a096219a63f6b3013265e819b57119dc99d538b804987e49f34

File Explorer

d3a9191963836a096219a63f6b3013265e819b57119dc99d538b804987e49f34

.exe 2.9MB

d3a9191963836a096219a63f6b3013265e819b57119dc99d538b804987e49f34

IMPHASH 4d249cbd60e7990c3939dc779348e7f4
SHA256 d3a9191963836a096219a63f6b3013265e819b57119dc99d538b804987e49f34
MD5 a0def058b9e252ad6d2ea9d2385c601f
SHA1 58fa8d9d6a72bf285b7b189432370d847a2adb50
SHA512 698778c10815d60588b964991ed7fd4136b75b421ed248ea0b58ba1d12065209be575aeac02cae5bc4a623a8f2798e8a8cc860e6e0931570215e32ce9cf3ce47
SSDEEP 49152:DNihygJmsRDudlePbBjAsbOmH2wJjGfBRrda0+eZ32kUHeIL/B:DNom0bK4/2wJq/rGeZ32kUH
TLSH
T1C6E5BE21BB04C236D4A101F19D3D7BAF956DAE38076844DBA3C43E2E5C745D26E3266F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

836149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\src\_LdsCode\al_clean\alone_clean_inst_uninst\bin\Uninst\Release\uninst.pdb

kernel32

MoveFileExW FindClose FindNextFileW SetLastError GetFullPathNameW FindFirstFileW GetCurrentProcess SetCurrentDirectoryW GetSystemDirectoryW GetCurrentDirectoryW InitializeCriticalSection WideCharToMultiByte MultiByteToWideChar LeaveCriticalSection EnterCriticalSection lstrlenW GetTickCount Sleep WaitForSingleObject WaitForMultipleObjects SetEvent CloseHandle CreateEventW GetModuleFileNameW GetModuleHandleW DeleteCriticalSection DecodePointer RaiseException GetLastError InitializeCriticalSectionEx lstrcmpiW OutputDebugStringW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ReadConsoleW GetConsoleOutputCP SetFilePointerEx HeapFree HeapReAlloc HeapSize HeapDestroy FreeLibrary LoadLibraryW GetProcAddress GetFileType SetStdHandle GetModuleHandleExW IsDebuggerPresent EncodePointer TryEnterCriticalSection GetCurrentThreadId FormatMessageW DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime QueryPerformanceCounter LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo CreateFileW MulDiv ExitProcess FreeResource GetACP GetCurrentProcessId GetFileSize ReadFile lstrcmpW DeleteFileW SetEndOfFile SetFilePointer WriteFile CreateFileMappingW MapViewOfFile UnmapViewOfFile GetVersion GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetTempFileNameW GetTempPathW ResumeThread ResetEvent GetLocalTime IsBadReadPtr lstrcpynW lstrcpyW GetLogicalDriveStringsW QueryDosDeviceW CreateMutexW GetLongPathNameW GetExitCodeProcess LocalFree GetFileAttributesW SetFileAttributesW RemoveDirectoryW GetWindowsDirectoryW MoveFileW GetTempPathA GetTempFileNameA DeleteFileA CreateFileA IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW InitializeSListHead GetFileSizeEx FlushFileBuffers CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx FindFirstFileA FindNextFileA CreateFileMappingA GetSystemWindowsDirectoryW DeviceIoControl lstrcmpA GetStdHandle GetConsoleMode WriteConsoleW RtlUnwind ExitThread

user32

GetCursorPos CreateCaret GetCaretBlinkTime SetCaretPos ScreenToClient MapWindowPoints IntersectRect UnionRect IsRectEmpty PtInRect GetWindowLongW SetWindowLongW GetParent GetClassNameW GetWindow MonitorFromWindow IsIconic SetWindowRgn MessageBoxW GetMonitorInfoW DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW EnableWindow SetPropW GetPropW LoadCursorW LoadImageW SystemParametersInfoW wvsprintfW SetCursor InflateRect OffsetRect MonitorFromPoint CharPrevW DrawTextW SetRect DestroyIcon DrawIconEx GetIconInfo GetMessagePos MoveWindow GetDlgCtrlID DrawFocusRect FillRect HideCaret ShowCaret ClientToScreen GetSysColor GetWindowDC GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn RemovePropW FindWindowExW IsWindowEnabled TranslateMessage DispatchMessageW GetClientRect SendMessageW CreateWindowExW IsWindow IsChild DestroyWindow UpdateLayeredWindow IsZoomed CharNextW SetFocus GetFocus PostMessageW GetMessageW SetForegroundWindow ShowWindow IsWindowVisible GetKeyState SetCapture ReleaseCapture SetTimer KillTimer GetDC ReleaseDC SetWindowPos PostQuitMessage SetWindowTextW RegisterWindowMessageW BeginPaint EndPaint GetUpdateRect InvalidateRect GetWindowRect

advapi32

RegCreateKeyW OpenProcessToken GetTokenInformation RegEnumKeyExW RegDeleteTreeW RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ord165 SHGetSpecialFolderPathW SHGetKnownFolderPath SHFileOperationW SHChangeNotify

ole32

CLSIDFromProgID CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoTaskMemFree OleLockRunning CLSIDFromString CoCreateGuid CreateStreamOnHGlobal CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysStringLen SysAllocStringLen SafeArrayCreate SysAllocString SysFreeString VariantInit VariantClear SafeArrayPutElement

shlwapi

SHAutoComplete PathFindFileNameW StrCmpNIW StrTrimA StrStrIA StrCmpIW SHGetValueW SHSetValueW SHDeleteKeyW PathFindFileNameA SHSetValueA StrStrIW PathCombineW PathRemoveFileSpecW PathAppendW PathFileExistsW PathRenameExtensionA

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

comctl32

_TrackMouseEvent ImageList_DrawEx ImageList_GetIconSize InitCommonControlsEx ord17

msimg32

AlphaBlend GradientFill

gdiplus

GdipGetImagePixelFormat GdipLoadImageFromFile GdipAlloc GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipDrawImageRectI GdipLoadImageFromStreamICM GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipSetPenDashStyle GdipFree GdipDeleteGraphics GdipSetSmoothingMode GdipDrawLineI GdipDrawRectangleI GdipDrawPath GdipFillEllipseI GdipClosePathFigure GdipCreateTexture GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageGraphicsContext GdipGetImageWidth GdipCreateBitmapFromStream GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCreateBitmapFromFile GdipGetPropertyItemSize GdipGetPropertyItem GdiplusStartup GdiplusShutdown GdipCreateFromHDC GdipCloneBrush GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipBitmapLockBits GdipBitmapUnlockBits GdipSetInterpolationMode GdipGraphicsClear GdipDrawEllipseI GdipDrawImageRectRectI GdipGetImageHeight GdipGetImageEncodersSize GdipGetImageEncoders GdipFillPath GdipAddPathArc GdipDrawImagePointsI

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

gdi32

ExtTextOutW TextOutW SetDIBColorTable CreateSolidBrush CreateDIBSection SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CombineRgn GetDeviceCaps CreateRoundRectRgn SetWindowOrgEx GetObjectW GetTextMetricsW SelectObject SaveDC RestoreDC Rectangle GetStockObject DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt GetTextColor GetDIBits CreateRectRgnIndirect CreateDCW SetDIBitsToDevice

generic

count=38, id=259, version=30795,

count=211, id=261, version=30795,

count=11, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=2, id=260, version=27034,

count=11, id=260, version=27054,

count=1, id=260, version=27050,

count=9, id=261, version=27050,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=1, id=262, version=30795,

count=83, id=261, version=27054,

count=40, id=260, version=26706,

count=138, id=261, version=26706,

count=50, id=260, version=30795,

count=37, id=257, version=30795,

count=547, id=1, productName=Unmarked objects,

count=44, id=265, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,