4fa6fad0b6194b5776d08a8557f0b49d13633d9ede664b27bec23c530c451976

Sharing

Copy URL Twitter E-mail

General

Target
4fa6fad0b6194b5776d08a8557f0b49d13633d9ede664b27bec23c530c451976
Size 3.2MB
Sample260922-ml5xjstend
SHA256 4fa6fad0b6194b5776d08a8557f0b49d13633d9ede664b27bec23c530c451976
MD5 6a74c211bdf9d4ec23a4dd5c76706aa6
SHA1 100e68525e7c309c3bad1d4b45e004e647f50b78
SHA512 fa917d5657ec98a9cf48ee92ff4991699b4f049bd52d657e91f89fcf7176cf6894bad50dc494cf4950bf05cb89cd286c4cb681ad2885ad455d6f7766856c82c0
SSDEEP 49152:NevLmW0PaaUUk9Iu3Iyzt7QYvQ0N8EdPqHn7r/3tdff1Q9mtH+ex5:NevLr0Pfbk9IuYyzt/YU8E4HPldff1Q
TLSH
T1A6F5CF12FB4280B2E8D2007199BA5BBF4D3DAE241728D9C3D7D439695D312D16B3F39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4fa6fad0b6194b5776d08a8557f0b49d13633d9ede664b27bec23c530c451976

File Explorer

4fa6fad0b6194b5776d08a8557f0b49d13633d9ede664b27bec23c530c451976

.exe 3.2MB

4fa6fad0b6194b5776d08a8557f0b49d13633d9ede664b27bec23c530c451976

IMPHASH 4e95fa98624596843d1403c3991c8091
SHA256 4fa6fad0b6194b5776d08a8557f0b49d13633d9ede664b27bec23c530c451976
MD5 6a74c211bdf9d4ec23a4dd5c76706aa6
SHA1 100e68525e7c309c3bad1d4b45e004e647f50b78
SHA512 fa917d5657ec98a9cf48ee92ff4991699b4f049bd52d657e91f89fcf7176cf6894bad50dc494cf4950bf05cb89cd286c4cb681ad2885ad455d6f7766856c82c0
SSDEEP 49152:NevLmW0PaaUUk9Iu3Iyzt7QYvQ0N8EdPqHn7r/3tdff1Q9mtH+ex5:NevLr0Pfbk9IuYyzt/YU8E4HPldff1Q
TLSH
T1A6F5CF12FB4280B2E8D2007199BA5BBF4D3DAE241728D9C3D7D439695D312D16B3F39A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

808791

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\winmasterforclean\product\win32\dbginfo\wmautoopt.pdb

kernel32

GetCurrentProcess GlobalFree GlobalUnlock GlobalLock GlobalAlloc OpenMutexW lstrcmpiW LoadLibraryExW ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber ReadConsoleA SetConsoleMode GetEnvironmentVariableW GetSystemTime GetSystemDirectoryW GetProcAddress GetModuleHandleW GetVersionExW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar FindClose FindNextFileW FindFirstFileW ResetEvent GetFullPathNameW OutputDebugStringA CreateProcessW GetConsoleCP SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetProcessHeap GetCommandLineA GetOEMCP IsValidCodePage SetConsoleCtrlHandler ReadConsoleW GetConsoleMode SetStdHandle GetCurrentDirectoryW GetTimeZoneInformation EnumSystemLocalesW IsValidLocale SetFilePointerEx GetACP FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess FindFirstFileExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW GetFileAttributesExW RtlUnwind FormatMessageA PeekNamedPipe GetStdHandle GetFileType ExpandEnvironmentStringsA VerifyVersionInfoA QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerSetConditionMask lstrlenW InterlockedIncrement InterlockedDecrement GetUserDefaultLCID GetLocaleInfoW InterlockedExchange FreeResource WaitForMultipleObjects SetEvent CreateEventW LoadLibraryW GetCurrentProcessId FormatMessageW Sleep GetCurrentThreadId WaitForSingleObject CreateMutexW SetEndOfFile SetLastError FlushFileBuffers LocalFree DecodePointer RaiseException LocalAlloc InitializeCriticalSectionAndSpinCount SystemTimeToFileTime CreateDirectoryW GetFileAttributesW GetModuleFileNameW GetTickCount GetWindowsDirectoryW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection WriteConsoleW FreeLibrary HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy WideCharToMultiByte GetLastError WriteFile GetFileSize CloseHandle CreateFileW SleepEx LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList OutputDebugStringW InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx GetCPInfo LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer GetStringTypeW SetFilePointer GetCommandLineW ReadFile

user32

MessageBoxW SetWindowLongW GetWindowLongW CopyRect GetDesktopWindow CreateWindowExW RegisterClassExW LoadCursorW DefWindowProcW FindWindowW DrawTextW SendMessageW GetParent GetDlgCtrlID PtInRect SetCursor InflateRect LoadImageW InvalidateRect IsWindow DestroyWindow LoadIconW DestroyIcon RegisterWindowMessageW SetTimer ShowWindow IsWindowVisible KillTimer GetDlgItem SetRect CallWindowProcW PostMessageW DrawIconEx OffsetRect GetClassInfoExW EnableWindow EndPaint GetNextDlgTabItem BeginPaint GetCursorPos IsIconic ReleaseCapture SystemParametersInfoW PostThreadMessageW UpdateLayeredWindow GetClientRect SetCapture TranslateMessage SetFocus IntersectRect IsRectEmpty MoveWindow IsWindowEnabled GetForegroundWindow AttachThreadInput MapWindowPoints IsChild PeekMessageW ClientToScreen GetMonitorInfoW IsDialogMessageW DispatchMessageW GetActiveWindow ScreenToClient SetWindowRgn SetActiveWindow MonitorFromWindow GetFocus GetWindowRect GetWindow GetMessageW GetWindowThreadProcessId LoadBitmapW BringWindowToTop GetLastActivePopup SwitchToThisWindow CharNextW SetForegroundWindow SetRectEmpty GetDC ReleaseDC EqualRect UnregisterClassW GetProcessWindowStation GetUserObjectInformationW SetWindowPos

gdi32

SetViewportOrgEx ExtSelectClipRgn CombineRgn GetViewportOrgEx RoundRect GetClipRgn SaveDC GetTextExtentPoint32W TextOutW RestoreDC CreateRectRgn SelectClipRgn RectInRegion ExtTextOutW CreateRectRgnIndirect Rectangle GetCurrentObject OffsetRgn LineTo MoveToEx CreatePen GetStockObject GetDeviceCaps CreateFontIndirectW SetBkMode SetBkColor BitBlt SetTextColor GetObjectW CreateDIBSection DeleteDC CreateCompatibleDC SelectObject DeleteObject GetStretchBltMode GetTextMetricsW CreateRoundRectRgn StretchBlt CreateBitmap CreateCompatibleBitmap SetStretchBltMode GetTextColor

advapi32

DeregisterEventSource CryptSignHashW CryptDestroyHash RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyW RegCreateKeyExW RegCloseKey CryptCreateHash CryptEnumProvidersW RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt

shell32

SHGetSpecialFolderPathW ShellExecuteExW ord680 SHCreateDirectoryExW ShellExecuteW

ole32

CoUninitialize CreateStreamOnHGlobal CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoInitialize CoCreateInstance

oleaut32

SysFreeString VarUI4FromStr

shlwapi

PathFileExistsW PathIsDirectoryW StrToIntW PathFindFileNameW PathRemoveFileSpecW PathAppendW PathAddBackslashW StrToIntA

comctl32

InitCommonControlsEx DrawShadowText _TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipDrawImagePointsRectI GdipGetImagePixelFormat GdipCloneBitmapArea GdipImageRotateFlip GdipLoadImageFromStream GdipSetCompositingQuality GdipGetFamily GdipDrawRectangleI GdipAddPathArcI GdipSetPenStartCap GdipDrawImageRectI GdipFillPath GdipGraphicsClear GdipAddPathStringI GdipSetPenDashStyle GdipDrawLine GdipSetPixelOffsetMode GdipFillRectangle GdipScaleWorldTransform GdipDrawLinesI GdipDrawPath GdipSetPenEndCap GdipStartPathFigure GdipGetFontSize GdipSetPenMode GdipDeletePen GdipDrawImageI GdipCreatePen1 GdipCreateLineBrushFromRectWithAngleI GdipAddPathPieI GdipAddPathRectangleI GdipClosePathFigure GdipSetSmoothingMode GdipSetInterpolationMode GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipLoadImageFromFile GdipCreateHBITMAPFromBitmap GdipFree GdipAlloc GdipCloneImage GdipCreateBitmapFromScan0 GdipDisposeImage GdipGetImageGraphicsContext GdipDeleteFontFamily GdipDeleteGraphics GdipCreatePath GdipDeletePath GdipSetClipPath GdipDrawImageRectRectI GdipGetImageHeight GdipGetImageWidth GdipDrawImageRectRect GdipTranslateWorldTransform GdipRotateWorldTransform GdipResetWorldTransform GdipFillRectangleI GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipSetTextRenderingHint GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipCreateFont GdipCreateFontFromLogfontW GdipDeleteFont GdipSetStringFormatAlign GdipMeasureString GdipNewPrivateFontCollection GdipDeletePrivateFontCollection GdiplusStartup GdiplusShutdown GdipCreateFromHDC GdipCreateBitmapFromStream GdipPrivateAddFontFile GdipGetFontCollectionFamilyCount GdipGetFontCollectionFamilyList GdipCloneFontFamily GdipAddPathLineI

ws2_32

getnameinfo gethostname ioctlsocket ntohs htons getsockopt getsockname getpeername connect sendto closesocket recvfrom listen accept freeaddrinfo getaddrinfo WSACleanup WSAStartup WSAIoctl bind send recv WSASetLastError select __WSAFDIsSet socket WSAGetLastError shutdown setsockopt

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wldap32

ord50 ord41 ord22 ord60 ord27 ord32 ord33 ord35 ord211 ord46 ord217 ord26 ord79 ord30 ord200 ord301 ord143

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

570KB

Virtual Size

570KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

350KB

Virtual Size

350KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=17, id=241, version=40116,

count=189, id=243, version=40116,

count=30, id=242, version=40116,

count=93, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=7, id=199, version=41118,

count=26, id=259, version=24123,

count=65, id=261, version=24123,

count=36, id=260, version=24123,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=23, productName=Unmarked objects (old),

count=558, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=505, id=1, productName=Unmarked objects,

count=45, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,