b7e21ca4f80239138d1d137bffb33c7a186ab1ba4257f546e5ebb3a1bb16df7d

Sharing

Copy URL Twitter E-mail

General

Target
b7e21ca4f80239138d1d137bffb33c7a186ab1ba4257f546e5ebb3a1bb16df7d
Size 3.1MB
Sample260922-mnyagstepg
SHA256 b7e21ca4f80239138d1d137bffb33c7a186ab1ba4257f546e5ebb3a1bb16df7d
MD5 b053f460ee2d89c742055b7a129036ea
SHA1 2fda3d7b1687a66ce64b216de49520933d540070
SHA512 6e083a2214205ef60920e9bf17d8064167f858f21904fe4c5a1cfc19ed6a634f7ed27f37704de1eaa9fde86425a7e3e204f92db7d7b8bbb0536692b841b57625
SSDEEP 49152:mqvYbmfvd6zJmBs67QY54Em78gI+dPXdxM63z/3tdffzhBFLJR:mqvdvd+JmBs05w8J+bx1zldff
TLSH
T18AE5BF12FB828472E8D20075966E6B7F4D39AF245324D6C397D03EB94D711D22B3E39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7e21ca4f80239138d1d137bffb33c7a186ab1ba4257f546e5ebb3a1bb16df7d

File Explorer

b7e21ca4f80239138d1d137bffb33c7a186ab1ba4257f546e5ebb3a1bb16df7d

.exe 3.1MB

b7e21ca4f80239138d1d137bffb33c7a186ab1ba4257f546e5ebb3a1bb16df7d

IMPHASH e804d8fef8992462d1adb05e51926ef1
SHA256 b7e21ca4f80239138d1d137bffb33c7a186ab1ba4257f546e5ebb3a1bb16df7d
MD5 b053f460ee2d89c742055b7a129036ea
SHA1 2fda3d7b1687a66ce64b216de49520933d540070
SHA512 6e083a2214205ef60920e9bf17d8064167f858f21904fe4c5a1cfc19ed6a634f7ed27f37704de1eaa9fde86425a7e3e204f92db7d7b8bbb0536692b841b57625
SSDEEP 49152:mqvYbmfvd6zJmBs67QY54Em78gI+dPXdxM63z/3tdffzhBFLJR:mqvdvd+JmBs05w8J+bx1zldff
TLSH
T18AE5BF12FB828472E8D20075966E6B7F4D39AF245324D6C397D03EB94D711D22B3E39A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

753014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\winmasterforclean\product\win32\dbginfo\wmautoopt.pdb

kernel32

FindClose GetCurrentProcess GlobalFree GlobalUnlock GlobalLock GlobalAlloc OpenMutexW lstrcmpiW LoadLibraryExW ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber ReadConsoleA SetConsoleMode GetEnvironmentVariableW GetSystemTime GetSystemDirectoryW GetProcAddress GetModuleHandleW GetVersionExW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW FindResourceExW FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar FindNextFileW FindFirstFileW ResetEvent GetFullPathNameW OutputDebugStringW OutputDebugStringA CreateProcessW WriteConsoleW GetConsoleCP SetEnvironmentVariableA GetProcessHeap GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetConsoleCtrlHandler ReadConsoleW GetConsoleMode SetStdHandle GetCurrentDirectoryW GetTimeZoneInformation EnumSystemLocalesW IsValidLocale SetFilePointerEx GetACP FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess FindFirstFileExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW GetFileAttributesExW RtlUnwind FormatMessageA PeekNamedPipe GetStdHandle GetFileType ExpandEnvironmentStringsA VerifyVersionInfoA QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerSetConditionMask lstrlenW InterlockedIncrement InterlockedDecrement GetUserDefaultLCID GetLocaleInfoW InterlockedExchange FreeResource WaitForMultipleObjects SetEvent CreateEventW LoadLibraryW GetCurrentProcessId FormatMessageW Sleep GetCurrentThreadId WaitForSingleObject CreateMutexW SetEndOfFile SetLastError FlushFileBuffers LocalFree DecodePointer RaiseException LocalAlloc InitializeCriticalSectionAndSpinCount GetLocalTime SystemTimeToFileTime CreateDirectoryW GetFileAttributesW GetModuleFileNameW GetTickCount GetWindowsDirectoryW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection FreeLibrary HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy WideCharToMultiByte GetLastError WriteFile GetFileSize CloseHandle CreateFileW EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW SleepEx LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetCPInfo WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter SetFilePointer FreeEnvironmentStringsW ReadFile GetStringTypeW

user32

MessageBoxW SetWindowLongW GetWindowLongW CopyRect GetDesktopWindow CreateWindowExW RegisterClassExW LoadCursorW DefWindowProcW FindWindowW DrawTextW SendMessageW GetParent GetDlgCtrlID PtInRect SetCursor InflateRect LoadImageW InvalidateRect IsWindow DestroyWindow LoadIconW DestroyIcon RegisterWindowMessageW SetTimer ShowWindow IsWindowVisible KillTimer GetDlgItem SetRect CallWindowProcW PostMessageW DrawIconEx OffsetRect GetClassInfoExW EnableWindow EndPaint GetNextDlgTabItem BeginPaint GetCursorPos IsIconic ReleaseCapture SystemParametersInfoW PostThreadMessageW UpdateLayeredWindow GetClientRect SetCapture TranslateMessage SetFocus IntersectRect IsRectEmpty MoveWindow IsWindowEnabled GetForegroundWindow AttachThreadInput MapWindowPoints IsChild PeekMessageW GetMonitorInfoW IsDialogMessageW DispatchMessageW GetActiveWindow ScreenToClient SetWindowRgn SetActiveWindow MonitorFromWindow GetFocus GetWindowRect GetWindow GetMessageW GetWindowThreadProcessId LoadBitmapW BringWindowToTop GetLastActivePopup SwitchToThisWindow CharNextW SetForegroundWindow ClientToScreen SetRectEmpty GetDC ReleaseDC EqualRect UnregisterClassW GetProcessWindowStation GetUserObjectInformationW SetWindowPos

gdi32

SetViewportOrgEx ExtSelectClipRgn CombineRgn GetViewportOrgEx RoundRect GetClipRgn SaveDC GetTextExtentPoint32W TextOutW RestoreDC CreateRectRgn SelectClipRgn RectInRegion ExtTextOutW CreateRectRgnIndirect Rectangle GetCurrentObject OffsetRgn LineTo MoveToEx CreatePen GetStockObject GetDeviceCaps CreateFontIndirectW SetBkMode SetBkColor BitBlt SetTextColor GetObjectW CreateDIBSection DeleteDC CreateCompatibleDC SelectObject DeleteObject CreateRoundRectRgn StretchBlt CreateBitmap CreateCompatibleBitmap SetStretchBltMode GetStretchBltMode GetTextColor

advapi32

DeregisterEventSource CryptSignHashW CryptDestroyHash RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyW RegCreateKeyExW RegCloseKey CryptCreateHash CryptEnumProvidersW RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt

shell32

SHGetSpecialFolderPathW ShellExecuteW ShellExecuteExW ord680 SHCreateDirectoryExW

ole32

CoUninitialize CreateStreamOnHGlobal CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitialize

oleaut32

VarUI4FromStr SysFreeString

shlwapi

PathAddBackslashW PathAppendW PathFileExistsW PathIsDirectoryW StrToIntW PathFindFileNameW PathRemoveFileSpecW StrToIntA

comctl32

InitCommonControlsEx DrawShadowText _TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipGetImagePixelFormat GdipGraphicsClear GdipDrawImageRectI GdipCloneBitmapArea GdipImageRotateFlip GdipDrawImagePointsRectI GdipLoadImageFromStream GdipDrawLinesI GdipDeletePen GdipCreatePen1 GdipAddPathPieI GdipAddPathRectangleI GdipClosePathFigure GdipSetSmoothingMode GdipSetInterpolationMode GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipDrawImageRectRect GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStream GdipCreateFromHDC GdiplusShutdown GdipLoadImageFromFile GdipFree GdipAlloc GdipCloneImage GdipCreateBitmapFromScan0 GdipDisposeImage GdipGetImageGraphicsContext GdipDeleteGraphics GdipCreatePath GdipDeletePath GdipTranslateWorldTransform GdipRotateWorldTransform GdipResetWorldTransform GdipFillRectangleI GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipSetTextRenderingHint GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipCreateFont GdipCreateFontFromLogfontW GdipDeleteFont GdipSetStringFormatAlign GdipMeasureString GdipNewPrivateFontCollection GdipDeletePrivateFontCollection GdipPrivateAddFontFile GdipSetClipPath GdipDrawImageRectRectI GdipGetImageHeight GdipGetImageWidth GdipGetFontCollectionFamilyCount GdipGetFontCollectionFamilyList GdipCloneFontFamily GdipDeleteFontFamily GdiplusStartup

ws2_32

gethostname ioctlsocket sendto shutdown listen accept freeaddrinfo getaddrinfo WSACleanup WSAStartup WSAIoctl setsockopt ntohs htons getsockopt getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet socket WSAGetLastError getnameinfo recvfrom

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wldap32

ord301 ord200 ord30 ord79 ord35 ord143 ord32 ord27 ord26 ord22 ord41 ord50 ord211 ord46 ord217 ord33 ord60

crypt32

CertOpenStore CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore

bcrypt

BCryptGenRandom

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

561KB

Virtual Size

560KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

350KB

Virtual Size

350KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=17, id=241, version=40116,

count=189, id=243, version=40116,

count=30, id=242, version=40116,

count=93, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=7, id=199, version=41118,

count=26, id=259, version=24123,

count=65, id=261, version=24123,

count=36, id=260, version=24123,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=23, productName=Unmarked objects (old),

count=558, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=485, id=1, productName=Unmarked objects,

count=45, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,