unhide[.]exe | Triage™

General

Target
unhide.exe
Size 389KB
Sample260922-phnvzavfrd
SHA256 4f68c751ca08888c6cf5eba888e9385d52f42e0c1a60ec7888c34841a7540b53
MD5 2529406e348278e6cb3ff7fcb104c54f
SHA1 b3a189605458d333a8defd92cb4975e0e9b03e46
SHA512 e35482df0f545f7dca6380d9d18875d052180d3dcc74c387bf98f2528d84074f9f60f56235c9ac30f012410f338503d05766619ab2b15e0df04ba85362fb312c
SSDEEP 6144:NUuTTTKHFpSDUISjVcSPf/Ke4Kk/jrjzc6r6IFLpjZ4R7fRXN:2u0FpBISxcSPfv4hTc6rDL74R7j
TLSH
T1A9843A60E1D885B3D5EA02304CB17B30156EFE982675C18F574C3BAA3ABEBC35136B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unhide.exe

File Explorer

unhide.exe

.exe 389KB

unhide.exe

IMPHASH ec9e48ca8e5a589d6104f3ceec89ade6
SHA256 4f68c751ca08888c6cf5eba888e9385d52f42e0c1a60ec7888c34841a7540b53
MD5 2529406e348278e6cb3ff7fcb104c54f
SHA1 b3a189605458d333a8defd92cb4975e0e9b03e46
SHA512 e35482df0f545f7dca6380d9d18875d052180d3dcc74c387bf98f2528d84074f9f60f56235c9ac30f012410f338503d05766619ab2b15e0df04ba85362fb312c
SSDEEP 6144:NUuTTTKHFpSDUISjVcSPf/Ke4Kk/jrjzc6r6IFLpjZ4R7fRXN:2u0FpBISxcSPfv4hTc6rDL74R7j
TLSH
T1A9843A60E1D885B3D5EA02304CB17B30156EFE982675C18F574C3BAA3ABEBC35136B19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ce:63:f9:93:0b:80:74:b5:62:47:76:3b:de:85:d5:74:42:f7:77:56

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bleeping Computer\, LLC.,O=Bleeping Computer\, LLC.,ST=New York,C=US,1.2.840.113549.1.9.1=#0c196365727440626c656570696e67636f6d70757465722e636f6d

Chains

Nov 24, 2012

CN=Bleeping Computer\, LLC.,O=Bleeping Computer\, LLC.,ST=New York,C=US,1.2.840.113549.1.9.1=#0c196365727440626c656570696e67636f6d70757465722e636f6d

Minor OS version

1

Major OS version

5

Entry point

61011

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

unhide.pdb

kernel32

Sleep FindFirstFileW FindNextFileW FindClose GetFileAttributesW SetFileAttributesW CreateDirectoryW CopyFileW GetVersionExW TerminateProcess GetLastError GetShortPathNameW SetEndOfFile CloseHandle GetLogicalDriveStringsW GetDriveTypeW GetCurrentProcess GetTickCount InitializeCriticalSection InterlockedCompareExchange SetEnvironmentVariableA CreateFileW IsValidLocale HeapFree InterlockedDecrement GetCPInfo GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection InterlockedExchange GetProcAddress GetModuleHandleW ExitProcess DecodePointer GetTimeFormatW GetDateFormatW HeapAlloc GetCommandLineW HeapSetInformation UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate IsProcessorFeaturePresent EncodePointer InterlockedIncrement TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId RaiseException WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW GetLocaleInfoW GetTimeZoneInformation SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection SetStdHandle LoadLibraryW WriteFile GetModuleFileNameW GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetConsoleCP GetConsoleMode SetFilePointer ReadFile FlushFileBuffers QueryPerformanceCounter GetCurrentProcessId RtlUnwind HeapSize HeapReAlloc CompareStringW SetEnvironmentVariableW WriteConsoleW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA GetProcessHeap

user32

MessageBoxW

advapi32

LookupPrivilegeValueW OpenProcessToken RegSetValueExW RegQueryValueExW RegDeleteValueW RegOpenKeyExW AdjustTokenPrivileges

Sharing