95e4711daad4a707005cd45b38ed9475df742b88fb03e152b6a00755f058097e

Sharing

Copy URL Twitter E-mail

General

Target
95e4711daad4a707005cd45b38ed9475df742b88fb03e152b6a00755f058097e
Size 523KB
Sample260923-x94phasw4n
SHA256 95e4711daad4a707005cd45b38ed9475df742b88fb03e152b6a00755f058097e
MD5 34866cee5fcbf623844fcec4c18c0581
SHA1 d4cb178cdf8f70943732658ca5d63590912b89f3
SHA512 6c73f1ea6962c48d3d1b908ab9f4af2bc2d971783d6bc2bbe5d3dac47cc7144eaaeef5a51bf54a88c6bc85b7b91976a933c0d6412b20451c489ad313557e9a78
SSDEEP 6144:UcobLMK1Gz7Y9KS8xlVNl3Hxwt2mz5mSqqLovqcmQKvAJZOgOs1cSWtmhPoUbm:ebL51GzM9KS8xlVbcdzJLT4JKDSWvUbm
TLSH
T194B44A55B36444B2D0A3D57E86828A8AF3B138450F3197CF03A5DBBA1F376E24A39771
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95e4711daad4a707005cd45b38ed9475df742b88fb03e152b6a00755f058097e

File Explorer

95e4711daad4a707005cd45b38ed9475df742b88fb03e152b6a00755f058097e

.exe 523KB

95e4711daad4a707005cd45b38ed9475df742b88fb03e152b6a00755f058097e

IMPHASH cffa5c3725ed588b2346a4495d35bf70
SHA256 95e4711daad4a707005cd45b38ed9475df742b88fb03e152b6a00755f058097e
MD5 34866cee5fcbf623844fcec4c18c0581
SHA1 d4cb178cdf8f70943732658ca5d63590912b89f3
SHA512 6c73f1ea6962c48d3d1b908ab9f4af2bc2d971783d6bc2bbe5d3dac47cc7144eaaeef5a51bf54a88c6bc85b7b91976a933c0d6412b20451c489ad313557e9a78
SSDEEP 6144:UcobLMK1Gz7Y9KS8xlVNl3Hxwt2mz5mSqqLovqcmQKvAJZOgOs1cSWtmhPoUbm:ebL51GzM9KS8xlVbcdzJLT4JKDSWvUbm
TLSH
T194B44A55B36444B2D0A3D57E86828A8AF3B138450F3197CF03A5DBBA1F376E24A39771
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

228608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\pcgmr_build\cim\cisrc\pdfconverter\pdfconverter\product\win32\shsign\fastpdf_ext_process64.pdb

kernel32

GetLastError LoadResource FindFirstFileW GetExitCodeProcess FindClose IsWow64Process GetNativeSystemInfo FindResourceExW VirtualAllocEx WriteProcessMemory VirtualFreeEx LoadLibraryW CreateRemoteThread GetProcAddress lstrlenA MultiByteToWideChar GetPrivateProfileIntW lstrlenW WideCharToMultiByte CreateFileW GetSystemDirectoryW CreateDirectoryW LocalFree LocalAlloc SetFilePointer WriteFile FlushFileBuffers CreateFileA GetFileSize ReadFile LoadLibraryA SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetTempPathW WritePrivateProfileStringW SetEndOfFile GetCommandLineW SetEnvironmentVariableA CompareStringW LockResource OpenProcess DeleteFileW SizeofResource InitializeCriticalSection GetFileAttributesW GetLocalTime GetPrivateProfileStringW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection CreateProcessW FindResourceW GetModuleFileNameW FreeLibrary GetExitCodeThread Sleep GetThreadContext GetCurrentThread GetModuleHandleW IsDebuggerPresent CloseHandle WaitForSingleObject SetThreadPriority CreateThread GetCurrentThreadId GetCurrentProcess CheckRemoteDebuggerPresent GetVersionExW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount HeapCreate CompareStringA WriteConsoleW GetConsoleOutputCP HeapSetInformation GetConsoleMode GetConsoleCP LCMapStringW WriteConsoleA SetStdHandle IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetLocaleInfoW GetCurrentProcessId GetTickCount QueryPerformanceCounter GetCommandLineA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException GetVersionExA GetACP GetLocaleInfoA GetThreadLocale GetSystemTimeAsFileTime GetModuleHandleA ExitProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter RtlCaptureContext RtlPcToFileHeader GetStartupInfoW RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry FlsGetValue FlsSetValue TlsFree FlsFree SetLastError FlsAlloc GetStdHandle GetModuleFileNameA GetCPInfo GetOEMCP IsValidCodePage GetTimeZoneInformation LCMapStringA GetEnvironmentStringsW

user32

CharLowerBuffW UnregisterClassA

advapi32

GetSidSubAuthority RegDeleteKeyW RegEnumValueW RegEnumKeyExW GetTokenInformation ConvertSidToStringSidW GetSidSubAuthorityCount OpenProcessToken GetSidIdentifierAuthority GetUserNameW LookupAccountNameW RegQueryInfoKeyW RegDeleteValueW QueryServiceConfigW CloseServiceHandle StartServiceW QueryServiceStatusEx OpenSCManagerW OpenServiceW ChangeServiceConfigW RegCreateKeyExW RegOpenKeyW RegSetValueExW RegQueryValueExW RegCloseKey RegOpenKeyExW

shell32

SHGetSpecialFolderPathW SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteExW ord680 SHGetFolderPathW

ole32

CoInitialize CoTaskMemFree CoTaskMemAlloc CoUninitialize

oleaut32

SysFreeString SystemTimeToVariantTime VariantTimeToSystemTime

shlwapi

PathAppendW PathCombineW PathAddBackslashW PathRemoveFileSpecW StrToIntW PathFileExistsW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Sharing

General

Malware Config

Signatures

File Explorer

95e4711daad4a707005cd45b38ed9475df742b88fb03e152b6a00755f058097e

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

generic