73c4aeb07e0a33960c246eeff75dcfe58411a039a48f834ec0006d1dd1ff7bc6

Sharing

Copy URL Twitter E-mail

General

Target
73c4aeb07e0a33960c246eeff75dcfe58411a039a48f834ec0006d1dd1ff7bc6
Size 3.4MB
Sample260925-npf82adg44
SHA256 73c4aeb07e0a33960c246eeff75dcfe58411a039a48f834ec0006d1dd1ff7bc6
MD5 d14ffa3314424027101717c870fb1f90
SHA1 bafad903ee77514044b18b935b0b6bc7175eac59
SHA512 17997e5ad105808b8f013c3a917310596f09f2257b6c5e76a8f2eeeb1e098e64f2cbd8441a800d9e120983954a199cd44f525be8b62fe123fe41e1527b8c5088
SSDEEP 49152:QdWOzVw9dv6FebFVyUzcSjIgRrP0YHIg9Xy7c5Gac1LwgJKM7cATB5qU+1qY7qH8:GzVediFetcSjIg93J94cqwg0M7+d7qH8
TLSH
T14DF56C213B85C136D5AD02B1A97CDAAF50697EB40B7854D7F2AC1B2E2B744C32732E17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
73c4aeb07e0a33960c246eeff75dcfe58411a039a48f834ec0006d1dd1ff7bc6

File Explorer

73c4aeb07e0a33960c246eeff75dcfe58411a039a48f834ec0006d1dd1ff7bc6

.dll 3.4MB

73c4aeb07e0a33960c246eeff75dcfe58411a039a48f834ec0006d1dd1ff7bc6

IMPHASH 1f036057a1607749cdba482f255e2d5e
SHA256 73c4aeb07e0a33960c246eeff75dcfe58411a039a48f834ec0006d1dd1ff7bc6
MD5 d14ffa3314424027101717c870fb1f90
SHA1 bafad903ee77514044b18b935b0b6bc7175eac59
SHA512 17997e5ad105808b8f013c3a917310596f09f2257b6c5e76a8f2eeeb1e098e64f2cbd8441a800d9e120983954a199cd44f525be8b62fe123fe41e1527b8c5088
SSDEEP 49152:QdWOzVw9dv6FebFVyUzcSjIgRrP0YHIg9Xy7c5Gac1LwgJKM7cATB5qU+1qY7qH8:GzVediFetcSjIg93J94cqwg0M7+d7qH8
TLSH
T14DF56C213B85C136D5AD02B1A97CDAAF50697EB40B7854D7F2AC1B2E2B744C32732E17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1519447

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Jenkins\.jenkins\workspace\birdsrv\360wpsrv\Release\birdsrv.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

GetLogicalDriveStringsW CreateDirectoryW CreateJobObjectW AssignProcessToJobObject SetInformationJobObject FindClose GetFullPathNameW FindFirstFileW FindNextFileW InterlockedExchange ExpandEnvironmentStringsW GetSystemTime AddAtomW FindAtomW RemoveDirectoryW GlobalLock GlobalUnlock MulDiv ReleaseMutex GetFileSizeEx OutputDebugStringW GetDriveTypeW CopyFileW DecodePointer InterlockedIncrement InterlockedDecrement LockResource FreeLibrary WaitForMultipleObjects DeleteAtom IsDebuggerPresent EncodePointer InitializeSListHead WaitForSingleObjectEx SystemTimeToFileTime ResumeThread IsBadReadPtr SetUnhandledExceptionFilter VirtualProtect InterlockedCompareExchange CreateThread GetUserDefaultLangID MoveFileA DeleteFileA CreateFileA SetFilePointer GlobalFree GlobalAlloc Process32NextW Process32FirstW CreateToolhelp32Snapshot MoveFileW GetFileAttributesW GetTempFileNameW GetTempPathW WritePrivateProfileStringW GetPrivateProfileStringW GetStartupInfoW TerminateProcess GetCurrentProcessId GetCurrentProcess OpenProcess GetShortPathNameW LocalFree SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindNextFileA FindFirstFileExA GetOEMCP IsValidCodePage SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW WriteConsoleW GetModuleFileNameA GetFileAttributesExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue SetEndOfFile ExitProcess GetACP GetFileType GetStdHandle GetSystemWindowsDirectoryW lstrcmpiA lstrcmpA DeviceIoControl UnhandledExceptionFilter FlushFileBuffers CreateFileMappingW UnmapViewOfFile MapViewOfFile InterlockedExchangeAdd GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW QueryPerformanceCounter TryEnterCriticalSection GetExitCodeThread GetCurrentThread LocalAlloc GetVersion FreeResource GetWindowsDirectoryW lstrcmpW lstrcpynW MoveFileExW ResetEvent WaitForSingleObject SetEvent SetFileAttributesW CreateFileW ReadFile WriteFile GetFileSize DeleteFileW GetLocalTime GetTickCount WideCharToMultiByte SetLastError MultiByteToWideChar GetVersionExW GetSystemDirectoryW FindResourceExW FindResourceW GetCommandLineW CreateProcessW GetModuleHandleExW GetModuleHandleW GetModuleHandleA GetDiskFreeSpaceExW GetModuleFileNameW LoadLibraryExW LoadLibraryW LoadLibraryA CreateEventW CreateMutexW lstrlenW lstrcmpiW CloseHandle SizeofResource LoadResource Sleep DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError GetCurrentThreadId RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetProcAddress SwitchToThread DuplicateHandle FormatMessageW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList

user32

RemoveMenu TrackPopupMenuEx GetMenuItemInfoW SetMenuItemInfoW SetMenuDefaultItem InvalidateRect GetClientRect GetWindowRect MessageBeep MapWindowPoints PtInRect GetWindowLongW SetWindowLongW FindWindowW CheckMenuRadioItem LoadStringA LoadStringW GetMenuItemCount DestroyMenu CreatePopupMenu TranslateAcceleratorW AppendMenuW MonitorFromPoint GetMonitorInfoW EnumDisplayDevicesW RegisterClassExW GetClassInfoExW CreateWindowExW ShowWindow UpdateLayeredWindow IsWindowVisible GetWindowDC RemovePropW GetCaretPos SetCaretPos ShowCaret HideCaret CreateCaret GetIconInfo DrawIconEx SetRect CharPrevW SetWindowRgn IsZoomed GetPropW SetPropW RegisterClassW IsRectEmpty GetUpdateRect GetKeyState SetFocus CharNextW GetDlgItem SetWindowPos DestroyWindow IsWindow InflateRect wvsprintfW DrawFocusRect EqualRect UnionRect OffsetRect GetAsyncKeyState SetCapture ReleaseCapture UnregisterClassW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW SendMessageTimeoutW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW GetDC KillTimer RegisterHotKey ReleaseDC FillRect GetSysColor GetWindowTextLengthW GetWindowTextW InvalidateRgn CreateAcceleratorTableW GetFocus IsChild ChangeDisplaySettingsW EnumChildWindows ClientToScreen DrawTextW GetMenuItemID GetMenuState GetMenuStringW TrackMouseEvent CloseWindow GetAncestor GetWindowInfo DestroyIcon LoadIconW EnumWindows GetShellWindow GetDesktopWindow CopyRect WindowFromPoint SetCursor GetForegroundWindow UpdateWindow DeleteMenu EnableMenuItem GetActiveWindow EndDialog DialogBoxParamW GetDoubleClickTime ReplyMessage UnregisterHotKey BeginPaint SetActiveWindow GetWindow IntersectRect MoveWindow IsDialogMessageW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnableWindow CheckDlgButton GetDlgItemTextW SetDlgItemTextW CreateDialogParamW EnumDisplaySettingsW MessageBoxW GetSystemMetrics GetWindowThreadProcessId GetClassNameW FindWindowExW LoadImageW GetCursorPos TrackPopupMenu GetSubMenu LoadMenuW EnumDisplayMonitors MonitorFromWindow SetForegroundWindow IsIconic PostThreadMessageW SetRectEmpty SetWindowTextW SystemParametersInfoW LoadCursorW GetParent ScreenToClient EndPaint SetTimer

gdi32

GetDeviceCaps GetObjectW CreateDIBSection SelectObject SelectClipRgn SaveDC RestoreDC CreateRectRgnIndirect CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject DeleteDC RectVisible OffsetViewportOrgEx CreateFontIndirectW Rectangle GetTextMetricsW SetWindowOrgEx CreateRoundRectRgn CreateDCW GetCharABCWidthsW GetClipBox RoundRect ExtSelectClipRgn SetBkColor SetBkMode SetTextColor TextOutW ExtTextOutW GetDIBits SetDIBitsToDevice PatBlt StretchBlt SetStretchBltMode GetViewportOrgEx SetViewportOrgEx GetTextExtentPoint32W GdiFlush CreateSolidBrush CreatePen MoveToEx CreateFontW EnumFontFamiliesW CombineRgn GetStockObject LineTo

advapi32

CreateWellKnownSid RegCreateKeyW RegEnumKeyExA CloseServiceHandle GetTokenInformation RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA CheckTokenMembership DuplicateTokenEx LookupPrivilegeValueW GetLengthSid FreeSid AllocateAndInitializeSid RegEnumValueW AdjustTokenPrivileges SetTokenInformation OpenProcessToken GetUserNameW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW ord165 SHGetFolderPathW Shell_NotifyIconW SHGetSpecialFolderLocation SHBrowseForFolderW SHGetPathFromIDListW SHCreateDirectoryExA CommandLineToArgvW SHFileOperationW SHChangeNotify ShellExecuteExW ShellExecuteW

ole32

CLSIDFromString CreateStreamOnHGlobal CLSIDFromProgID CoCreateGuid CoInitializeSecurity CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoUninitialize CoInitialize OleLockRunning

oleaut32

SafeArrayPutElement SafeArrayCreate VarBstrCmp SysStringLen SysAllocStringLen SysFreeString VarUI4FromStr SysAllocString VariantInit VariantClear SysStringByteLen SysAllocStringByteLen

shlwapi

PathRemoveFileSpecA StrStrIW StrTrimA StrCmpNIW SHSetValueA SHGetValueA StrStrIA AssocQueryStringW PathIsDirectoryW PathFindFileNameW PathCombineW StrCmpIW SHSetValueW SHGetValueW SHDeleteKeyW SHDeleteValueW PathRemoveFileSpecW PathFileExistsW PathAppendW StrCmpW

comctl32

InitCommonControlsEx _TrackMouseEvent ord17

msimg32

GradientFill AlphaBlend

gdiplus

GdipGetPropertyItem GdipDrawImageRectI GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDrawLine GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectRectI GdipSetInterpolationMode GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdiplusStartup GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdiplusShutdown GdipDrawEllipseI GdipDrawPath ord1 GdipDrawImagePointsI GdipFillPath GdipGraphicsClear GdipBitmapUnlockBits GdipGetImageWidth GdipGetImageHeight GdipSetTextRenderingHint GdipFillRectangleI GdipDrawImageRectRect GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipSetSmoothingMode GdipFillEllipseI GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathArcI GdipCreateTexture GdipGetImageGraphicsContext GdipCloneBitmapAreaI GdipBitmapLockBits

secur32

InitializeSecurityContextA FreeCredentialsHandle AcquireCredentialsHandleA GetUserNameExW

ws2_32

connect WSACleanup closesocket htons recv WSAAsyncSelect WSAAsyncGetHostByName WSAGetLastError gethostbyname socket shutdown send WSAStartup

wininet

InternetGetConnectedState InternetCrackUrlW InternetGetCookieW InternetSetCookieW InternetGetCookieExW InternetQueryOptionW DeleteUrlCacheEntryW InternetQueryOptionA

rasapi32

RasGetConnectStatusW RasEnumConnectionsW

psapi

GetModuleFileNameExW

crypt32

CertGetNameStringW CryptBinaryToStringA

winmm

timeBeginPeriod timeKillEvent timeEndPeriod timeSetEvent

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

iphlpapi

GetAdaptersInfo

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

generic

count=34, id=241, version=40116,

count=184, id=243, version=40116,

count=35, id=242, version=40116,

count=6, id=260, productName=VS2017 v15.7.5 build 26433, version=26433,

count=4, productName=Unmarked objects (old),

count=26, id=264, version=27045,

count=3, id=199, version=41118,

count=28, id=259, version=26706,

count=7, id=261, version=27049,

count=1, id=260, version=27048,

count=40, id=261, version=27048,

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=38, id=260, version=26706,

count=130, id=261, version=26706,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=19, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=703, id=1, productName=Unmarked objects,

count=210, id=261, version=27045,

count=1, id=256, version=27045,

count=1, id=255, version=27045,

count=3, id=151,

count=1, id=258, version=27045,