e19317c3b46ed59071ffa5e027fc12ccad2d59472baf637a3a2e3d4ac3e538a1

Sharing

Copy URL Twitter E-mail

General

Target
e19317c3b46ed59071ffa5e027fc12ccad2d59472baf637a3a2e3d4ac3e538a1
Size 2.9MB
Sample260926-s2bljavy2p
SHA256 e19317c3b46ed59071ffa5e027fc12ccad2d59472baf637a3a2e3d4ac3e538a1
MD5 e145be1e425d0d06b6d40c45fd2a73b9
SHA1 8999425956737100e3fb01f2bda8eee0f981a7cb
SHA512 d7966459ef8ebe8a8350ab5fbab035cf10b0f087bf3baa9d7b3765e8a7ac2544f20c36e50f42b4446644bfa53c87d03ee17688f93be19f8a653ee2058d8a20e2
SSDEEP 49152:Mrx18CTOvDvB65n1Km1mYZj+Y6lYww9N/H+rvX2sLNiXicJFFRGNzj3:Uxnit6rgYFH+rvX2s7wRGpj3
TLSH
T18FD5494AAAB481F0D0B7D03DC5826A5BF872745ACB3597D702868B5F1F2B3E1993DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e19317c3b46ed59071ffa5e027fc12ccad2d59472baf637a3a2e3d4ac3e538a1

File Explorer

e19317c3b46ed59071ffa5e027fc12ccad2d59472baf637a3a2e3d4ac3e538a1

.exe 2.9MB

e19317c3b46ed59071ffa5e027fc12ccad2d59472baf637a3a2e3d4ac3e538a1

IMPHASH 7728a1ee37d87a053d3b883e4f60c81e
SHA256 e19317c3b46ed59071ffa5e027fc12ccad2d59472baf637a3a2e3d4ac3e538a1
MD5 e145be1e425d0d06b6d40c45fd2a73b9
SHA1 8999425956737100e3fb01f2bda8eee0f981a7cb
SHA512 d7966459ef8ebe8a8350ab5fbab035cf10b0f087bf3baa9d7b3765e8a7ac2544f20c36e50f42b4446644bfa53c87d03ee17688f93be19f8a653ee2058d8a20e2
SSDEEP 49152:Mrx18CTOvDvB65n1Km1mYZj+Y6lYww9N/H+rvX2sLNiXicJFFRGNzj3:Uxnit6rgYFH+rvX2s7wRGpj3
TLSH
T18FD5494AAAB481F0D0B7D03DC5826A5BF872745ACB3597D702868B5F1F2B3E1993DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1109816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Temp\FiboConfigSrv\x64\Release\FiboConfigSrv.pdb

setupapi

SetupDiEnumDeviceInfo SetupDiGetClassDevsA SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdA SetupDiClassGuidsFromNameA SetupDiGetDeviceRegistryPropertyA

kernel32

SetCommState SetCommTimeouts lstrlenA GetPrivateProfileIntA SetEvent OpenEventA GetPrivateProfileStringA WinExec GetPrivateProfileSectionA CreateDirectoryA WideCharToMultiByte ReleaseMutex CreateMutexA EnterCriticalSection LeaveCriticalSection ReleaseSemaphore CreateThread TerminateThread ReadDirectoryChangesW DeleteFileA GetFileAttributesA GetLocalTime CopyFileA MoveFileA FindClose FindFirstFileA GetSystemDirectoryA FindNextFileA GetCommState HeapFree GetProcessHeap OpenProcess GetTickCount LocalAlloc LocalFree CreateToolhelp32Snapshot Process32First Process32Next InitializeCriticalSection GetCurrentProcess GetVersionExA WaitForMultipleObjects CreateSemaphoreA GetCurrentDirectoryA LocalFileTimeToFileTime SetFilePointer SetFileTime SystemTimeToFileTime GetFileInformationByHandle GetFileSize MapViewOfFile UnmapViewOfFile CreateFileMappingA FileTimeToSystemTime SetEndOfFile WaitForMultipleObjectsEx ReadConsoleW ClearCommError ClearCommBreak GetModuleFileNameA CreateProcessA GetExitCodeProcess TerminateProcess CreateEventA WaitForSingleObject ResetEvent GetOverlappedResult CloseHandle OutputDebugStringA WriteFile ReadFile CreateFileA Sleep InitializeCriticalSectionEx GetLastError SetEnvironmentVariableA lstrlenW GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc GetThreadTimes FreeLibrary HeapAlloc LoadLibraryW SetStdHandle GetTimeZoneInformation FreeLibraryAndExitThread SetProcessAffinityMask VirtualProtect GetSystemTimeAsFileTime QueryPerformanceCounter SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers LoadLibraryExW OutputDebugStringW SetConsoleCtrlHandler GetCurrentThread GetOEMCP GetACP IsValidCodePage VirtualFree VirtualAlloc GetVersionExW UnregisterWaitEx InitializeSListHead DuplicateHandle GetModuleHandleA DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW CreateFileW CreateEventW SetCommMask BuildCommDCBW GetCommModemStatus GetCurrentThreadId GetCurrentProcessId RaiseException CreateSemaphoreW GetSystemInfo RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA FatalAppExitA GetCPInfo TryEnterCriticalSection CreateTimerQueue InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList RtlCaptureStackBackTrace WaitForSingleObjectEx SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority TlsAlloc TlsGetValue TlsSetValue TlsFree GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetModuleHandleW GetProcAddress GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount GetStartupInfoW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess AreFileApisANSI HeapSize

user32

UnregisterClassW GetDesktopWindow wsprintfA

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken StartServiceA QueryServiceStatusEx QueryServiceStatus QueryServiceConfigA OpenServiceA OpenSCManagerA EnumDependentServicesA DeleteService CreateServiceA ControlService CloseServiceHandle ChangeServiceConfig2A ChangeServiceConfigA RegSetValueExA RegQueryInfoKeyA RegOpenKeyExA RegEnumKeyExA StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerA RegQueryValueExA RegCloseKey InitiateSystemShutdownA

shell32

SHFileOperationA SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SafeArrayGetVartype CreateErrorInfo SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetDim SafeArrayCreate SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound SafeArrayDestroy SysFreeString SysAllocString GetErrorInfo VariantClear VariantInit VariantChangeType SetErrorInfo SafeArrayPutElement

shlwapi

PathIsDirectoryA PathFileExistsA PathAddBackslashA

wtsapi32

WTSFreeMemory WTSEnumerateSessionsA

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

556KB

Virtual Size

555KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

133KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

e19317c3b46ed59071ffa5e027fc12ccad2d59472baf637a3a2e3d4ac3e538a1

setupapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wtsapi32

generic