85b9de8e766e038e19a255da36621bfecde77695bea0f4cdf18b4aae1e113c91

Sharing

Copy URL Twitter E-mail

General

Target
85b9de8e766e038e19a255da36621bfecde77695bea0f4cdf18b4aae1e113c91
Size 2.8MB
Sample260930-a691savbld
SHA256 85b9de8e766e038e19a255da36621bfecde77695bea0f4cdf18b4aae1e113c91
MD5 7bf9445a8c19ec8f66479b10d6aa97b8
SHA1 9da1794e0946cea9035694f04a2aa9ef54cf5067
SHA512 9cdf7762c4916a1ab46abf74fba1508cae08d2a680945fc7149698fd6d1da59a6fbf3eaae26622f55b5d481ddc2fa468bd187fd37970b420da55152e10f79b06
SSDEEP 49152:+DibHypjcxPqKX6TubhQq1pveKGb2KhJkGGVT/qLx8jjtWtGVLrTnNEYOYnVpEWd:+TYxPqKX6TubhQq1pve1b2KhJ0VTL/N3
TLSH
T188D5E021B542C07AD45620B1096CDBABC63CBD354B2168CBB7E41E7D5E206D26F32B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85b9de8e766e038e19a255da36621bfecde77695bea0f4cdf18b4aae1e113c91

File Explorer

85b9de8e766e038e19a255da36621bfecde77695bea0f4cdf18b4aae1e113c91

.exe 2.8MB

85b9de8e766e038e19a255da36621bfecde77695bea0f4cdf18b4aae1e113c91

IMPHASH b7e831187fc054f6183a6b4f09b9a99a
SHA256 85b9de8e766e038e19a255da36621bfecde77695bea0f4cdf18b4aae1e113c91
MD5 7bf9445a8c19ec8f66479b10d6aa97b8
SHA1 9da1794e0946cea9035694f04a2aa9ef54cf5067
SHA512 9cdf7762c4916a1ab46abf74fba1508cae08d2a680945fc7149698fd6d1da59a6fbf3eaae26622f55b5d481ddc2fa468bd187fd37970b420da55152e10f79b06
SSDEEP 49152:+DibHypjcxPqKX6TubhQq1pveKGb2KhJkGGVT/qLx8jjtWtGVLrTnNEYOYnVpEWd:+TYxPqKX6TubhQq1pve1b2KhJ0VTL/N3
TLSH
T188D5E021B542C07AD45620B1096CDBABC63CBD354B2168CBB7E41E7D5E206D26F32B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

751762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\data\workspace\code\result_generated\Win32\Release\Ginkgo.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

timeGetTime timeKillEvent timeSetEvent

comctl32

ord17 _TrackMouseEvent

shlwapi

PathIsRelativeW PathFileExistsW

gdiplus

GdipMeasureString GdipFillPath GdipFillEllipseI GdipDrawEllipseI GdipDrawString GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipDrawPath GdipDrawRectangleI GdipDrawBezierI GdipDrawLineI GdipFillRectangle GdipDeletePath GdipTransformPath GdipIsOutlineVisiblePathPointI GdipIsVisiblePathPointI GdipGetPathWorldBoundsI GdipAddPathPolygonI GdipAddPathPieI GdipAddPathArcI GdipAddPathEllipseI GdipAddPathRectangleI GdipAddPathCurveI GdipAddPathBezierI GdipScaleMatrix GdipAddPathLineI GdipClosePathFigure GdipStartPathFigure GdipGetPathFillMode GdipSetPathFillMode GdipResetPath GdipClonePath GdipCreatePath GdipCreateTexture GdipCreateBitmapFromHBITMAP GdipCreateSolidFill GdipGetPenDashStyle GdipSetPenDashStyle GdipGetPenLineJoin GdipSetPenLineJoin GdipGetPenDashCap197819 GdipGetPenEndCap GdipGetPenStartCap GdipSetPenDashCap197819 GdipSetPenEndCap GdipSetPenStartCap GdipSetPenColor GdipGetPenWidth GdipSetPenWidth GdipClonePen GdipCreateBitmapFromGdiDib GdipLoadImageFromFile GdipImageRotateFlip GdipDrawImageRect GdipSetWorldTransform GdipRotateMatrix GdipTranslateMatrix GdipCreatePen2 GdipSetLineBlend GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushFromRect GdipDrawArc GdipDeletePen GdipCreatePen1 GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipDeleteMatrix GdipCreateMatrix GdipAlloc GdipCloneImage GdiplusShutdown GdiplusStartup GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCreateHBITMAPFromBitmap GdipImageSelectActiveFrame GdipGetPropertyItem GdipGetPropertyItemSize GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipDisposeImage GdipAddPathLine2I

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

msimg32

AlphaBlend

advapi32

RegCloseKey CryptHashData CryptCreateHash CryptGenRandom CryptDestroyKey CryptGetHashParam CryptAcquireContextA RegGetValueW CryptReleaseContext CryptAcquireContextW CryptImportKey CryptSetKeyParam CryptEncrypt CryptDecrypt RegOpenKeyExW CryptDestroyHash RegQueryValueExW

kernel32

RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringEx DecodePointer EncodePointer GetStringTypeW SetStdHandle SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetNativeSystemInfo GetExitCodeThread SwitchToThread LocalFree GetFileInformationByHandleEx AreFileApisANSI SetFilePointerEx SetFileInformationByHandle SetEndOfFile GetFullPathNameW GetFileType ExitProcess GetFileSizeEx FlushFileBuffers GetConsoleOutputCP ReadConsoleW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetLastError MultiByteToWideChar GetUserDefaultLCID GetFileAttributesW GetDynamicTimeZoneInformation GetCurrentThreadId Sleep GetCurrentProcessId OutputDebugStringA SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA WriteFile GetConsoleMode GetProcAddress GetModuleHandleW CloseHandle CreateEventW WaitForSingleObject SetEvent CreateFileMappingW MapViewOfFile UnmapViewOfFile ReleaseMutex ReleaseSemaphore WaitForSingleObjectEx FormatMessageW HeapAlloc GetProcessHeap HeapFree GetModuleHandleExW GetModuleFileNameA DebugBreak IsDebuggerPresent OutputDebugStringW SetLastError OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCommandLineW WritePrivateProfileStringW GetPrivateProfileIntW GetModuleFileNameW LoadLibraryW FreeLibrary GetEnvironmentVariableW WriteConsoleW TlsSetValue TlsAlloc TlsGetValue TlsFree ResetEvent TerminateThread RaiseException CreateDirectoryW ReadFile FindClose CreateFileW DeleteFileW GetCurrentDirectoryW GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort TryEnterCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection DeleteCriticalSection LocalFileTimeToFileTime FileTimeToSystemTime QueryPerformanceFrequency SystemTimeToFileTime GetSystemTimeAsFileTime QueryPerformanceCounter VerifyVersionInfoW VerSetConditionMask GetTickCount GlobalLock GlobalUnlock GlobalFree FindResourceW LoadResource SizeofResource GlobalAlloc GetModuleHandleA MulDiv GlobalSize GetFileSize SetFilePointer EnumSystemLocalesW GetTimeZoneInformation HeapReAlloc LoadLibraryExW CreateThread FreeLibraryAndExitThread ExitThread GetStdHandle IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW AcquireSRWLockExclusive InitializeCriticalSectionEx FormatMessageA FindFirstFileExW FindNextFileW GetFileAttributesExW HeapSize SleepEx GetSystemDirectoryA LoadLibraryA GetEnvironmentVariableA MoveFileExA CreateFileA VirtualQuery ReleaseSRWLockExclusive GetDriveTypeW PeekNamedPipe WideCharToMultiByte SystemTimeToTzSpecificLocalTime GetFileInformationByHandle InitializeSRWLock

user32

UpdateLayeredWindow EndPaint PtInRect IsZoomed MonitorFromPoint OffsetRect SetWindowRgn MessageBoxW IsWindowVisible SetForegroundWindow UnionRect SetCursor CharNextW ClientToScreen GetSysColor GetAsyncKeyState OpenClipboard IsClipboardFormatAvailable GetClipboardData CloseClipboard EmptyClipboard SetClipboardData FindWindowW GetDesktopWindow MapWindowPoints GetParent SetWindowTextW GetDC GetPropW SetPropW CallWindowProcW SendMessageW GetSystemMetrics GetUpdateRect IsIconic MonitorFromWindow IsRectEmpty GetWindowRect ShowWindow SetFocus EnableWindow GetWindow GetWindowLongW SetWindowLongW GetClassInfoExW RegisterClassW LoadCursorW ReleaseDC MoveWindow InvalidateRect BeginPaint DefWindowProcW DestroyWindow CreateWindowExW UnregisterClassW WaitMessage RegisterClassExW DispatchMessageW SetTimer PeekMessageW MsgWaitForMultipleObjectsEx CallMsgFilterW GetQueueStatus TranslateMessage KillTimer PostMessageW FindWindowExW AllowSetForegroundWindow AttachThreadInput GetWindowThreadProcessId GetForegroundWindow IsWindow PostQuitMessage ReleaseCapture SetCapture GetFocus IntersectRect GetMonitorInfoW GetCursorPos GetClientRect GetKeyState SetWindowPos ScreenToClient

gdi32

CreateRectRgnIndirect GetObjectA SetStretchBltMode SetWindowOrgEx GetStockObject GetWindowOrgEx RestoreDC SaveDC DeleteDC CreateCompatibleDC StretchBlt CreateDIBSection GetDeviceCaps CreateRoundRectRgn BitBlt ExtSelectClipRgn SelectObject DeleteObject CreateFontIndirectW GetObjectW

shell32

ShellExecuteW GetCurrentProcessExplicitAppUserModelID

ole32

CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoCreateInstance CoTaskMemFree CoTaskMemAlloc

crypt32

CryptDecodeObjectEx PFXImportCertStore CertFreeCertificateChain CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA

ws2_32

bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl inet_pton closesocket WSACleanup __WSAFDIsSet select getaddrinfo freeaddrinfo accept htonl listen ioctlsocket WSACreateEvent send recv WSACloseEvent WSAWaitForMultipleEvents WSAResetEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAStartup

Sharing

General

Malware Config

Signatures

File Explorer

85b9de8e766e038e19a255da36621bfecde77695bea0f4cdf18b4aae1e113c91

version

winmm

comctl32

shlwapi

gdiplus

imm32

msimg32

advapi32

kernel32

user32

gdi32

shell32

ole32

crypt32

ws2_32

generic