7b8fc65b6a2c1cefc880569343ac1913fc7b68aa730f98a7597b5bd5f9434813

Sharing

Copy URL Twitter E-mail

General

Target
7b8fc65b6a2c1cefc880569343ac1913fc7b68aa730f98a7597b5bd5f9434813
Size 4.4MB
Sample260930-c2gjsa1bjg
SHA256 7b8fc65b6a2c1cefc880569343ac1913fc7b68aa730f98a7597b5bd5f9434813
MD5 87ffcee9b081bd16e8ca7d7d43e47169
SHA1 bfb0ec04d880d00dc9690958669651e611baeb27
SHA512 cc0c78935c17bc09f20265d1b6b8a0610067962b2c2b65ba3532ac2179662d3df2efb5231b44441080d67999811e19f6f8443e9a790c9fe81aa867b712890edb
SSDEEP 98304:GzVediFetcSjIg93J94cqwg0M7+d7qHgk4C2:GzVed2ucSjIg9Zowo7Aq4C2
TLSH
T170262A313E91962AD1280A70BD6EE65F135F6EF0476840DB727D3ED92B704E22731B92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b8fc65b6a2c1cefc880569343ac1913fc7b68aa730f98a7597b5bd5f9434813

File Explorer

7b8fc65b6a2c1cefc880569343ac1913fc7b68aa730f98a7597b5bd5f9434813

.dll 4.4MB

7b8fc65b6a2c1cefc880569343ac1913fc7b68aa730f98a7597b5bd5f9434813

IMPHASH 1f036057a1607749cdba482f255e2d5e
SHA256 7b8fc65b6a2c1cefc880569343ac1913fc7b68aa730f98a7597b5bd5f9434813
MD5 87ffcee9b081bd16e8ca7d7d43e47169
SHA1 bfb0ec04d880d00dc9690958669651e611baeb27
SHA512 cc0c78935c17bc09f20265d1b6b8a0610067962b2c2b65ba3532ac2179662d3df2efb5231b44441080d67999811e19f6f8443e9a790c9fe81aa867b712890edb
SSDEEP 98304:GzVediFetcSjIg93J94cqwg0M7+d7qHgk4C2:GzVed2ucSjIg9Zowo7Aq4C2
TLSH
T170262A313E91962AD1280A70BD6EE65F135F6EF0476840DB727D3ED92B704E22731B92
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1519447

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Jenkins\.jenkins\workspace\birdsrv\360wpsrv\Release\birdsrv.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

GetLogicalDriveStringsW CreateDirectoryW CreateJobObjectW AssignProcessToJobObject SetInformationJobObject FindClose GetFullPathNameW FindFirstFileW FindNextFileW InterlockedExchange ExpandEnvironmentStringsW GetSystemTime AddAtomW FindAtomW RemoveDirectoryW GlobalLock GlobalUnlock MulDiv ReleaseMutex GetFileSizeEx OutputDebugStringW GetDriveTypeW CopyFileW DecodePointer InterlockedIncrement InterlockedDecrement LockResource FreeLibrary WaitForMultipleObjects DeleteAtom IsDebuggerPresent EncodePointer InitializeSListHead WaitForSingleObjectEx SystemTimeToFileTime ResumeThread IsBadReadPtr SetUnhandledExceptionFilter VirtualProtect InterlockedCompareExchange CreateThread GetUserDefaultLangID MoveFileA DeleteFileA CreateFileA SetFilePointer GlobalFree GlobalAlloc Process32NextW Process32FirstW CreateToolhelp32Snapshot MoveFileW GetFileAttributesW GetTempFileNameW GetTempPathW WritePrivateProfileStringW GetPrivateProfileStringW GetStartupInfoW TerminateProcess GetCurrentProcessId GetCurrentProcess OpenProcess GetShortPathNameW LocalFree SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindNextFileA FindFirstFileExA GetOEMCP IsValidCodePage SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW WriteConsoleW GetModuleFileNameA GetFileAttributesExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue SetEndOfFile ExitProcess GetACP GetFileType GetStdHandle GetSystemWindowsDirectoryW lstrcmpiA lstrcmpA DeviceIoControl UnhandledExceptionFilter FlushFileBuffers CreateFileMappingW UnmapViewOfFile MapViewOfFile InterlockedExchangeAdd GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW QueryPerformanceCounter TryEnterCriticalSection GetExitCodeThread GetCurrentThread LocalAlloc GetVersion FreeResource GetWindowsDirectoryW lstrcmpW lstrcpynW MoveFileExW ResetEvent WaitForSingleObject SetEvent SetFileAttributesW CreateFileW ReadFile WriteFile GetFileSize DeleteFileW GetLocalTime GetTickCount WideCharToMultiByte SetLastError MultiByteToWideChar GetVersionExW GetSystemDirectoryW FindResourceExW FindResourceW GetCommandLineW CreateProcessW GetModuleHandleExW GetModuleHandleW GetModuleHandleA GetDiskFreeSpaceExW GetModuleFileNameW LoadLibraryExW LoadLibraryW LoadLibraryA CreateEventW CreateMutexW lstrlenW lstrcmpiW CloseHandle SizeofResource LoadResource Sleep DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError GetCurrentThreadId RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetProcAddress SwitchToThread DuplicateHandle FormatMessageW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList

user32

RemoveMenu TrackPopupMenuEx GetMenuItemInfoW SetMenuItemInfoW SetMenuDefaultItem InvalidateRect GetClientRect GetWindowRect MessageBeep MapWindowPoints PtInRect GetWindowLongW SetWindowLongW FindWindowW CheckMenuRadioItem LoadStringA LoadStringW GetMenuItemCount DestroyMenu CreatePopupMenu TranslateAcceleratorW AppendMenuW MonitorFromPoint GetMonitorInfoW EnumDisplayDevicesW RegisterClassExW GetClassInfoExW CreateWindowExW ShowWindow UpdateLayeredWindow IsWindowVisible GetWindowDC RemovePropW GetCaretPos SetCaretPos ShowCaret HideCaret CreateCaret GetIconInfo DrawIconEx SetRect CharPrevW SetWindowRgn IsZoomed GetPropW SetPropW RegisterClassW IsRectEmpty GetUpdateRect GetKeyState SetFocus CharNextW GetDlgItem SetWindowPos DestroyWindow IsWindow InflateRect wvsprintfW DrawFocusRect EqualRect UnionRect OffsetRect GetAsyncKeyState SetCapture ReleaseCapture UnregisterClassW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW SendMessageTimeoutW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW GetDC KillTimer RegisterHotKey ReleaseDC FillRect GetSysColor GetWindowTextLengthW GetWindowTextW InvalidateRgn CreateAcceleratorTableW GetFocus IsChild ChangeDisplaySettingsW EnumChildWindows ClientToScreen DrawTextW GetMenuItemID GetMenuState GetMenuStringW TrackMouseEvent CloseWindow GetAncestor GetWindowInfo DestroyIcon LoadIconW EnumWindows GetShellWindow GetDesktopWindow CopyRect WindowFromPoint SetCursor GetForegroundWindow UpdateWindow DeleteMenu EnableMenuItem GetActiveWindow EndDialog DialogBoxParamW GetDoubleClickTime ReplyMessage UnregisterHotKey BeginPaint SetActiveWindow GetWindow IntersectRect MoveWindow IsDialogMessageW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnableWindow CheckDlgButton GetDlgItemTextW SetDlgItemTextW CreateDialogParamW EnumDisplaySettingsW MessageBoxW GetSystemMetrics GetWindowThreadProcessId GetClassNameW FindWindowExW LoadImageW GetCursorPos TrackPopupMenu GetSubMenu LoadMenuW EnumDisplayMonitors MonitorFromWindow SetForegroundWindow IsIconic PostThreadMessageW SetRectEmpty SetWindowTextW SystemParametersInfoW LoadCursorW GetParent ScreenToClient EndPaint SetTimer

gdi32

GetDeviceCaps GetObjectW CreateDIBSection SelectObject SelectClipRgn SaveDC RestoreDC CreateRectRgnIndirect CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject DeleteDC RectVisible OffsetViewportOrgEx CreateFontIndirectW Rectangle GetTextMetricsW SetWindowOrgEx CreateRoundRectRgn CreateDCW GetCharABCWidthsW GetClipBox RoundRect ExtSelectClipRgn SetBkColor SetBkMode SetTextColor TextOutW ExtTextOutW GetDIBits SetDIBitsToDevice PatBlt StretchBlt SetStretchBltMode GetViewportOrgEx SetViewportOrgEx GetTextExtentPoint32W GdiFlush CreateSolidBrush CreatePen MoveToEx CreateFontW EnumFontFamiliesW CombineRgn GetStockObject LineTo

advapi32

CreateWellKnownSid RegCreateKeyW RegEnumKeyExA CloseServiceHandle GetTokenInformation RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA CheckTokenMembership DuplicateTokenEx LookupPrivilegeValueW GetLengthSid FreeSid AllocateAndInitializeSid RegEnumValueW AdjustTokenPrivileges SetTokenInformation OpenProcessToken GetUserNameW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW ord165 SHGetFolderPathW Shell_NotifyIconW SHGetSpecialFolderLocation SHBrowseForFolderW SHGetPathFromIDListW SHCreateDirectoryExA CommandLineToArgvW SHFileOperationW SHChangeNotify ShellExecuteExW ShellExecuteW

ole32

CLSIDFromString CreateStreamOnHGlobal CLSIDFromProgID CoCreateGuid CoInitializeSecurity CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoUninitialize CoInitialize OleLockRunning

oleaut32

SafeArrayPutElement SafeArrayCreate VarBstrCmp SysStringLen SysAllocStringLen SysFreeString VarUI4FromStr SysAllocString VariantInit VariantClear SysStringByteLen SysAllocStringByteLen

shlwapi

PathRemoveFileSpecA StrStrIW StrTrimA StrCmpNIW SHSetValueA SHGetValueA StrStrIA AssocQueryStringW PathIsDirectoryW PathFindFileNameW PathCombineW StrCmpIW SHSetValueW SHGetValueW SHDeleteKeyW SHDeleteValueW PathRemoveFileSpecW PathFileExistsW PathAppendW StrCmpW

comctl32

InitCommonControlsEx _TrackMouseEvent ord17

msimg32

GradientFill AlphaBlend

gdiplus

GdipGetPropertyItem GdipDrawImageRectI GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDrawLine GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectRectI GdipSetInterpolationMode GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdiplusStartup GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdiplusShutdown GdipDrawEllipseI GdipDrawPath ord1 GdipDrawImagePointsI GdipFillPath GdipGraphicsClear GdipBitmapUnlockBits GdipGetImageWidth GdipGetImageHeight GdipSetTextRenderingHint GdipFillRectangleI GdipDrawImageRectRect GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipSetSmoothingMode GdipFillEllipseI GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathArcI GdipCreateTexture GdipGetImageGraphicsContext GdipCloneBitmapAreaI GdipBitmapLockBits

secur32

InitializeSecurityContextA FreeCredentialsHandle AcquireCredentialsHandleA GetUserNameExW

ws2_32

connect WSACleanup closesocket htons recv WSAAsyncSelect WSAAsyncGetHostByName WSAGetLastError gethostbyname socket shutdown send WSAStartup

wininet

InternetGetConnectedState InternetCrackUrlW InternetGetCookieW InternetSetCookieW InternetGetCookieExW InternetQueryOptionW DeleteUrlCacheEntryW InternetQueryOptionA

rasapi32

RasGetConnectStatusW RasEnumConnectionsW

psapi

GetModuleFileNameExW

crypt32

CertGetNameStringW CryptBinaryToStringA

winmm

timeBeginPeriod timeKillEvent timeEndPeriod timeSetEvent

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

iphlpapi

GetAdaptersInfo

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

generic

count=34, id=241, version=40116,

count=184, id=243, version=40116,

count=35, id=242, version=40116,

count=6, id=260, productName=VS2017 v15.7.5 build 26433, version=26433,

count=4, productName=Unmarked objects (old),

count=26, id=264, version=27045,

count=3, id=199, version=41118,

count=28, id=259, version=26706,

count=7, id=261, version=27049,

count=1, id=260, version=27048,

count=40, id=261, version=27048,

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=38, id=260, version=26706,

count=130, id=261, version=26706,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=19, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=703, id=1, productName=Unmarked objects,

count=210, id=261, version=27045,

count=1, id=256, version=27045,

count=1, id=255, version=27045,

count=3, id=151,

count=1, id=258, version=27045,