0849a78dd77529b0cb6623d4948ce94fff30dc88283a63174640c5d55d955fd9

Sharing

Copy URL Twitter E-mail

General

Target
0849a78dd77529b0cb6623d4948ce94fff30dc88283a63174640c5d55d955fd9
Size 8.3MB
Sample260930-e857tssxfs
SHA256 0849a78dd77529b0cb6623d4948ce94fff30dc88283a63174640c5d55d955fd9
MD5 1df4c54ff20931f1adf9943ce35b9c29
SHA1 85400b7871ab42fcce80d05364ef8919316a86d3
SHA512 9283d5bad8aca842b37a1dbbca24453a1b042fa1fb5eb55b716ab001c4111cc79e04663a0015062ece9cd817c52488d9dd82ce6ce02bdd18e08dc55cf505da5a
SSDEEP 196608:JIV0GxRtX5tIHvM2c+tQasnAVQC2L4k/QBqjQHVpH:aV0GxRtXnIHAnAl2L4Df
TLSH
T1C396CF11B390802AF0F701B586BE866A99747E301725D4CFA3C07E5E6F716D1AB39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0849a78dd77529b0cb6623d4948ce94fff30dc88283a63174640c5d55d955fd9

File Explorer

0849a78dd77529b0cb6623d4948ce94fff30dc88283a63174640c5d55d955fd9

.exe 8.3MB

0849a78dd77529b0cb6623d4948ce94fff30dc88283a63174640c5d55d955fd9

IMPHASH 8961b6f3f37d074a3610bbbea0f6006c
SHA256 0849a78dd77529b0cb6623d4948ce94fff30dc88283a63174640c5d55d955fd9
MD5 1df4c54ff20931f1adf9943ce35b9c29
SHA1 85400b7871ab42fcce80d05364ef8919316a86d3
SHA512 9283d5bad8aca842b37a1dbbca24453a1b042fa1fb5eb55b716ab001c4111cc79e04663a0015062ece9cd817c52488d9dd82ce6ce02bdd18e08dc55cf505da5a
SSDEEP 196608:JIV0GxRtX5tIHvM2c+tQasnAVQC2L4k/QBqjQHVpH:aV0GxRtXnIHAnAl2L4Df
TLSH
T1C396CF11B390802AF0F701B586BE866A99747E301725D4CFA3C07E5E6F716D1AB39B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2218039

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\autobuild_sesvc_13\360sesvc\bin\Release\sesvc.pdb

kernel32

SetErrorMode lstrcmpiW LoadLibraryExW OutputDebugStringA QueryInformationJobObject IsProcessInJob FlushFileBuffers QueryPerformanceCounter FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetCurrentProcessId LockFileEx LocalFree CreateFileMappingA UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileA GetVersionExA WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnlockFileEx SetEndOfFile GetFullPathNameA LockFile GetDiskFreeSpaceW InterlockedCompareExchange GetFullPathNameW HeapFree HeapCreate AreFileApisANSI TryEnterCriticalSection GetPrivateProfileStringW WritePrivateProfileStringW OpenProcess DebugBreak lstrlenA lstrlenW GetDiskFreeSpaceExW OpenMutexW GetCurrentThread WaitForMultipleObjects GetPrivateProfileIntW GetSystemDirectoryW GetTempFileNameW QueryDosDeviceW GetFileType DuplicateHandle DosDateTimeToFileTime GetCurrentDirectoryW GetExitCodeProcess ReleaseMutex GetSystemTimes MoveFileW VirtualQuery SetUnhandledExceptionFilter GetCommandLineW WritePrivateProfileStructW DeviceIoControl ResetEvent TlsAlloc TlsSetValue TlsFree CreateWaitableTimerW SetWaitableTimer CancelWaitableTimer IsBadReadPtr IsBadWritePtr GetModuleHandleA lstrcpynW TerminateThread SuspendThread lstrcmpA lstrcmpiA GetFileSizeEx ExitProcess LocalFileTimeToFileTime CloseHandle MapViewOfFile GetCurrentProcess CreateFileMappingW CreateFileW GetLastError GetFileSize WriteFile ReadFile SetFilePointer CreateFileA VirtualAlloc VirtualFree GetVersionExW SetLastError SetFileTime CreateDirectoryW GetFileAttributesW DecodePointer RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection DeleteFileW MultiByteToWideChar WideCharToMultiByte SetEvent WaitForSingleObject CreateEventW GetCurrentThreadId WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA SetStdHandle GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode GetModuleFileNameA SetEnvironmentVariableA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread RtlUnwind OpenThread HeapWalk HeapUnlock HeapLock SetFilePointerEx FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsGetValue SwitchToThread EncodePointer LoadLibraryExA VirtualProtect VerifyVersionInfoA VerSetConditionMask PeekNamedPipe GetStdHandle GetEnvironmentVariableA MoveFileExA GetSystemDirectoryA QueryPerformanceFrequency SleepEx GetACP TerminateProcess InterlockedDecrement InterlockedIncrement FindFirstFileW RemoveDirectoryW FindClose FreeLibrary InitializeCriticalSection ExitThread MoveFileExW SetFileAttributesW GetModuleFileNameW GlobalAddAtomW CopyFileW GetTempPathW GetTickCount CreateThread Process32NextW Process32FirstW UnmapViewOfFile FindNextFileW EnterCriticalSection LeaveCriticalSection CreateMutexW FreeResource LockResource GetProcAddress GlobalAlloc GlobalLock GlobalUnlock GlobalFree Sleep LoadResource SizeofResource LoadLibraryW GetModuleHandleW CreateProcessW FindResourceW CreateToolhelp32Snapshot GetLongPathNameW

user32

TrackMouseEvent GetMonitorInfoW MonitorFromWindow GetDesktopWindow SetWindowLongW GetWindowLongW GetWindowRect SetWindowTextW DestroyWindow LoadCursorW KillTimer SetTimer GetAsyncKeyState GetKeyState SetWindowPos ShowWindow IsWindow UnregisterClassW GetMessageW PostThreadMessageW GetMessagePos CreateWindowExW GetClassInfoExW UpdateLayeredWindow IsWindowVisible GetSystemMetrics RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW CreatePopupMenu GetShellWindow DestroyMenu MsgWaitForMultipleObjects CloseWindow RealGetWindowClassW SystemParametersInfoW WindowFromPoint GetLastInputInfo SendMessageTimeoutW wsprintfW EnumDisplayDevicesW EnumDisplaySettingsW CharLowerW EnumDisplayMonitors GetWindowTextW wvsprintfW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW FindWindowW CharNextW PeekMessageW ReleaseDC GetClassNameW SendMessageW DispatchMessageW TranslateMessage UnregisterHotKey RegisterHotKey GetWindowThreadProcessId SetForegroundWindow GetForegroundWindow SetActiveWindow SetFocus AttachThreadInput FindWindowExW FindWindowExA FindWindowA GetDC DrawTextW SetMenuInfo TrackPopupMenu AppendMenuW PostMessageW

gdi32

GetDeviceCaps GetObjectW SetTextColor SetBkMode SelectObject GetStockObject DeleteObject DeleteDC CreateSolidBrush CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap

shell32

SHGetFolderPathW ord165 SHGetSpecialFolderPathW ShellExecuteW ShellExecuteExW SHFileOperationW ord680 SHAppBarMessage

ws2_32

send recv listen htons htonl closesocket accept gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet WSACleanup WSAIoctl WSASetLastError setsockopt ntohs getsockopt getsockname getpeername connect bind WSAGetLastError socket WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSAStartup WSAWaitForMultipleEvents

wldap32

ord143 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain

shlwapi

PathFindExtensionW SHGetValueA PathIsRootW PathGetDriveNumberW PathAddBackslashW StrDupW StrStrIW PathFindFileNameA StrStrIA SHDeleteValueW PathFindFileNameW StrCmpIW SHSetValueW SHGetValueW PathCombineW PathRemoveFileSpecW PathFileExistsA PathAppendW PathFileExistsW

psapi

GetModuleFileNameExW GetProcessImageFileNameW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

setupapi

SetupIterateCabinetW

netapi32

Netbios NetUserChangePassword

generic

count=20, id=241, version=40116,

count=204, id=243, version=40116,

count=30, id=242, version=40116,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=8, id=199, version=41118,

count=27, id=259, version=26706,

count=35, id=260, version=26706,

count=77, id=261, version=26706,

count=113, id=260, version=27034,

count=33, id=261, version=27034,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=718, id=1, productName=Unmarked objects,

count=116, id=261, version=27043,

count=49, id=260, version=27043,

count=1, id=256, version=27043,

count=1, id=255, version=27043,

count=1, id=151,

count=1, id=258, version=27043,