2ff6acf070fdc0a57a42010c04322b71f7442be3b792dff2bde9820215bb3654

Sharing

Copy URL Twitter E-mail

General

Target
2ff6acf070fdc0a57a42010c04322b71f7442be3b792dff2bde9820215bb3654
Size 1.5MB
Sample260930-gghcssx12p
SHA256 2ff6acf070fdc0a57a42010c04322b71f7442be3b792dff2bde9820215bb3654
MD5 bfab139eed1ed604469987265ffda44e
SHA1 ced97f42f586ecd776e91ddae1890f8d5447a17b
SHA512 3304139ed77228afbae8067f2660441969c346d316a76cf26da8b2065b8d77b76d603788e82d54a0f2d7cc1a20d06298e2d570574afba4d7aca21f9ae6a37ba7
SSDEEP 24576:+mdvJCjLG4TBt3byAUHWreGf+jY+JqRp5fl9NJn:5vJCXG4ltLyvH88YzRp5/NJn
TLSH
T1E7750130369A8432E9B30172597CAB7FA079B7591F7350DB66C84B5D8C706C32B74B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ff6acf070fdc0a57a42010c04322b71f7442be3b792dff2bde9820215bb3654

File Explorer

2ff6acf070fdc0a57a42010c04322b71f7442be3b792dff2bde9820215bb3654

.exe 1.5MB

2ff6acf070fdc0a57a42010c04322b71f7442be3b792dff2bde9820215bb3654

IMPHASH 1f0d8fc096453c0d48b43a3af1721f01
SHA256 2ff6acf070fdc0a57a42010c04322b71f7442be3b792dff2bde9820215bb3654
MD5 bfab139eed1ed604469987265ffda44e
SHA1 ced97f42f586ecd776e91ddae1890f8d5447a17b
SHA512 3304139ed77228afbae8067f2660441969c346d316a76cf26da8b2065b8d77b76d603788e82d54a0f2d7cc1a20d06298e2d570574afba4d7aca21f9ae6a37ba7
SSDEEP 24576:+mdvJCjLG4TBt3byAUHWreGf+jY+JqRp5fl9NJn:5vJCXG4ltLyvH88YzRp5/NJn
TLSH
T1E7750130369A8432E9B30172597CAB7FA079B7591F7350DB66C84B5D8C706C32B74B2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

164659

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\workspace\p-ad0484fbdfe349d18f6d70b4084a70ba\src\product\win32\dbginfo\pdfaccountsvr.pdb

kernel32

CompareFileTime EnterCriticalSection WaitForMultipleObjects LeaveCriticalSection InitializeCriticalSection CreateEventW GetFileAttributesExW SetEvent CloseHandle LocalFree WideCharToMultiByte GetPrivateProfileIntW GetProcessId GetLocalTime ReadFile WriteFile SetFilePointer LocalAlloc CreateFileW GetFileSize CreateDirectoryW GetModuleFileNameW GetFileAttributesW DeleteFileW MultiByteToWideChar GetVersionExW GetSystemDirectoryW GetProcAddress GetModuleHandleW MoveFileW WaitForSingleObject ResetEvent K32GetModuleFileNameExW OpenProcess GetTickCount GetExitCodeThread Sleep OutputDebugStringW TerminateProcess CreateNamedPipeW UnmapViewOfFile DisconnectNamedPipe CreateToolhelp32Snapshot Process32NextW Process32FirstW QueryFullProcessImageNameW CreateFileMappingW MapViewOfFile ConnectNamedPipe CreateMutexW LoadLibraryW GetPrivateProfileStringW GetProcessHeap AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount IsDebuggerPresent DeleteCriticalSection HeapDestroy HeapAlloc FindResourceW LoadResource FindResourceExW RaiseException HeapReAlloc LockResource GetLastError HeapSize InitializeCriticalSectionEx HeapFree CreateThread SizeofResource

user32

DefWindowProcW SendMessageW GetWindowRect DestroyWindow IsWindowVisible CreateWindowExW PostMessageW GetMessageW RealGetWindowClassW RegisterClassExW ShowWindow IsWindow DispatchMessageW SetTimer IsChild GetForegroundWindow TranslateMessage LoadCursorW PostQuitMessage SetWinEventHook UnhookWinEvent GetWindowTextW GetWindowThreadProcessId wsprintfW FindWindowW

advapi32

GetLengthSid AddMandatoryAce GetTokenInformation RegNotifyChangeKeyValue RegOpenKeyExW RegCloseKey RegOpenKeyW RegQueryValueExW InitializeAcl InitializeSecurityDescriptor OpenProcessToken SetSecurityDescriptorSacl ConvertStringSidToSidW GetSidSubAuthority GetSidSubAuthorityCount SetSecurityDescriptorDacl GetSecurityDescriptorSacl

shell32

SHGetFolderPathW ShellExecuteExW ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathRemoveFileSpecW PathFileExistsW

msvcp140

?_Throw_C_error@std@@YAXH@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ _Mtx_lock _Mtx_init_in_situ _Mtx_unlock _Mtx_destroy_in_situ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

vcruntime140

wcsstr memcpy memchr _except_handler4_common __current_exception_context __current_exception memset memmove _CxxThrowException __CxxFrameHandler3 wcsrchr wcschr strchr __std_terminate __std_exception_destroy _purecall __std_exception_copy

api-ms-win-crt-string-l1-1-0

tolower isalnum strncmp _stricmp isspace strnlen wcscspn wcsspn wmemcpy_s iswspace wcstok wcsncmp _wcsicmp _wcslwr_s isalpha wcsnlen

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 _mktime64

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _errno _invalid_parameter_noinfo _controlfp_s _c_exit _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _register_thread_local_exe_atexit_callback _set_app_type _beginthreadex _seh_filter_exe _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free _recalloc calloc

api-ms-win-crt-convert-l1-1-0

_wtoi64 _wtoi wcstol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vswprintf_s __stdio_common_vswscanf fclose _set_fmode __stdio_common_vfprintf __stdio_common_vsnprintf_s fflush __p__commode _wfopen __stdio_common_vswprintf fputws __stdio_common_vsscanf __stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-filesystem-l1-1-0

_wstat32

api-ms-win-crt-locale-l1-1-0

_configthreadlocale setlocale

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sharing

General

Malware Config

Signatures

File Explorer

2ff6acf070fdc0a57a42010c04322b71f7442be3b792dff2bde9820215bb3654

kernel32

user32

advapi32

shell32

shlwapi

msvcp140

version

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

generic