95ec5717c16520c1404e8ff2de8529a6d34020468f81807ad713d1f793d1627d

Sharing

Copy URL Twitter E-mail

General

Target
95ec5717c16520c1404e8ff2de8529a6d34020468f81807ad713d1f793d1627d
Size 1.5MB
Sample260930-gswdssyxht
SHA256 95ec5717c16520c1404e8ff2de8529a6d34020468f81807ad713d1f793d1627d
MD5 48996039c080dc8745f8eb122d69469c
SHA1 0cfcaec5bc28c1df62ecfb0ccd8200eb92afec54
SHA512 54ad77cfab3e5d47766bcd686acc25962752299421f2a3e991bf2a060f2b6de9ad4e9b6283bc44d8a319483a4e91b1a431cffce2a1971ea33777e8a3b9fc0293
SSDEEP 24576:1mdvJCjLGBTBt3byAUHWreGf+jY+JqRp5fl9NJn:GvJCXGBltLyvH88YzRp5/NJn
TLSH
T18B750131369A8432EAB30172597CAB7F6079B7591F7340DB66C84B5D8C706C32B74B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95ec5717c16520c1404e8ff2de8529a6d34020468f81807ad713d1f793d1627d

File Explorer

95ec5717c16520c1404e8ff2de8529a6d34020468f81807ad713d1f793d1627d

.exe 1.5MB

95ec5717c16520c1404e8ff2de8529a6d34020468f81807ad713d1f793d1627d

IMPHASH 1f0d8fc096453c0d48b43a3af1721f01
SHA256 95ec5717c16520c1404e8ff2de8529a6d34020468f81807ad713d1f793d1627d
MD5 48996039c080dc8745f8eb122d69469c
SHA1 0cfcaec5bc28c1df62ecfb0ccd8200eb92afec54
SHA512 54ad77cfab3e5d47766bcd686acc25962752299421f2a3e991bf2a060f2b6de9ad4e9b6283bc44d8a319483a4e91b1a431cffce2a1971ea33777e8a3b9fc0293
SSDEEP 24576:1mdvJCjLGBTBt3byAUHWreGf+jY+JqRp5fl9NJn:GvJCXGBltLyvH88YzRp5/NJn
TLSH
T18B750131369A8432EAB30172597CAB7F6079B7591F7340DB66C84B5D8C706C32B74B2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

164659

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\workspace\p-ad0484fbdfe349d18f6d70b4084a70ba\src\product\win32\dbginfo\pdfaccountsvr.pdb

kernel32

CompareFileTime EnterCriticalSection WaitForMultipleObjects LeaveCriticalSection InitializeCriticalSection CreateEventW GetFileAttributesExW SetEvent CloseHandle LocalFree WideCharToMultiByte GetPrivateProfileIntW GetProcessId GetLocalTime ReadFile WriteFile SetFilePointer LocalAlloc CreateFileW GetFileSize CreateDirectoryW GetModuleFileNameW GetFileAttributesW DeleteFileW MultiByteToWideChar GetVersionExW GetSystemDirectoryW GetProcAddress GetModuleHandleW MoveFileW WaitForSingleObject ResetEvent K32GetModuleFileNameExW OpenProcess GetTickCount GetExitCodeThread Sleep OutputDebugStringW TerminateProcess CreateNamedPipeW UnmapViewOfFile DisconnectNamedPipe CreateToolhelp32Snapshot Process32NextW Process32FirstW QueryFullProcessImageNameW CreateFileMappingW MapViewOfFile ConnectNamedPipe CreateMutexW LoadLibraryW GetPrivateProfileStringW GetProcessHeap AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount IsDebuggerPresent DeleteCriticalSection HeapDestroy HeapAlloc FindResourceW LoadResource FindResourceExW RaiseException HeapReAlloc LockResource GetLastError HeapSize InitializeCriticalSectionEx HeapFree CreateThread SizeofResource

user32

DefWindowProcW SendMessageW GetWindowRect DestroyWindow IsWindowVisible CreateWindowExW PostMessageW GetMessageW RealGetWindowClassW RegisterClassExW ShowWindow IsWindow DispatchMessageW SetTimer IsChild GetForegroundWindow TranslateMessage LoadCursorW PostQuitMessage SetWinEventHook UnhookWinEvent GetWindowTextW GetWindowThreadProcessId wsprintfW FindWindowW

advapi32

GetLengthSid AddMandatoryAce GetTokenInformation RegNotifyChangeKeyValue RegOpenKeyExW RegCloseKey RegOpenKeyW RegQueryValueExW InitializeAcl InitializeSecurityDescriptor OpenProcessToken SetSecurityDescriptorSacl ConvertStringSidToSidW GetSidSubAuthority GetSidSubAuthorityCount SetSecurityDescriptorDacl GetSecurityDescriptorSacl

shell32

SHGetFolderPathW ShellExecuteExW ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathRemoveFileSpecW PathFileExistsW

msvcp140

?_Throw_C_error@std@@YAXH@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ _Mtx_lock _Mtx_init_in_situ _Mtx_unlock _Mtx_destroy_in_situ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

vcruntime140

wcsstr memcpy memchr _except_handler4_common __current_exception_context __current_exception memset memmove _CxxThrowException __CxxFrameHandler3 wcsrchr wcschr strchr __std_terminate __std_exception_destroy _purecall __std_exception_copy

api-ms-win-crt-string-l1-1-0

tolower isalnum strncmp _stricmp isspace strnlen wcscspn wcsspn wmemcpy_s iswspace wcstok wcsncmp _wcsicmp _wcslwr_s isalpha wcsnlen

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 _mktime64

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _errno _invalid_parameter_noinfo _controlfp_s _c_exit _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _register_thread_local_exe_atexit_callback _set_app_type _beginthreadex _seh_filter_exe _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free _recalloc calloc

api-ms-win-crt-convert-l1-1-0

_wtoi64 _wtoi wcstol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vswprintf_s __stdio_common_vswscanf fclose _set_fmode __stdio_common_vfprintf __stdio_common_vsnprintf_s fflush __p__commode _wfopen __stdio_common_vswprintf fputws __stdio_common_vsscanf __stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-filesystem-l1-1-0

_wstat32

api-ms-win-crt-locale-l1-1-0

_configthreadlocale setlocale

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sharing

General

Malware Config

Signatures

File Explorer

95ec5717c16520c1404e8ff2de8529a6d34020468f81807ad713d1f793d1627d

kernel32

user32

advapi32

shell32

shlwapi

msvcp140

version

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

generic