5186b1fb7959acf47896928e943dcb6aafb46523591ff5144bf4df2454964e15

Sharing

Copy URL Twitter E-mail

General

Target
5186b1fb7959acf47896928e943dcb6aafb46523591ff5144bf4df2454964e15
Size 2.4MB
Sample260930-kkxtfazxcz
SHA256 5186b1fb7959acf47896928e943dcb6aafb46523591ff5144bf4df2454964e15
MD5 5219af2109216e51c335febc1ec8d3c2
SHA1 4a92d5773e84ed331224b14d992b3cc7f591a403
SHA512 9f0762d33ebbf558bae22f40dc09ed41673fc65586356aaab096e36c1428d686b505ddc97e765ed9dfe9ca8eeded84ba30441b38d75b679531d880a5491b482f
SSDEEP 49152:uNq97gBcENQfZt4h5p9bZrnoBmFUdrPlCLwNYIfJ4klKXnj:u8hgBAH4vTZrnoScrdCmYIfJ4k
TLSH
T1C7C5E0017682C072D752513035DAD2AADE28BE6D4B2748C7BFD3376EDE306D24AF9249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5186b1fb7959acf47896928e943dcb6aafb46523591ff5144bf4df2454964e15

File Explorer

5186b1fb7959acf47896928e943dcb6aafb46523591ff5144bf4df2454964e15

.exe 2.4MB

5186b1fb7959acf47896928e943dcb6aafb46523591ff5144bf4df2454964e15

IMPHASH cd88f298feb287e83e03a7aaee1d092c
SHA256 5186b1fb7959acf47896928e943dcb6aafb46523591ff5144bf4df2454964e15
MD5 5219af2109216e51c335febc1ec8d3c2
SHA1 4a92d5773e84ed331224b14d992b3cc7f591a403
SHA512 9f0762d33ebbf558bae22f40dc09ed41673fc65586356aaab096e36c1428d686b505ddc97e765ed9dfe9ca8eeded84ba30441b38d75b679531d880a5491b482f
SSDEEP 49152:uNq97gBcENQfZt4h5p9bZrnoBmFUdrPlCLwNYIfJ4klKXnj:u8hgBAH4vTZrnoScrdCmYIfJ4k
TLSH
T1C7C5E0017682C072D752513035DAD2AADE28BE6D4B2748C7BFD3376EDE306D24AF9249
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

331688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Publish\rail_tips\build\bin\Release\web_pay.pdb

kernel32

SetCurrentDirectoryW LoadLibraryW OutputDebugStringW SetDllDirectoryW GetModuleFileNameW GetCommandLineW OutputDebugStringA CreateProcessW CreateToolhelp32Snapshot GetLastError lstrlenW lstrlenA CreateFileW WriteConsoleW CompareStringW GetConsoleMode GetConsoleCP GetExitCodeProcess GetTimeZoneInformation GetCurrentDirectoryW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID FatalAppExitA HeapReAlloc GetCurrentProcessId Process32FirstW Process32NextW Sleep GetTickCount OpenProcess WaitForSingleObject CloseHandle InterlockedExchange IsValidCodePage GetOEMCP GetACP QueryPerformanceCounter HeapDestroy HeapCreate GetStartupInfoW SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW HeapSize GetLocaleInfoW GetStdHandle IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetLastError TlsFree TlsSetValue TlsGetValue WideCharToMultiByte MultiByteToWideChar GetFileAttributesW InterlockedDecrement GetDiskFreeSpaceExA GetDriveTypeW FindFirstFileW LocalFree LocalAlloc lstrcpyW GetDriveTypeA GetLogicalDriveStringsA DeleteFileA SetFileAttributesA GetFileAttributesA GetModuleFileNameA GetModuleHandleA CreateFileA GetLongPathNameW HeapAlloc GetProcessHeap VirtualQuery WriteProcessMemory GetCurrentProcess SetUnhandledExceptionFilter GetProcAddress GetModuleHandleW HeapFree Thread32Next Thread32First SuspendThread OpenThread GetCurrentThreadId TerminateProcess WaitForMultipleObjects SearchPathW DuplicateHandle CreateEventA EnterCriticalSection ReadProcessMemory VirtualAllocEx InitializeCriticalSection SetErrorMode UnmapViewOfFile MapViewOfFile CreateFileMappingW GetPrivateProfileStringA LoadLibraryA GetPrivateProfileStringW FreeLibrary InterlockedIncrement InterlockedCompareExchange DeleteCriticalSection LeaveCriticalSection EncodePointer DecodePointer FormatMessageA GetEnvironmentVariableA CreateFileMappingA OpenFileMappingA CreateThread ExitThread GetCurrentThread GetExitCodeThread SleepEx GetSystemTimeAsFileTime VirtualProtect VirtualLock VirtualUnlock SetProcessWorkingSetSize FlushViewOfFile SetEndOfFile SetFilePointer Process32Next Process32First GetSystemInfo GetVersionExA GetLocalTime Module32First LockFile LockFileEx UnlockFile UnlockFileEx WriteFile ReadFile FlushFileBuffers GetFileSize CreateDirectoryA CopyFileA GetShortPathNameA CreateMutexA ReleaseMutex ResetEvent SetEvent ExitProcess GenerateConsoleCtrlEvent RtlUnwind RaiseException GetCommandLineA HeapSetInformation LCMapStringW GetCPInfo FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime CreatePipe CreateProcessA SetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetFullPathNameA SetConsoleCtrlHandler SetEnvironmentVariableA GetCurrentDirectoryA SetCurrentDirectoryA GetFileInformationByHandle PeekNamedPipe GetTimeFormatA GetDateFormatA MoveFileA TlsAlloc OpenMutexA

user32

InflateRect OffsetRect SetWindowLongA MessageBoxA TranslateMessage PeekMessageW GetWindow GetForegroundWindow SetWindowPos DispatchMessageA SetCursor ClipCursor

shell32

CommandLineToArgvW SHCreateDirectoryExW SHGetDesktopFolder SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW

version

GetFileVersionInfoW VerQueryValueA GetFileVersionInfoSizeW

shlwapi

PathFileExistsW PathIsRelativeW

winmm

timeBeginPeriod timeGetDevCaps timeSetEvent timeKillEvent

tx_log

?GetLogLevel@TxLogWrapper@@YG?AW4LogLevel@1@XZ ?MakeLogOutput@TxLogWrapper@@YGXPB_W0W4LogLevel@1@@Z ?SetLogPath@TxLogWrapper@@YGXPB_W@Z ?SetLogLevel@TxLogWrapper@@YGXW4LogLevel@1@@Z ?FlushLog@TxLogWrapper@@YGXXZ

crypt32

CryptMsgClose CertCloseStore CertFreeCertificateContext CertGetNameStringA CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CertGetNameStringW

ws2_32

listen socket setsockopt ioctlsocket gethostbyname htons ntohl inet_addr bind WSAGetLastError connect __WSAFDIsSet select accept closesocket send recv htonl WSACleanup getsockopt inet_ntoa WSAStartup

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CoTaskMemFree CoInitializeSecurity

oleaut32

SysFreeString VariantClear CreateErrorInfo SetErrorInfo VariantInit VariantChangeType GetErrorInfo SysAllocString

comdlg32

GetOpenFileNameW

advapi32

RegCreateKeyExW AllocateAndInitializeSid InitializeSecurityDescriptor InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl FreeSid RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCloseKey GetLengthSid

Sharing

General

Malware Config

Signatures

File Explorer

5186b1fb7959acf47896928e943dcb6aafb46523591ff5144bf4df2454964e15

kernel32

user32

shell32

version

shlwapi

winmm

tx_log

crypt32

ws2_32

ole32

oleaut32

comdlg32

advapi32

generic