XyronFreeMacro[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
XyronFreeMacro.exe
Size 424KB
Sample261001-2ca35sca29
SHA256 8f5add72eab2209a68e5bb2ff00fae27cf4dc7458e110e29afe185c3499e66ce
MD5 568bd79520a4d6684e636b53d0d8ee58
SHA1 9209a56a8145b71f2032418a977c8205cd63253a
SHA512 02b875cbe95558295c08b4b733eb003a9151251fd16aadf3418814d0288555a5942e1e080ef9ddcdff9432d6063873d185ea6500c642dbb48a01930bebd20ad8
SSDEEP 6144:Q55DV2X7HO/r6h+6aXlg1WmKw4oxrwebMSF8294ef7lmCHQdHa04a4EYoi:/Srn3lgMmZxrBF822qoWQ9/4gZ
TLSH
T19994AE15E2E505FAEA37867CDD639A02EA3378460770E6DF0390496A1F336D49E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XyronFreeMacro.exe

File Explorer

XyronFreeMacro.exe

.exe 424KB

XyronFreeMacro.exe

IMPHASH 7b963fd2ba0f99247f06a40f498e5313
SHA256 8f5add72eab2209a68e5bb2ff00fae27cf4dc7458e110e29afe185c3499e66ce
MD5 568bd79520a4d6684e636b53d0d8ee58
SHA1 9209a56a8145b71f2032418a977c8205cd63253a
SHA512 02b875cbe95558295c08b4b733eb003a9151251fd16aadf3418814d0288555a5942e1e080ef9ddcdff9432d6063873d185ea6500c642dbb48a01930bebd20ad8
SSDEEP 6144:Q55DV2X7HO/r6h+6aXlg1WmKw4oxrwebMSF8294ef7lmCHQdHa04a4EYoi:/Srn3lgMmZxrBF822qoWQ9/4gZ
TLSH
T19994AE15E2E505FAEA37867CDD639A02EA3378460770E6DF0390496A1F336D49E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

106944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

SelectObject CreateRoundRectRgn BitBlt CreateDIBSection DeleteDC CreateCompatibleBitmap CreateCompatibleDC DeleteObject

gdiplus

GdiplusShutdown GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipSaveGraphics GdipCloneImage GdipDeleteBrush GdipDrawEllipseI GdipAlloc GdipDrawImageRectI GdipDeletePath GdipDisposeImage GdipSetSmoothingMode GdipCreateLineBrush GdipCreatePath GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipFillPath GdipDrawLine GdipClosePathFigure GdipGetGenericFontFamilySansSerif GdipFree GdipDrawPath GdipDrawString GdipCreateFromHDC GdipFillEllipseI GdipFillEllipse GdipSetTextRenderingHint GdipRestoreGraphics GdipCloneBrush GdipFillRectangleI GdipAddPathArc GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipTranslateWorldTransform GdipCreateBitmapFromFile GdipDeletePen GdipCreatePen1 GdipSetStringFormatAlign GdipDrawLineI GdiplusStartup GdipCreateStringFormat

user32

SetCapture TranslateMessage DestroyWindow IsWindow GetDC UpdateLayeredWindow ReleaseDC DefWindowProcW PostMessageW SetWindowPos SetWindowLongPtrW DispatchMessageW SetWindowRgn CreateWindowExW GetSystemMetrics GetWindowLongPtrW RegisterClassExW ShowWindow SetTimer LoadCursorW MessageBoxW KillTimer PostQuitMessage UpdateWindow ReleaseCapture InvalidateRect GetCursorPos BeginPaint EndPaint GetKeyNameTextW MapVirtualKeyW SendInput GetAsyncKeyState GetMessageW FindWindowW

winmm

timeBeginPeriod timeEndPeriod

shell32

ShellExecuteExW SHGetFolderPathW ShellExecuteW

advapi32

OpenProcessToken GetTokenInformation

kernel32

HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx GetFileType LCMapStringW LoadLibraryExW VirtualProtect CreateFileW HeapAlloc UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle TerminateProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread GetCurrentThreadId WriteConsoleW HeapFree SetDefaultDllDirectories GetCurrentProcess GetModuleFileNameW CreateMutexW ReleaseMutex GetModuleHandleA CreateToolhelp32Snapshot Sleep GetLastError Process32NextW Process32FirstW CloseHandle LoadLibraryW CreateThread Module32FirstW GetProcAddress ExitProcess GetCurrentProcessId GetModuleHandleW Module32NextW SetDllDirectoryW IsDebuggerPresent CheckRemoteDebuggerPresent GetTickCount64 SetThreadPriority GetCurrentThread QueryPerformanceFrequency QueryPerformanceCounter CreateDirectoryW FindFirstFileW WritePrivateProfileStringW FindNextFileW GetPrivateProfileIntW FindClose GetFileAttributesW GetPrivateProfileStringW DeleteFileW Beep WaitForSingleObjectEx SwitchToThread

Name

.text

Size

200KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

XyronFreeMacro.exe

gdi32

gdiplus

user32

winmm

shell32

advapi32

kernel32

generic