acac20335bb39df2eae352cc702f12708ca0af581c027ac1b67a1dae74e4eb36

Sharing

Copy URL Twitter E-mail

General

Target
acac20335bb39df2eae352cc702f12708ca0af581c027ac1b67a1dae74e4eb36
Size 4.3MB
Sample261001-hdtr4atwft
SHA256 acac20335bb39df2eae352cc702f12708ca0af581c027ac1b67a1dae74e4eb36
MD5 8bf59ce3fa7611e7b5f97abda8709e31
SHA1 32a735826aef3716f46d8873c2b63f79571728b0
SHA512 e7a7310857956acd00bf43e89bb7a039e125244fa9db2f84d4276b73b0837fa988990c825948bfe766eb2798d0767f95f4aa452927523c12edd7ece12cfb49de
SSDEEP 98304:G8cpBeK8j0J/2iZs8dw8gf3D/+q7Ccr953z:G8cb8AJSPL/p5BB
TLSH
T14326AE233605C539D86112F15D28BBAE826D99351FB504D7F3E86E1E4E646C22F33F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
acac20335bb39df2eae352cc702f12708ca0af581c027ac1b67a1dae74e4eb36

File Explorer

acac20335bb39df2eae352cc702f12708ca0af581c027ac1b67a1dae74e4eb36

.exe 4.3MB

acac20335bb39df2eae352cc702f12708ca0af581c027ac1b67a1dae74e4eb36

IMPHASH 735eb0cb1538657605a3f31233804b21
SHA256 acac20335bb39df2eae352cc702f12708ca0af581c027ac1b67a1dae74e4eb36
MD5 8bf59ce3fa7611e7b5f97abda8709e31
SHA1 32a735826aef3716f46d8873c2b63f79571728b0
SHA512 e7a7310857956acd00bf43e89bb7a039e125244fa9db2f84d4276b73b0837fa988990c825948bfe766eb2798d0767f95f4aa452927523c12edd7ece12cfb49de
SSDEEP 98304:G8cpBeK8j0J/2iZs8dw8gf3D/+q7Ccr953z:G8cb8AJSPL/p5BB
TLSH
T14326AE233605C539D86112F15D28BBAE826D99351FB504D7F3E86E1E4E646C22F33F2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2350848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\devops\data\p-4e427c98f1c445cc902daac3669dbefb\win\out\MTRelease\WXWorkWeb.pdb

adj

?GetStatusADJ@@YAHXZ

shlwapi

PathMatchSpecW PathFileExistsW

libcef

cef_zip_reader_create cef_v8context_get_current_context cef_string_multimap_append cef_string_multimap_value cef_string_multimap_key cef_string_multimap_size cef_string_map_append cef_string_map_value cef_string_map_key cef_string_map_size cef_string_list_append cef_string_list_value cef_string_list_size cef_browser_host_create_browser cef_request_context_create_context cef_cookie_manager_get_global_manager cef_stream_reader_create_for_handler cef_stream_reader_create_for_data cef_stream_reader_create_for_file cef_command_line_create cef_string_map_free cef_string_map_alloc cef_api_hash cef_write_json cef_parse_json cef_uriencode cef_get_mime_type cef_string_multimap_alloc cef_quit_message_loop cef_run_message_loop cef_shutdown cef_initialize cef_execute_process cef_register_extension cef_post_delayed_task cef_post_task cef_currently_on cef_v8value_create_array cef_v8value_create_object cef_v8value_create_string cef_v8value_create_double cef_v8value_create_int cef_v8value_create_bool cef_v8value_create_null cef_process_message_create cef_list_value_create cef_dictionary_value_create cef_string_list_free cef_string_list_alloc cef_value_create cef_string_userfree_utf16_free cef_string_wide_to_utf8 cef_log cef_string_multimap_free cef_string_utf8_clear cef_string_utf16_clear cef_string_utf16_cmp cef_string_utf8_to_utf16 cef_string_userfree_utf16_alloc cef_get_min_log_level cef_parse_url cef_string_utf16_to_utf8 cef_time_to_basetime cef_time_from_doublet ?SetWXWorkDnsUpdateCallback@@YAXP6AXXZ@Z ?GetUserHostSystemResolver@@YAPAVIUserSystemHostResolver@@XZ ?SetUserHostSystemResolverCallback@@YAXPAVIUserSystemHostResolver@@@Z cef_string_ascii_to_utf16 cef_string_utf16_set

dbghelp

SymFromAddr SymSetSearchPathW SymGetSearchPathW SymInitialize SymGetLineFromAddr64 SymCleanup SymSetOptions

winmm

timeGetTime timeBeginPeriod timeEndPeriod

kernel32

MapViewOfFileEx UnmapViewOfFile CreateSemaphoreA ReleaseSemaphore FormatMessageA LocalFree CreateDirectoryA RemoveDirectoryA GetProcAddress GetModuleHandleA SetLastError CreateFileW GetFileSize ReadFile GetVersionExW VirtualAlloc VirtualFree FreeLibrary LoadLibraryExW GetCommandLineW DecodePointer HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap PostQueuedCompletionStatus EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent WaitForMultipleObjects QueueUserAPC TerminateThread TlsAlloc TlsFree GetModuleFileNameW LoadLibraryExA LoadLibraryA LoadLibraryW FormatMessageW SetDllDirectoryW WideCharToMultiByte SearchPathW RaiseException SetUnhandledExceptionFilter SetErrorMode InitializeCriticalSection CreateEventW TerminateProcess OpenThread SuspendThread CreateProcessW VirtualQuery VirtualAllocEx ReadProcessMemory WriteProcessMemory CreateFileMappingW MapViewOfFile FindResourceExW LoadResource LockResource SizeofResource FindResourceW CreateToolhelp32Snapshot Thread32First Thread32Next Module32FirstW Module32NextW OpenFileMappingW lstrcmpW GetNamedPipeServerProcessId GetUserDefaultLCID InitializeSRWLock SetWaitableTimer TlsSetValue CreateWaitableTimerW InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus ReleaseSRWLockExclusive AcquireSRWLockExclusive WaitForSingleObjectEx ReleaseSRWLockShared AcquireSRWLockShared VerSetConditionMask SleepEx VerifyVersionInfoW TlsGetValue CreateEventA CreateIoCompletionPort DeleteFileW GetNativeSystemInfo SetThreadPriority GetCurrentThread GetLocaleInfoW CreateMutexW SetThreadAffinityMask CreateNamedPipeW WaitNamedPipeW RegisterWaitForSingleObject UnregisterWaitEx ConnectNamedPipe GetFileSizeEx GetCurrentDirectoryW OutputDebugStringA GetLocalTime ResetEvent OutputDebugStringW TryAcquireSRWLockExclusive CreateThread IsDebuggerPresent GetThreadId GetThreadPriority TzSpecificLocalTimeToSystemTime SystemTimeToFileTime WaitForSingleObject SystemTimeToTzSpecificLocalTime QueryThreadCycleTime GetDiskFreeSpaceExW K32QueryWorkingSetEx SetInformationJobObject SetFileAttributesW RemoveDirectoryW GetFileAttributesW MoveFileExW CreateDirectoryW GetTempPathW GetLongPathNameW QueryDosDeviceW GetFileAttributesExW SetCurrentDirectoryW RtlCaptureStackBackTrace GetModuleHandleExW VirtualQueryEx FindFirstFileExW FindNextFileW GetEnvironmentVariableW SetEnvironmentVariableW SetFilePointerEx GetFileInformationByHandle FlushFileBuffers InitializeConditionVariable SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable HeapSetInformation GetUserDefaultLangID ExpandEnvironmentStringsW GetWindowsDirectoryW GetSystemDirectoryW GetCurrentProcessorNumber InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetFileTime GetFullPathNameW DeviceIoControl AreFileApisANSI SetProcessDEPPolicy TerminateJobObject UnregisterWait GetUserDefaultLocaleName EnumSystemLocalesEx GetProductInfo IsWow64Process GetFileType WriteFile SetEndOfFile FindClose FindNextFileA FindFirstFileA CreateFileA DuplicateHandle CloseHandle GetLastError QueryPerformanceFrequency QueryPerformanceCounter GetSystemInfo SwitchToThread Sleep GetProcessTimes GetSystemTimeAsFileTime K32GetPerformanceInfo K32EmptyWorkingSet GlobalMemoryStatusEx ExitProcess GetCurrentProcess GetModuleHandleW GetTickCount ReleaseMutex SetHandleInformation AssignProcessToJobObject GetProcessHeaps GetCurrentThreadId GetCurrentProcessId GetCPInfo MultiByteToWideChar GetStringTypeW CreateJobObjectW GetExitCodeThread CreateFileMappingA CreateMutexA FileTimeToSystemTime QueryInformationJobObject VirtualProtectEx DeleteProcThreadAttributeList InitializeProcThreadAttributeList UpdateProcThreadAttribute VirtualFreeEx GetProcessHandleCount lstrlenW DebugBreak CreateRemoteThread GetLogicalProcessorInformation SetFilePointer GetLocaleInfoEx EncodePointer LCMapStringEx CancelIo OpenEventA RtlUnwind InterlockedPushEntrySList GetCommandLineA SetConsoleCtrlHandler ExitThread FreeLibraryAndExitThread GetDriveTypeW GetConsoleOutputCP WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetStdHandle GetTimeZoneInformation SetStdHandle GetConsoleMode CompareStringEx

user32

CreateWindowStationW SetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW RegisterWindowMessageW SendMessageTimeoutW PostMessageW DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW FindWindowW AllowSetForegroundWindow SystemParametersInfoW SendMessageW CallWindowProcW CreateDesktopW CloseWindowStation CloseDesktop ClientToScreen PostQuitMessage SetTimer GetQueueStatus MsgWaitForMultipleObjectsEx KillTimer MsgWaitForMultipleObjects DispatchMessageW TranslateMessage PeekMessageW LoadCursorW DestroyWindow GetClassNameW IsWindow GetWindow SetWindowLongW GetWindowLongW ScreenToClient GetThreadDesktop

advapi32

RevertToSelf SetTokenInformation GetKernelObjectSecurity GetSecurityDescriptorSacl GetAce SetKernelObjectSecurity DuplicateTokenEx MapGenericMask DuplicateToken GetSecurityDescriptorDacl GetNamedSecurityInfoW ImpersonateLoggedOnUser FreeSid AddMandatoryAce SetSecurityInfo GetSecurityInfo SetEntriesInAclW BuildTrusteeWithSidW AdjustTokenPrivileges LookupPrivilegeValueW CreateRestrictedToken SetThreadToken CreateProcessAsUserW EqualSid ConvertSidToStringSidW AccessCheck InitializeSid IsValidSid GetLengthSid CreateWellKnownSid ConvertStringSidToSidW GetSidSubAuthority GetTokenInformation OpenProcessToken InitializeAcl SystemFunction036 RegQueryValueExW RegOpenKeyW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegQueryValueExA RegOpenKeyExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegDisablePredefinedCache

shell32

SHGetFolderPathW ShellExecuteW SHGetSpecialFolderPathW CommandLineToArgvW

ole32

StringFromGUID2 CoCreateGuid CoUninitialize CoInitializeEx CoTaskMemFree

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

ws2_32

accept closesocket send connect getsockname recv WSAGetLastError select WSASetLastError listen bind socket htonl ioctlsocket WSACleanup WSAStartup ntohs

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

generic

count=204, id=261, version=30795,

count=26, id=261, version=31937,

count=2, id=253, version=33808,

count=27, id=259, version=33808,

count=21, id=260, version=33808,

count=109, id=261, version=33808,

count=27, id=259, version=30795,

count=28, id=260, version=30795,

count=1, id=262, version=30795,

count=133, id=261, version=32215,

count=341, productName=Unmarked objects (old),

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=362, id=265, version=34120,

count=28, id=257, version=30795,

count=3, id=257, version=34120,

count=628, id=1, productName=Unmarked objects,

count=48, id=261, version=34120,

count=1, id=256, version=34120,

count=1, id=255, version=34120,

count=1, id=151,

count=1, id=258, version=34120,