ee3ae5c943b6737f0e05f316b12464e003671dfbbca76f24e14964a57ee7ec54

Sharing

Copy URL Twitter E-mail

General

Target
ee3ae5c943b6737f0e05f316b12464e003671dfbbca76f24e14964a57ee7ec54
Size 1000KB
Sample261002-heflvstalg
SHA256 ee3ae5c943b6737f0e05f316b12464e003671dfbbca76f24e14964a57ee7ec54
MD5 3381ac48cad3765543d16d4f4e2cd0ad
SHA1 f2c8761256c90e004883310f0503a632e81aefcb
SHA512 6d09319267ccb8faf41f93882996c043a1df4cea0b242950ff1ce1c3d6b153b150302dc5fe3c3e17e2e2f0ead9d58d252d6c73f8b32cf474e7bead3fcd12aecd
SSDEEP 12288:dqUyF9t9S0Yhb8UV5FwmJCIb8ULsPcjDkw7PeXAg:dqUq7zYlV5JCuLHPeQg
TLSH
T1DA251700328280F1FE6106339A6CCAB5F52D7E210B71B7DB67947A69C971DD19A3CF26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee3ae5c943b6737f0e05f316b12464e003671dfbbca76f24e14964a57ee7ec54

File Explorer

ee3ae5c943b6737f0e05f316b12464e003671dfbbca76f24e14964a57ee7ec54

.exe 1000KB

ee3ae5c943b6737f0e05f316b12464e003671dfbbca76f24e14964a57ee7ec54

IMPHASH 735677d2e4883e0ebdeb5bc43f821a3f
SHA256 ee3ae5c943b6737f0e05f316b12464e003671dfbbca76f24e14964a57ee7ec54
MD5 3381ac48cad3765543d16d4f4e2cd0ad
SHA1 f2c8761256c90e004883310f0503a632e81aefcb
SHA512 6d09319267ccb8faf41f93882996c043a1df4cea0b242950ff1ce1c3d6b153b150302dc5fe3c3e17e2e2f0ead9d58d252d6c73f8b32cf474e7bead3fcd12aecd
SSDEEP 12288:dqUyF9t9S0Yhb8UV5FwmJCIb8ULsPcjDkw7PeXAg:dqUq7zYlV5JCuLHPeQg
TLSH
T1DA251700328280F1FE6106339A6CCAB5F52D7E210B71B7DB67947A69C971DD19A3CF26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

87962

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\workspace\ci.cbu.seller.win.build\develop\SourceCode\out\symbol\release\AliWorkbench.pdb

kernel32

WaitForSingleObject CreateThread TerminateThread CreateProcessW FindResourceExW GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW LocalFree GetPrivateProfileStringW CreateFileW ReadFile MultiByteToWideChar WideCharToMultiByte CreateDirectoryW DeleteFileW FindClose FindFirstFileW FlushFileBuffers GetFileAttributesW GetFileSize SetFilePointer WriteFile Sleep GetCurrentProcessId OpenProcess GetLocalTime FreeLibrary DeleteCriticalSection LoadLibraryW GlobalAlloc GlobalFree LocalAlloc lstrcmpA CopyFileW MoveFileExW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetConsoleMode GetConsoleCP SetFilePointerEx SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetCommandLineA InitializeCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc FindNextFileW FindFirstFileExW GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapAlloc HeapDestroy GetLastError RaiseException CloseHandle DecodePointer SetCurrentDirectoryW GetCommandLineW GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer SetLastError SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo OutputDebugStringW RtlUnwind ExitProcess GetModuleHandleExW GetStdHandle GetFileType GetDateFormatW GetTimeFormatW WriteConsoleW

shell32

ShellExecuteExW SHFileOperationW CommandLineToArgvW SHGetSpecialFolderPathW SHCreateDirectoryExW

oleaut32

VariantTimeToSystemTime VarUdateFromDate SystemTimeToVariantTime

advapi32

OpenProcessToken CheckTokenMembership FreeSid DuplicateTokenEx GetTokenInformation LookupAccountSidW GetUserNameW AllocateAndInitializeSid

shlwapi

PathCanonicalizeW PathFileExistsW PathAppendW

wintrust

WinVerifyTrust

crypt32

CryptMsgClose CryptMsgGetParam CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CryptDecodeObject

Sharing

General

Malware Config

Signatures

File Explorer

ee3ae5c943b6737f0e05f316b12464e003671dfbbca76f24e14964a57ee7ec54

kernel32

shell32

oleaut32

advapi32

shlwapi

wintrust

crypt32

generic