996ae57f1202851d369f3a54aab1c3dabb77c486db86048a360c5ed6b3e506d2

Sharing

Copy URL Twitter E-mail

General

Target
996ae57f1202851d369f3a54aab1c3dabb77c486db86048a360c5ed6b3e506d2
Size 7.6MB
Sample261002-ltd85afb99
SHA256 996ae57f1202851d369f3a54aab1c3dabb77c486db86048a360c5ed6b3e506d2
MD5 43e5189faa9b8715c1d179c7b1894bec
SHA1 fa6535c8a81ca4a77c319a7f8513e501f6d10c7a
SHA512 8d0199d256cc951d14f5f32561f3ac1abcd36df74bdf715db3ead37e59a9264bc675be684eec1ea765116afdf4c9917e76b8a5a20b109938aa5dc0c304986242
SSDEEP 98304:x+2JQYjY903z2Aw4khoN9pObA0DHCU023W:xbju03z2Aw47NPOE0Dip4W
TLSH
T113868D6AA3A811C8E0BBD17CC5464627E6F1F81A137057CF05A196B91F37AE96F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
996ae57f1202851d369f3a54aab1c3dabb77c486db86048a360c5ed6b3e506d2

File Explorer

996ae57f1202851d369f3a54aab1c3dabb77c486db86048a360c5ed6b3e506d2

.exe 7.6MB

996ae57f1202851d369f3a54aab1c3dabb77c486db86048a360c5ed6b3e506d2

IMPHASH c831407b6a6a235badb80d9d688a1608
SHA256 996ae57f1202851d369f3a54aab1c3dabb77c486db86048a360c5ed6b3e506d2
MD5 43e5189faa9b8715c1d179c7b1894bec
SHA1 fa6535c8a81ca4a77c319a7f8513e501f6d10c7a
SHA512 8d0199d256cc951d14f5f32561f3ac1abcd36df74bdf715db3ead37e59a9264bc675be684eec1ea765116afdf4c9917e76b8a5a20b109938aa5dc0c304986242
SSDEEP 98304:x+2JQYjY903z2Aw4khoN9pObA0DHCU023W:xbju03z2Aw47NPOE0Dip4W
TLSH
T113868D6AA3A811C8E0BBD17CC5464627E6F1F81A137057CF05A196B91F37AE96F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46876

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\Jenkins\WorkSpace\workspace\lib_TSCloudEnhancedService\bin\x64\RelWithDebInfo\TSCloudEnhancedService.pdb

kernel32

ResetEvent WaitForSingleObject CreateEventA RtlVirtualUnwind SetLastError GetSystemDirectoryA LoadLibraryA FormatMessageA GetFileType GetModuleHandleW MultiByteToWideChar GetEnvironmentVariableW GetSystemInfo VirtualAlloc VirtualProtect VirtualFree VirtualLock GetACP SwitchToFiber DeleteFiber CreateFiberEx QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiberEx FindClose FindFirstFileW FindNextFileW CancelIo ReadConsoleA ReadConsoleW GetSystemTime SystemTimeToFileTime WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW DeviceIoControl GetEnvironmentStringsW GetOEMCP IsValidCodePage ReadFile CreateFileA SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA GetConsoleMode WideCharToMultiByte GetDynamicTimeZoneInformation LocalFree Sleep SetErrorMode GetLastError WriteFile GetFileAttributesW GetCommandLineW GetStdHandle SetConsoleMode GetOverlappedResult OutputDebugStringW HeapReAlloc SetStdHandle GetTimeZoneInformation GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapAlloc HeapFree GetCurrentThread GetCommandLineA GetModuleFileNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW SetConsoleCtrlHandler ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread DeleteFileW LoadLibraryExW TlsFree TlsSetValue LoadLibraryW GetProcAddress FreeLibrary GetCurrentThreadId GetCurrentProcessId GetCurrentProcess CloseHandle FreeEnvironmentStringsW CreateFileW TlsGetValue TlsAlloc InterlockedFlushSList RtlUnwind QueryPerformanceFrequency WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetNativeSystemInfo InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime GetTempPathW AreFileApisANSI CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW InitOnceBeginInitialize InitOnceComplete FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetLocaleInfoEx GetStringTypeW InitializeCriticalSectionAndSpinCount SetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedPushEntrySList

user32

wsprintfW MessageBoxW GetUserObjectInformationW GetProcessWindowStation

shell32

CommandLineToArgvW

advapi32

CryptCreateHash RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptEnumProvidersW CryptSignHashW CryptDestroyHash DeregisterEventSource CryptDecrypt CryptExportKey

iphlpapi

GetAdaptersInfo

ws2_32

inet_ntoa inet_addr htons htonl gethostbyname WSASetLastError inet_pton getnameinfo freeaddrinfo getaddrinfo WSASocketW WSAGetLastError accept WSAStartup gethostbyaddr shutdown setsockopt send select recv ntohs getsockopt getsockname getpeername ioctlsocket connect closesocket __WSAFDIsSet bind listen getservbyport socket getservbyname WSACleanup

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertOpenSystemStoreW CertOpenStore CertFindCertificateInStore CertDuplicateCertificateContext CertGetCertificateContextProperty

wininet

InternetQueryOptionW

bcrypt

BCryptGenRandom

Name

.text

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

64KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

251KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

799B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

632KB

Virtual Size

636KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

996ae57f1202851d369f3a54aab1c3dabb77c486db86048a360c5ed6b3e506d2

kernel32

user32

shell32

advapi32

iphlpapi

ws2_32

crypt32

wininet

bcrypt

generic