4703b2ed0cdcdaec2b30bd72c7f5d56f6c42fedb72226ab524c91a5160099f0f

Sharing

Copy URL Twitter E-mail

General

Target
4703b2ed0cdcdaec2b30bd72c7f5d56f6c42fedb72226ab524c91a5160099f0f
Size 1.4MB
Sample261002-n11rtazdrb
SHA256 4703b2ed0cdcdaec2b30bd72c7f5d56f6c42fedb72226ab524c91a5160099f0f
MD5 781c7fb9314c06cb6e15dbb8b2e3ab63
SHA1 3baa90a10f9049b6361ba1d9864951440631fff8
SHA512 fc8ed94a0bd710fbc985bf549bd0a210934a2638ec0c7d727eeb75455f50618f247383c912cd0a986b382f1bdf2497de9b078f9bb7a76e4b559b301e803b0edf
SSDEEP 24576:2sfB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ffBLNiXicJFFRGNzj3
TLSH
T1A26523936BCDC1B1EBBA003749769019A2465F285B2545D3F2043E1FA578FE7CE39362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4703b2ed0cdcdaec2b30bd72c7f5d56f6c42fedb72226ab524c91a5160099f0f

File Explorer

4703b2ed0cdcdaec2b30bd72c7f5d56f6c42fedb72226ab524c91a5160099f0f

.exe 1.4MB

4703b2ed0cdcdaec2b30bd72c7f5d56f6c42fedb72226ab524c91a5160099f0f

IMPHASH e4b30b230a9250f8822869541d1e6a1a
SHA256 4703b2ed0cdcdaec2b30bd72c7f5d56f6c42fedb72226ab524c91a5160099f0f
MD5 781c7fb9314c06cb6e15dbb8b2e3ab63
SHA1 3baa90a10f9049b6361ba1d9864951440631fff8
SHA512 fc8ed94a0bd710fbc985bf549bd0a210934a2638ec0c7d727eeb75455f50618f247383c912cd0a986b382f1bdf2497de9b078f9bb7a76e4b559b301e803b0edf
SSDEEP 24576:2sfB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ffBLNiXicJFFRGNzj3
TLSH
T1A26523936BCDC1B1EBBA003749769019A2465F285B2545D3F2043E1FA578FE7CE39362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\winapps\gu6\exe\vc\GuProcessManagerService\sourcecode\gupmservice\Release\GUPMService.pdb

kernel32

FindResourceExW GetPrivateProfileStringW CreateMutexW SetPriorityClass GetPriorityClass OpenProcess ReleaseMutex GetPrivateProfileSectionW RaiseException EnterCriticalSection LeaveCriticalSection GetCurrentProcessId GetTickCount FindResourceW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW InterlockedCompareExchange InterlockedExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc LoadResource LockResource SizeofResource GetLogicalDriveStringsW lstrcmpiW QueryDosDeviceW lstrcatW GetCommandLineW lstrcpyW SetEvent InterlockedDecrement InterlockedIncrement GetCurrentThreadId GetModuleHandleW GetProcAddress CreateEventW CreateThread GetModuleFileNameW Sleep DeleteCriticalSection InitializeCriticalSection HeapDestroy WaitForSingleObject lstrlenW WideCharToMultiByte SetEndOfFile SetFilePointer WriteFile GetLastError CreateFileW CloseHandle QueryPerformanceCounter GetSystemTimeAsFileTime

user32

PostThreadMessageW GetMessageW DispatchMessageW TranslateMessage MessageBoxW CharUpperW CharNextW LoadStringW

advapi32

DeleteService OpenServiceW OpenSCManagerW SetServiceStatus DeregisterEventSource ReportEventW RegisterEventSourceW RegDeleteValueW RegCloseKey StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW ChangeServiceConfigW ChangeServiceConfig2W ControlService CloseServiceHandle CreateServiceW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW

shell32

ord165

ole32

CoUninitialize CoCreateInstance CoInitialize CoInitializeSecurity

oleaut32

SysFreeString UnRegisterTypeLi RegisterTypeLi SysStringLen

atl90

ord67 ord49 ord56 ord68 ord61 ord64 ord17 ord23 ord20

shlwapi

PathFileExistsW

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

psapi

GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

msvcr90

__set_app_type __p__fmode __p__commode __setusermatherr _configthreadlocale _initterm_e ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook _invoke_watson _controlfp_s _adjust_fdiv _initterm _wcmdln exit _XcptFilter ??3@YAXPAX@Z memcpy_s memmove_s free _CxxThrowException calloc _recalloc __CxxFrameHandler3 _putws _vsnwprintf_s wcscpy_s wcsncpy_s wcsrchr wcsnlen memset wcschr _wcsnicmp _invalid_parameter_noinfo _wcsicmp wcsstr _vscwprintf vswprintf_s ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@XZ ??0exception@std@@QAE@ABV01@@Z ??2@YAPAXI@Z _wtoi _except_handler4_common _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer ?terminate@@YAXXZ _amsg_exit __wgetmainargs _cexit _exit

Sharing

General

Malware Config

Signatures

File Explorer

4703b2ed0cdcdaec2b30bd72c7f5d56f6c42fedb72226ab524c91a5160099f0f

kernel32

user32

advapi32

shell32

ole32

oleaut32

atl90

shlwapi

msvcp90

psapi

msvcr90

generic