109432016c8b729bad688b21ec9762a203937613916862e6be6fe5ce992c5126

Sharing

Copy URL Twitter E-mail

General

Target
109432016c8b729bad688b21ec9762a203937613916862e6be6fe5ce992c5126
Size 5.7MB
Sample261007-3kft2axvay
SHA256 109432016c8b729bad688b21ec9762a203937613916862e6be6fe5ce992c5126
MD5 164cd58baecccad08c52fc8513ebd37a
SHA1 86317539a7db5b90332150eea42e62e6d981cf9e
SHA512 78c93674c9f612335db43059d40e11f16e9ac74666e51877d6664258c78ac604ae0b18047ac48059acce50eb7bb79ed5beb0c137a907ef8690f13635abdc96ee
SSDEEP 98304:p7zk4egqdOM0LXjZpP7wRGpj3qSuJ4zqIQcEBz2m1e:pvfeHCjj/TF92Oz4lw
TLSH
T10B56BF2A76A841DAD1B7D07CCD878B4AEAB274058B318BCB0155435F2F27AF94D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
109432016c8b729bad688b21ec9762a203937613916862e6be6fe5ce992c5126

File Explorer

109432016c8b729bad688b21ec9762a203937613916862e6be6fe5ce992c5126

.exe 5.7MB

109432016c8b729bad688b21ec9762a203937613916862e6be6fe5ce992c5126

IMPHASH 2f4ff53fa2079dfef460666702e844a5
SHA256 109432016c8b729bad688b21ec9762a203937613916862e6be6fe5ce992c5126
MD5 164cd58baecccad08c52fc8513ebd37a
SHA1 86317539a7db5b90332150eea42e62e6d981cf9e
SHA512 78c93674c9f612335db43059d40e11f16e9ac74666e51877d6664258c78ac604ae0b18047ac48059acce50eb7bb79ed5beb0c137a907ef8690f13635abdc96ee
SSDEEP 98304:p7zk4egqdOM0LXjZpP7wRGpj3qSuJ4zqIQcEBz2m1e:pvfeHCjj/TF92Oz4lw
TLSH
T10B56BF2A76A841DAD1B7D07CCD878B4AEAB274058B318BCB0155435F2F27AF94D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54006

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\Jenkins\WorkSpace\workspace\lib_TSDeviceViewerSDK\bin\x64\RelWithDebInfo\DeviceViewerService.pdb

lib_tsdeviceviewersdk

InitBugsplat FreeTSDeviceViewerSDK InitTSDeviceViewerSDK

tslogsdk

InitLogEx LogEx

lib_tscommunication_sdk

close_communication_sdk ts_comm_write ts_comm_connect init_communication_sdk ts_comm_map ts_comm_read ts_comm_unmap

kernel32

GetNumaHighestNodeNumber RtlCaptureStackBackTrace HeapSize WriteConsoleW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation HeapReAlloc GetFileSizeEx SetConsoleCtrlHandler GetLastError GetCurrentDirectoryW FindClose FindFirstFileW FindNextFileW SetLastError MultiByteToWideChar WideCharToMultiByte GetFullPathNameW FormatMessageW CloseHandle DuplicateHandle WaitForSingleObjectEx Sleep GetCurrentProcess SwitchToThread GetCurrentThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection RtlPcToFileHeader EncodePointer DecodePointer RaiseException GetStringTypeW InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress QueryPerformanceCounter QueryPerformanceFrequency CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer RtlUnwind GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait OutputDebugStringW GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree SetProcessAffinityMask ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx LoadLibraryW WaitForSingleObject RtlUnwindEx ExitProcess GetModuleHandleExW SetEnvironmentVariableW SetCurrentDirectoryW CreateDirectoryW GetFileAttributesExW CreateFileW GetFileType GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetConsoleMode ReadConsoleW WriteFile GetConsoleOutputCP ExitThread ResumeThread GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers SetStdHandle SetEndOfFile SetFilePointerEx

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

703KB

Virtual Size

702KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

35KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

914B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

355B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

298B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

109432016c8b729bad688b21ec9762a203937613916862e6be6fe5ce992c5126

lib_tsdeviceviewersdk

tslogsdk

lib_tscommunication_sdk

kernel32

generic