ac619441f649717854f68b2cc670452c626e4d38ba4a4a8ec7472fdd44d5f796

Sharing

Copy URL Twitter E-mail

General

Target
ac619441f649717854f68b2cc670452c626e4d38ba4a4a8ec7472fdd44d5f796
Size 4.8MB
Sample261011-e68vyax12n
SHA256 ac619441f649717854f68b2cc670452c626e4d38ba4a4a8ec7472fdd44d5f796
MD5 98f8feb51d962e8a7da1cc6097f867e9
SHA1 cba7b4d516d47eafcaa7e11d98624c24815ed17e
SHA512 eba21f0969050df2a95d10d36b64b55772921879f9fa9dd1730d7aa29b38d49c9d6ce06fd1f64506b8b470df69519e81c4b37b639990103bc20fe4a410bebb6a
SSDEEP 98304:eCWNOfE3S83iaAfWgWC9dvEE5JUr9mcWxHE3e/oIgX:0NgKiFEoOIcCH0pI6
TLSH
T10C36CF03FB818832D7D3017156AAD73E8A3979304B25C6C3E7A5257E9D309D2E73A399
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac619441f649717854f68b2cc670452c626e4d38ba4a4a8ec7472fdd44d5f796

File Explorer

ac619441f649717854f68b2cc670452c626e4d38ba4a4a8ec7472fdd44d5f796

.exe 4.8MB

ac619441f649717854f68b2cc670452c626e4d38ba4a4a8ec7472fdd44d5f796

IMPHASH c4b60f8dc5548768394711b778b675fa
SHA256 ac619441f649717854f68b2cc670452c626e4d38ba4a4a8ec7472fdd44d5f796
MD5 98f8feb51d962e8a7da1cc6097f867e9
SHA1 cba7b4d516d47eafcaa7e11d98624c24815ed17e
SHA512 eba21f0969050df2a95d10d36b64b55772921879f9fa9dd1730d7aa29b38d49c9d6ce06fd1f64506b8b470df69519e81c4b37b639990103bc20fe4a410bebb6a
SSDEEP 98304:eCWNOfE3S83iaAfWgWC9dvEE5JUr9mcWxHE3e/oIgX:0NgKiFEoOIcCH0pI6
TLSH
T10C36CF03FB818832D7D3017156AAD73E8A3979304B25C6C3E7A5257E9D309D2E73A399
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2301873

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\WorkSpace\jenkins\workspace\Emulator_Build_Api4\Emulator_Check_AppsInstaller_EN_V5_ROM7_1\appsInstall\apps\bin\OutPut\Nox\NoxPack.pdb

kernel32

DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus GetModuleHandleExA GetCurrentThreadId SetThreadPriority GetPrivateProfileStringA lstrcpynW GlobalMemoryStatusEx RaiseException SetLastError InitializeCriticalSectionAndSpinCount lstrcmpW GetSystemDefaultLangID GetVersion VerSetConditionMask VerifyVersionInfoW GetUserDefaultLCID GetCommandLineW GetEnvironmentVariableA GetDriveTypeW DecodePointer SetUnhandledExceptionFilter ExitProcess GetLocalTime LoadLibraryExW SetEvent ResetEvent CreateEventW CreateFileA CompareFileTime CreateDirectoryA GetFileTime SetFileAttributesA GetModuleFileNameA SetEndOfFile QueueUserWorkItem GetStartupInfoW GetSystemInfo GetACP FormatMessageA InitializeCriticalSectionEx SleepEx QueryPerformanceFrequency GetSystemDirectoryW QueryPerformanceCounter WaitForSingleObjectEx ExpandEnvironmentStringsA GetStdHandle PeekNamedPipe WaitForMultipleObjects GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetModuleHandleExW SuspendThread GetSystemTimeAsFileTime SwitchToFiber DeleteFiber CreateFiber LoadLibraryA ConvertFiberToThread ConvertThreadToFiber TryEnterCriticalSection TerminateThread CreateThread GetCurrentProcessId WaitForSingleObject GetLastError RemoveDirectoryW ReadFile GetVolumeInformationW WriteConsoleW CopyFileW EnterCriticalSection OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage GetTimeZoneInformation GetFullPathNameA GetFullPathNameW FlushFileBuffers HeapSize SetStdHandle EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetCurrentThread GetConsoleCP HeapReAlloc SetConsoleCtrlHandler SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetCommandLineA FreeLibraryAndExitThread ResumeThread ExitThread GetFileAttributesExW InterlockedFlushSList RtlUnwind LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetProcessHeap HeapFree HeapAlloc InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo EncodePointer GetStringTypeW InitializeCriticalSection Process32NextW Process32FirstW CreateToolhelp32Snapshot lstrcatW lstrcpyW lstrcmpiW lstrcmpiA LeaveCriticalSection GetModuleHandleW GetModuleFileNameW GetLongPathNameW FindNextFileW FindFirstFileW FindClose CreateDirectoryW WideCharToMultiByte WritePrivateProfileStructW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW DeleteFileW lstrlenW MulDiv LocalFree LocalAlloc CloseHandle WriteFile SetFileAttributesW CreateFileW FindResourceW GlobalFree GlobalUnlock GlobalLock GlobalAlloc FreeResource SizeofResource LockResource OpenProcess GetExitCodeProcess Sleep CreatePipe SetHandleInformation OutputDebugStringW DebugBreak RemoveDirectoryA QueryDosDeviceW GetTempFileNameW GetLogicalDriveStringsW GetFileSize FindNextFileA FindFirstFileA DeleteFileA SetCurrentDirectoryW DosDateTimeToFileTime GetCurrentProcess DuplicateHandle SetFileTime SetFilePointer GetFileType GetCurrentDirectoryW lstrlenA lstrcpyA lstrcpynA GetTempPathW GetDiskFreeSpaceExW DeviceIoControl SystemTimeToFileTime LoadLibraryW GetProcAddress FreeLibrary GetSystemTime GetVersionExW MultiByteToWideChar FindFirstFileExA MoveFileExW GetTickCount FindFirstFileExW CreateProcessW LoadResource FormatMessageW

user32

GetWindowRect SendMessageW GetDesktopWindow ReleaseDC GetDC LoadStringW FillRect EnumDisplaySettingsW GetClipboardData RegisterClipboardFormatW IsClipboardFormatAvailable GetAsyncKeyState SetCapture ReleaseCapture SetCursor GetCursorPos CreateCaret HideCaret ShowCaret SetCaretPos ClientToScreen GetSysColor IntersectRect UnionRect PtInRect RegisterWindowMessageW PostThreadMessageW FindWindowW GetMonitorInfoW MonitorFromWindow TrackMouseEvent IsIconic IsWindowEnabled MapWindowPoints wsprintfW CopyRect SetWindowPos OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetParent FindWindowExW GetWindowThreadProcessId TranslateMessage DispatchMessageW PeekMessageW AttachThreadInput BringWindowToTop SetActiveWindow GetForegroundWindow SetForegroundWindow MessageBoxW CharNextW PostMessageW WaitMessage DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer KillTimer IsRectEmpty CallWindowProcW GetClassInfoExW IsWindow ShowWindow SetFocus SetWindowTextW GetWindowTextW GetWindowTextLengthW GetWindowLongW SetWindowLongW LoadCursorW BeginPaint EndPaint InvalidateRect DrawIcon DrawTextW LoadImageW DrawIconEx GetFocus GetKeyState GetClientRect UpdateWindow GetMessagePos IsZoomed EnableWindow SetWindowRgn ScreenToClient OffsetRect SetClassLongW ChangeDisplaySettingsW GetUserObjectInformationW SystemParametersInfoW GetWindow GetProcessWindowStation

gdi32

SetViewportOrgEx SetBkColor MoveToEx GetObjectA SetTextColor RoundRect Rectangle LineTo SetBkMode GetTextExtentPoint32W GetCurrentObject GetClipBox ExcludeClipRect CreateSolidBrush SetWindowOrgEx CreateFontIndirectW DeleteObject CreatePatternBrush CreateFontW CreateCompatibleBitmap GetObjectW CreateDIBSection SelectObject GetDIBits GetDeviceCaps DeleteDC CreateCompatibleDC BitBlt GetStockObject CombineRgn CreateRectRgn CreateRoundRectRgn CreateRectRgnIndirect SelectClipRgn GdiSetBatchLimit CreatePen StretchBlt

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegEnumValueW CreateWellKnownSid RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW OpenProcessToken CreateProcessAsUserW SetTokenInformation DuplicateTokenEx AllocateAndInitializeSid FreeSid GetLengthSid SystemFunction036 RegCloseKey

shell32

SHBrowseForFolderW SHGetSpecialFolderLocation SHGetMalloc CommandLineToArgvW Shell_NotifyIconW SHFileOperationW ShellExecuteW SHGetSpecialFolderPathW SHGetSpecialFolderPathA SHGetPathFromIDListW

ole32

CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes CoLoadLibrary StringFromGUID2 CoInitializeEx CoUninitialize CoCreateInstance CreateStreamOnHGlobal

oleaut32

OleLoadPicture SysAllocString VarUI4FromStr GetErrorInfo VariantClear VariantInit VariantChangeType SetErrorInfo CreateErrorInfo SysFreeString

shlwapi

PathAppendW PathCanonicalizeW PathFindExtensionW PathIsDirectoryW PathIsRootW PathMatchSpecW SHRegGetUSValueA PathRemoveExtensionW PathRemoveFileSpecW SHGetValueW PathIsDirectoryEmptyW PathAppendA PathCombineA PathFileExistsA PathFindFileNameA PathIsDirectoryA StrCmpIW StrStrIW StrStrW PathFileExistsW PathRemoveFileSpecA PathFindFileNameW SHRegSetUSValueA PathAddBackslashW

comctl32

InitCommonControlsEx

msimg32

TransparentBlt AlphaBlend

gdiplus

GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCreateBitmapFromHBITMAP GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteFont GdipDrawString GdipCreateFontFromDC GdipDrawImageRectI GdipFillPath GdipFillRectangleI GdipDrawPath GdipDrawRectangleI GdipDrawLineI GdipSetTextRenderingHint GdipReleaseDC GdipSetImageAttributesColorKeys GdipGetPropertyItem GdipCreateFontFromLogfontA GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipTranslateTextureTransform GdipCreateTexture2I GdipDeleteBrush GdipCloneBrush GdipAddPathArcI GdipAddPathLineI GdipDeletePath GdipClonePath GdipCreatePath GdiplusShutdown GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdipLoadImageFromFileICM GdipLoadImageFromFile GdipDrawImageRectRectI GdipSetInterpolationMode GdipDeleteGraphics GdipCreateFromHDC GdipDisposeImageAttributes GdipCreateImageAttributes GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdiplusStartup GdipFree GdipAlloc GdipGetPropertyItemSize

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

HttpQueryInfoW InternetSetOptionW InternetSetCookieA InternetSetCookieW InternetErrorDlg InternetGetCookieW InternetOpenA InternetConnectW InternetOpenUrlA HttpOpenRequestW HttpSendRequestA InternetReadFile InternetOpenUrlW InternetCloseHandle InternetOpenW InternetCrackUrlW

netapi32

Netbios

iphlpapi

GetAdaptersInfo

psapi

GetProcessImageFileNameW

dbghelp

MiniDumpWriteDump

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

winmm

timeGetTime

bcrypt

BCryptGenRandom

ws2_32

closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt WSASetLastError WSAIoctl WSAStartup WSACleanup __WSAFDIsSet select getaddrinfo freeaddrinfo accept listen recvfrom sendto ioctlsocket gethostname gethostbyname getnameinfo bind send recv socket WSAGetLastError shutdown

wldap32

ord147 ord133 ord79 ord142 ord301 ord127 ord27 ord26 ord118 ord167 ord41 ord208 ord216 ord14 ord46 ord219 ord145

generic

count=15, id=241, version=40116,

count=186, id=243, version=40116,

count=28, id=242, version=40116,

count=1, id=264, version=23026,

count=17, id=170, productName=VS2010 build 30319, version=30319,

count=10, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=1, id=209, version=65501,

count=6, id=199, version=41118,

count=26, id=259, version=23013,

count=75, id=261, version=23013,

count=66, id=260, version=23013,

count=6, id=206, version=65501,

count=1, id=208, version=65501,

count=666, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=47, id=203, version=65501,

count=595, id=1, productName=Unmarked objects,

count=108, id=261, productName=VS2015 [14.0] build 23026, version=23026,

count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,

count=1, id=151,

count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,