19c3b209e80ba14a482623911e8d98c07837f3ace12ecaea3bc782fd735bb2f1

Sharing

Copy URL Twitter E-mail

General

Target
19c3b209e80ba14a482623911e8d98c07837f3ace12ecaea3bc782fd735bb2f1
Size 6.2MB
Sample261011-hy1q5sgv21
SHA256 19c3b209e80ba14a482623911e8d98c07837f3ace12ecaea3bc782fd735bb2f1
MD5 00c88434fecf7c28c1b5ae1b9310959a
SHA1 2c1325867379224cf09b08eac89675a2a09fa8aa
SHA512 799187584aa82be4405f7e68614811b766d5ae7ee39d73d1a5d53b18cf303ae4aae4f59afde9fce88fc7f6bbd02a0b75db01922f3e15561a7856c0f5b440bda4
SSDEEP 98304:DpULdlyjls7bf66D6s2kvW6HBfEqAqlDc54oNbmHsZm/V2JTy:DCLdlo27bfkaBfEqFx4mwJ+
TLSH
T1AE66CF02F7529179EC9350B6697DA72C242D6D316B5108C7C2C47EA96FF4AC02E327AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19c3b209e80ba14a482623911e8d98c07837f3ace12ecaea3bc782fd735bb2f1

File Explorer

19c3b209e80ba14a482623911e8d98c07837f3ace12ecaea3bc782fd735bb2f1

.exe 6.2MB

19c3b209e80ba14a482623911e8d98c07837f3ace12ecaea3bc782fd735bb2f1

IMPHASH 058b62fd79e1f72a2f7fc2a7e3161218
SHA256 19c3b209e80ba14a482623911e8d98c07837f3ace12ecaea3bc782fd735bb2f1
MD5 00c88434fecf7c28c1b5ae1b9310959a
SHA1 2c1325867379224cf09b08eac89675a2a09fa8aa
SHA512 799187584aa82be4405f7e68614811b766d5ae7ee39d73d1a5d53b18cf303ae4aae4f59afde9fce88fc7f6bbd02a0b75db01922f3e15561a7856c0f5b440bda4
SSDEEP 98304:DpULdlyjls7bf66D6s2kvW6HBfEqAqlDc54oNbmHsZm/V2JTy:DCLdlo27bfkaBfEqFx4mwJ+
TLSH
T1AE66CF02F7529179EC9350B6697DA72C242D6D316B5108C7C2C47EA96FF4AC02E327AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2596016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\se15\src\out\Release\setup.exe.pdb

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid BuildTrusteeWithSidW ConvertSidToStringSidW ConvertStringSidToSidW CreateProcessAsUserW DuplicateTokenEx FreeSid GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityInfo GetTokenInformation GetUserNameW ImpersonateLoggedOnUser IsValidAcl IsValidSecurityDescriptor IsValidSid LookupAccountNameW LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegLoadKeyW RegOpenCurrentUser RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW RegUnLoadKeyW RevertToSelf SetEntriesInAclW SetNamedSecurityInfoW SetSecurityInfo SystemFunction036

comdlg32

GetOpenFileNameW

gdi32

BitBlt CombineRgn CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreateRectRgn CreateRectRgnIndirect DeleteDC DeleteObject GdiAlphaBlend GetCurrentObject GetDIBits GetDeviceCaps GetLayout GetObjectType GetObjectW GetRandomRgn GetRgnBox GetStockObject GetTextExtentPoint32W IntersectClipRect LPtoDP ModifyWorldTransform OffsetRgn RectVisible RestoreDC SaveDC SelectClipRgn SelectObject SetBkMode SetDIBColorTable SetGraphicsMode SetLayout SetViewportOrgEx SetWindowOrgEx SetWorldTransform StretchBlt

oleaut32

CreateDispTypeInfo CreateStdDispatch SysAllocString SysAllocStringLen SysFreeString SysStringLen VarCmp VarUI4FromStr VariantChangeType VariantClear VariantCopy VariantInit

shlwapi

PathAppendW PathCombineW PathFileExistsW PathFindExtensionW PathFindFileNameA PathFindFileNameW PathGetDriveNumberW PathIsDirectoryW PathMatchSpecW PathRemoveFileSpecW SHDeleteKeyW SHDeleteValueW SHGetValueA SHGetValueW SHSetValueW StrCpyW StrStrIW

user32

AdjustWindowRectEx AllowSetForegroundWindow AttachThreadInput BeginPaint BringWindowToTop CallWindowProcW CharNextW CharUpperW CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawIconEx DrawTextW EndPaint FillRect FindWindowExW FindWindowW GetActiveWindow GetAsyncKeyState GetCapture GetClassInfoExW GetClassNameW GetClientRect GetCursorPos GetDC GetDesktopWindow GetFocus GetForegroundWindow GetIconInfo GetKeyState GetMessageExtraInfo GetMessagePos GetMessageW GetMonitorInfoW GetParent GetShellWindow GetSystemMetrics GetWindow GetWindowLongW GetWindowRect GetWindowTextW GetWindowThreadProcessId InflateRect IntersectRect InvalidateRect InvalidateRgn IsIconic IsWindow IsWindowVisible KillTimer LoadCursorW LoadIconW LoadImageW LoadStringW MapWindowPoints MessageBoxW MonitorFromWindow MoveWindow PostMessageW PostQuitMessage PtInRect RegisterClassExW RegisterClassW RegisterWindowMessageW ReleaseCapture ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetActiveWindow SetCapture SetCursor SetDlgItemTextW SetFocus SetForegroundWindow SetTimer SetWindowLongW SetWindowPos SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoW TrackMouseEvent TranslateMessage UnhookWindowsHookEx UnregisterClassW UpdateLayeredWindow UpdateWindow WindowFromDC wsprintfW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

timeGetTime

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AssignProcessToJobObject CancelWaitableTimer CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateJobObjectW CreateMutexW CreateProcessW CreateRemoteThread CreateSemaphoreW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerW DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl EncodePointer EnterCriticalSection EnumResourceNamesW EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceExW FindResourceW FlushFileBuffers FlushInstructionCache FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeResource GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalDriveStringsW GetLongPathNameA GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetPrivateProfileIntW GetPrivateProfileStringW GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetThreadContext GetThreadId GetThreadPreferredUILanguages GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultUILanguage GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapDestroy HeapFree HeapLock HeapReAlloc HeapSize HeapUnlock HeapWalk InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock InterlockedDecrement InterlockedIncrement InterlockedPopEntrySList InterlockedPushEntrySList IsBadReadPtr IsBadWritePtr IsDebuggerPresent IsProcessInJob IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32EnumProcesses K32GetModuleFileNameExW K32GetModuleInformation K32GetProcessImageFileNameW K32GetProcessMemoryInfo K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFileTimeToFileTime LocalFree LockResource MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenMutexW OpenProcess OpenThread OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryFullProcessImageNameW QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureStackBackTrace RtlUnwind SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetErrorMode SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetStdHandle SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer SizeofResource Sleep SleepConditionVariableSRW SuspendThread SystemTimeToFileTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WritePrivateProfileStringW lstrcmpA lstrcmpiA lstrcmpiW lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoInitialize CoInitializeEx CoSetProxyBlanket CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoUninitialize DoDragDrop OleInitialize OleUninitialize PropVariantClear RegisterDragDrop RevokeDragDrop

rpcrt4

NdrClientCall2 RpcBindingFromStringBindingW RpcStringBindingComposeW

comctl32

InitCommonControlsEx

gdiplus

GdipAlloc GdipBitmapLockBits GdipBitmapUnlockBits GdipCloneImage GdipCreateBitmapFromFile GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipCreateImageAttributes GdipDeleteGraphics GdipDisposeImage GdipDisposeImageAttributes GdipDrawImageI GdipDrawImagePointRectI GdipDrawImageRectRectI GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipGetImageGraphicsContext GdipGetImageHeight GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageWidth GdipSaveImageToFile GdipSetImageAttributesColorMatrix GdipSetImageAttributesWrapMode GdipSetInterpolationMode GdipSetSmoothingMode GdiplusShutdown GdiplusStartup

secur32

GetUserNameExW

propsys

InitPropVariantFromCLSID

ntdll

NtDeleteKey

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

netapi32

Netbios

Sharing

General

Malware Config

Signatures

File Explorer

19c3b209e80ba14a482623911e8d98c07837f3ace12ecaea3bc782fd735bb2f1

advapi32

comdlg32

gdi32

oleaut32

shlwapi

user32

version

winmm

kernel32

ole32

rpcrt4

comctl32

gdiplus

secur32

propsys

ntdll

userenv

netapi32

generic