795a3f3248059ae773de7e1d09c94d4279f77c400ab63949835744beb65d9954

Sharing

Copy URL Twitter E-mail

General

Target
795a3f3248059ae773de7e1d09c94d4279f77c400ab63949835744beb65d9954
Size 4.8MB
Sample261014-d417msxzbx
SHA256 795a3f3248059ae773de7e1d09c94d4279f77c400ab63949835744beb65d9954
MD5 a709a393f4333763e8518abd726dc8b9
SHA1 4aaa274287a4fdffb8caa0e5df52e6a95b8b3c78
SHA512 b6089de9942fc5f77c72df6eeabacb3664c1ba38402cbe85e73da786141907e62ddfa1f7a9f6a6b4fc89090c4adc975abe0a2ff10c9b2a75d425f7add4c63e69
SSDEEP 98304:hUvprWzyrLTdAE4NiV72uNbw1qHvUxbn8Jaj5:KtWgF2ukqHsxbn8Jaj
TLSH
T1A236AE01B7818072F8B741B695BEC57F4A39AD201328A4D7B3CDB8691F769E12A33357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
795a3f3248059ae773de7e1d09c94d4279f77c400ab63949835744beb65d9954

File Explorer

795a3f3248059ae773de7e1d09c94d4279f77c400ab63949835744beb65d9954

.exe 4.8MB

795a3f3248059ae773de7e1d09c94d4279f77c400ab63949835744beb65d9954

IMPHASH 880864301db7144e7a4a4fb1c5725edc
SHA256 795a3f3248059ae773de7e1d09c94d4279f77c400ab63949835744beb65d9954
MD5 a709a393f4333763e8518abd726dc8b9
SHA1 4aaa274287a4fdffb8caa0e5df52e6a95b8b3c78
SHA512 b6089de9942fc5f77c72df6eeabacb3664c1ba38402cbe85e73da786141907e62ddfa1f7a9f6a6b4fc89090c4adc975abe0a2ff10c9b2a75d425f7add4c63e69
SSDEEP 98304:hUvprWzyrLTdAE4NiV72uNbw1qHvUxbn8Jaj5:KtWgF2ukqHsxbn8Jaj
TLSH
T1A236AE01B7818072F8B741B695BEC57F4A39AD201328A4D7B3CDB8691F769E12A33357
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1031212

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\winmasterforclean\product\win32\dbginfo\aslive.pdb

kernel32

CopyFileW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW RemoveDirectoryW FindClose FindNextFileW FindFirstFileW DeleteFileW GetModuleFileNameW FreeLibrary LoadLibraryW FindResourceExW ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber ReadConsoleA SetConsoleMode GetEnvironmentVariableW GetSystemTime WriteConsoleW FlushFileBuffers GetFullPathNameW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler FindResourceW GetConsoleCP GetTimeZoneInformation ReadConsoleW GetConsoleMode EnumSystemLocalesW IsValidLocale SetFilePointerEx GetDriveTypeW GetACP ExitProcess GetFileAttributesExW GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW RtlUnwind FormatMessageA PeekNamedPipe GetStdHandle GetFileType ExpandEnvironmentStringsA VerifyVersionInfoA GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerSetConditionMask SleepEx LoadLibraryExA FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx GetCPInfo GetStringTypeW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer FormatMessageW VirtualFreeEx VirtualAllocEx SetEnvironmentVariableW CreateThread GetCurrentProcessId lstrlenW OutputDebugStringW InterlockedDecrement InterlockedIncrement GetLocaleInfoW GetUserDefaultLCID InterlockedExchange K32GetModuleFileNameExW FreeResource MoveFileW GetStartupInfoW CreatePipe GlobalUnlock GlobalLock MoveFileExW SetFileAttributesW GetDiskFreeSpaceExW Sleep GetLocalTime OpenEventW GetExitCodeThread GetFileTime GlobalFree GlobalAlloc LocalFree SetLastError OutputDebugStringA SetEndOfFile GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTickCount GetVersionExW GetSystemDirectoryW GetWindowsDirectoryW GetCommandLineW GetExitCodeProcess CreateProcessW TerminateProcess Process32NextW Module32NextW Module32FirstW Process32FirstW CreateToolhelp32Snapshot ReadProcessMemory ExpandEnvironmentStringsW OpenProcess GetCurrentProcess LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetModuleHandleW GetProcAddress DecodePointer RaiseException GetCurrentThreadId InitializeCriticalSectionAndSpinCount WaitForMultipleObjects GetModuleFileNameA CreateDirectoryW GetFileAttributesW WideCharToMultiByte MultiByteToWideChar GetCurrentDirectoryW SystemTimeToFileTime ResetEvent SetEvent CreateEventW WaitForSingleObject InitializeCriticalSection ReleaseSemaphore DeleteCriticalSection LeaveCriticalSection ReadFile EnterCriticalSection VirtualAlloc VirtualFree GetLastError WriteFile GetFileSize CloseHandle CreateFileW QueryDosDeviceW QueryPerformanceFrequency GetLogicalDriveStringsW SetFilePointer CreateProcessA

user32

MonitorFromWindow GetWindow GetCursorPos GetActiveWindow SystemParametersInfoW SetActiveWindow GetClassInfoExW GetMonitorInfoW AppendMenuW TrackPopupMenuEx MapWindowPoints ScreenToClient IsChild IsDialogMessageW MonitorFromPoint DestroyMenu GetNextDlgTabItem SetWindowRgn EnumWindows FillRect GetSystemMetrics PostQuitMessage DrawIconEx DeleteMenu EnableWindow KillTimer SetTimer IsWindowEnabled LoadIconW ReleaseCapture SetCapture ClientToScreen EndPaint BeginPaint GetClientRect MoveWindow IsRectEmpty IsIconic DestroyIcon OffsetRect IsWindowVisible EqualRect ShowWindow GetSystemMenu CreatePopupMenu GetDlgCtrlID PostThreadMessageW TranslateMessage PeekMessageW DispatchMessageW UnregisterClassW GetMessageW RegisterWindowMessageW GetWindowThreadProcessId GetLastInputInfo IsWindow GetFocus PostMessageW SetWindowPos MessageBoxW GetUserObjectInformationW GetProcessWindowStation SetWindowLongW GetWindowLongW GetParent SetFocus SendMessageW SetWindowTextW GetWindowTextW GetWindowTextLengthW InvalidateRect MessageBeep IsClipboardFormatAvailable OpenClipboard GetClipboardData CloseClipboard HideCaret DestroyCaret DestroyWindow DefWindowProcW GetDlgItem CallWindowProcW GetForegroundWindow AttachThreadInput BringWindowToTop SetForegroundWindow GetDesktopWindow FindWindowW FindWindowExW GetWindowRect DrawTextW GetDC ReleaseDC CreateWindowExW LoadCursorW RegisterClassExW LoadBitmapW LoadImageW CopyRect UpdateLayeredWindow InflateRect SetRectEmpty SetCursor PtInRect SetRect IntersectRect

gdi32

GetTextColor SetStretchBltMode GetViewportOrgEx GetClipRgn ExtSelectClipRgn RoundRect TextOutW GetTextExtentPoint32W SaveDC RestoreDC SetViewportOrgEx SelectClipRgn GetTextMetricsW LineTo MoveToEx SetBkMode GetStretchBltMode Rectangle GetCurrentObject CreateBitmap CreateCompatibleBitmap CreateDIBSection CombineRgn CreateRectRgn StretchBlt BitBlt ExtTextOutW CreateCompatibleDC CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps SelectObject SetBkColor SetTextColor DeleteObject CreateSolidBrush DeleteDC RectInRegion OffsetRgn CreateRoundRectRgn CreateRectRgnIndirect CreatePen

advapi32

SetSecurityDescriptorSacl CryptSignHashW CryptDestroyHash CloseEventLog ReadEventLogW OpenEventLogW StartServiceW RegEnumKeyExW RegQueryValueExA RegOpenKeyExA GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor CloseServiceHandle OpenServiceW OpenSCManagerW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegCreateKeyExW RegOpenKeyW CryptCreateHash DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptEnumProvidersW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW Shell_NotifyIconW

ole32

CreateStreamOnHGlobal

oleaut32

VariantTimeToSystemTime SystemTimeToVariantTime

shlwapi

StrToIntA PathAddBackslashW StrToIntW PathFindFileNameW PathAppendW PathRemoveFileSpecW PathIsDirectoryW PathFileExistsW

comctl32

DrawShadowText _TrackMouseEvent

msimg32

AlphaBlend

ws2_32

setsockopt WSAIoctl WSACleanup getaddrinfo freeaddrinfo accept listen recvfrom sendto ioctlsocket gethostname getnameinfo WSAStartup gethostbyname inet_ntoa inet_addr ntohs htons getsockopt getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet socket WSAGetLastError shutdown

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

gdiplus

GdiplusShutdown GdiplusStartup GdipCloneBitmapArea GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipImageRotateFlip GdipGetImagePixelFormat GdipGetImageWidth GdipCloneImage GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipLoadImageFromFile GdipLoadImageFromFileICM GdipDeleteFont GdipCreateFont GdipCreateFontFromLogfontW GdipCreateFontFromDC GdipPrivateAddFontFile GdipDeletePrivateFontCollection GdipNewPrivateFontCollection GdipCloneFontFamily GdipGetFontCollectionFamilyList GdipGetFontCollectionFamilyCount GdipSetClipPath GdipDrawImagePointsRectI GdipDrawImageRectRectI GdipDrawImageRectRect GdipDrawImageRectI GdipMeasureString GdipDrawString GdipFillPath GdipFillRectangleI GdipFillRectangle GdipGraphicsClear GdipDrawPath GdipDrawRectangleI GdipDrawLinesI GdipDrawLine GdipRotateWorldTransform GdipScaleWorldTransform GdipTranslateWorldTransform GdipResetWorldTransform GdipSetSmoothingMode GdipSetInterpolationMode GdipSetTextRenderingHint GdipDeleteGraphics GdipGetImageGraphicsContext GdipCreateFromHDC GdipAddPathPieI GdipAddPathRectangleI GdipAddPathArcI GdipAddPathLineI GdipClosePathFigure GdipStartPathFigure GdipDeletePath GdipCreatePath GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipSetPenDashStyle GdipSetPenMode GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen1 GdipCreateLineBrushFromRectWithAngleI GdipCreateLineBrushI GdipDisposeImage GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipAlloc GdipDeleteFontFamily GdipFree GdipGetImageHeight

iphlpapi

GetNetworkParams IcmpCloseHandle IcmpSendEcho IcmpCreateFile

wldap32

ord30 ord79 ord200 ord301 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord211 ord46 ord217 ord143

crypt32

CertGetCertificateContextProperty CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertOpenStore

bcrypt

BCryptGenRandom

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

720KB

Virtual Size

719KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

520B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=19, id=241, version=40116,

count=206, id=243, version=40116,

count=31, id=242, version=40116,

count=100, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=11, id=199, version=41118,

count=26, id=259, version=24123,

count=64, id=261, version=24123,

count=36, id=260, version=24123,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=23, productName=Unmarked objects (old),

count=558, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=594, id=1, productName=Unmarked objects,

count=99, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,