1feae77446d54e563970300358c91bbdcad7b9fb4f0570a1118665ed2491934d

Sharing

Copy URL Twitter E-mail

General

Target
1feae77446d54e563970300358c91bbdcad7b9fb4f0570a1118665ed2491934d
Size 4.4MB
Sample261014-e49z8ayvcw
SHA256 1feae77446d54e563970300358c91bbdcad7b9fb4f0570a1118665ed2491934d
MD5 90c539a63c9f59b0048e6718d346cac2
SHA1 722ae41d43f684fec790ce083f6441b3fd9ff2fb
SHA512 a4c69da436ab6ec0767a9db86c1bcfa9ce3bdf7e92a450d34834b04a5239edc8b6de6bf4285d1a82400930dc846bc5043dfa20ff68fec86e1c1cf08f844c8a6e
SSDEEP 98304:TmvUdq7myPh6T5mSSswRbw1qHvUxbn8Jajqc:Gt05YswYqHsxbn8Jajq
TLSH
T1C226AD02B7818072F8B645B6A1BEC57F4E38AD201328A4D777CD78691F729E02A37757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1feae77446d54e563970300358c91bbdcad7b9fb4f0570a1118665ed2491934d

File Explorer

1feae77446d54e563970300358c91bbdcad7b9fb4f0570a1118665ed2491934d

.exe 4.4MB

1feae77446d54e563970300358c91bbdcad7b9fb4f0570a1118665ed2491934d

IMPHASH b80d36ca29dcece7a6cc6232f443b41b
SHA256 1feae77446d54e563970300358c91bbdcad7b9fb4f0570a1118665ed2491934d
MD5 90c539a63c9f59b0048e6718d346cac2
SHA1 722ae41d43f684fec790ce083f6441b3fd9ff2fb
SHA512 a4c69da436ab6ec0767a9db86c1bcfa9ce3bdf7e92a450d34834b04a5239edc8b6de6bf4285d1a82400930dc846bc5043dfa20ff68fec86e1c1cf08f844c8a6e
SSDEEP 98304:TmvUdq7myPh6T5mSSswRbw1qHvUxbn8Jajqc:Gt05YswYqHsxbn8Jajq
TLSH
T1C226AD02B7818072F8B645B6A1BEC57F4E38AD201328A4D777CD78691F729E02A37757
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

702344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\winmasterforclean\product\win32\dbginfo\aslive.pdb

kernel32

CopyFileW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW RemoveDirectoryW FindClose FindNextFileW FindFirstFileW DeleteFileW GetModuleFileNameW FreeLibrary LoadLibraryW FindResourceExW ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber ReadConsoleA SetConsoleMode GetEnvironmentVariableW GetSystemTime WriteConsoleW FlushFileBuffers GetFullPathNameW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler FindResourceW GetConsoleCP GetTimeZoneInformation ReadConsoleW GetConsoleMode EnumSystemLocalesW IsValidLocale SetFilePointerEx GetDriveTypeW GetACP ExitProcess GetFileAttributesExW GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW RtlUnwind FormatMessageA PeekNamedPipe GetStdHandle GetFileType ExpandEnvironmentStringsA VerifyVersionInfoA GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerSetConditionMask SleepEx LoadLibraryExA FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx GetCPInfo GetStringTypeW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer FormatMessageW SetEnvironmentVariableW CreateThread GetCurrentProcessId OutputDebugStringW InterlockedDecrement InterlockedIncrement GetLocaleInfoW GetUserDefaultLCID K32GetModuleFileNameExW MoveFileW GetStartupInfoW MoveFileExW GlobalUnlock GlobalLock FreeResource InterlockedExchange SetFileAttributesW GetDiskFreeSpaceExW Sleep GetLocalTime OpenEventW GetFileTime LocalFree SetLastError SetEndOfFile GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTickCount GetVersionExW GetSystemDirectoryW GetWindowsDirectoryW GetCommandLineW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetModuleHandleW GetProcAddress DecodePointer RaiseException GetCurrentThreadId InitializeCriticalSectionAndSpinCount WaitForMultipleObjects CreateDirectoryW GetFileAttributesW WideCharToMultiByte MultiByteToWideChar GetCurrentDirectoryW SystemTimeToFileTime ResetEvent SetEvent CreateEventW WaitForSingleObject InitializeCriticalSection ReleaseSemaphore DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc VirtualFree GetLastError WriteFile ReadFile GetFileSize CloseHandle CreateFileW GetExitCodeProcess CreateProcessW TerminateProcess Process32NextW Module32NextW Module32FirstW Process32FirstW CreateToolhelp32Snapshot ReadProcessMemory ExpandEnvironmentStringsW OpenProcess GetCurrentProcess QueryDosDeviceW QueryPerformanceFrequency GetLogicalDriveStringsW SetFilePointer CreateProcessA

user32

SetWindowRgn IsChild GetWindow ScreenToClient FillRect KillTimer EnumWindows MapWindowPoints SystemParametersInfoW GetMonitorInfoW MonitorFromWindow GetCursorPos SetTimer ReleaseCapture SetCapture EndPaint BeginPaint GetClientRect MoveWindow IsRectEmpty IsIconic IsWindowVisible ShowWindow GetNextDlgTabItem IsDialogMessageW GetDlgCtrlID SetRect PtInRect PostThreadMessageW TranslateMessage PeekMessageW DispatchMessageW UnregisterClassW GetMessageW RegisterWindowMessageW GetWindowThreadProcessId GetLastInputInfo FindWindowW GetDC ReleaseDC CreateWindowExW MessageBoxW GetUserObjectInformationW GetProcessWindowStation GetDesktopWindow DefWindowProcW LoadCursorW RegisterClassExW InflateRect PostMessageW IsWindow GetFocus SetWindowPos SetWindowLongW GetWindowLongW GetParent SetFocus SendMessageW GetWindowTextW GetWindowTextLengthW InvalidateRect MessageBeep IsClipboardFormatAvailable OpenClipboard GetClipboardData CloseClipboard HideCaret DestroyCaret DestroyWindow GetDlgItem CallWindowProcW FindWindowExW GetWindowRect DrawTextW CopyRect UpdateLayeredWindow SetCursor GetClassInfoExW

gdi32

GetStockObject GetObjectW DeleteObject GetDeviceCaps CreateFontIndirectW CreateCompatibleDC CreateRectRgnIndirect CreateRoundRectRgn RectInRegion GetCurrentObject GetTextColor SetViewportOrgEx SetBkMode CombineRgn CreateSolidBrush SelectClipRgn Rectangle SetTextColor CreateCompatibleBitmap CreateDIBSection CreateRectRgn BitBlt DeleteDC ExtTextOutW SetBkColor SelectObject

advapi32

OpenEventLogW CryptSignHashW CryptDestroyHash CloseEventLog ReadEventLogW StartServiceW RegEnumKeyExW RegQueryValueExA RegOpenKeyExA SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor CloseServiceHandle OpenServiceW OpenSCManagerW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegCreateKeyExW RegOpenKeyW CryptCreateHash DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptEnumProvidersW

shell32

SHGetFolderPathW ShellExecuteW SHGetSpecialFolderPathW

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime

shlwapi

StrToIntA StrToIntW PathFileExistsW PathAddBackslashW PathFindFileNameW PathAppendW PathRemoveFileSpecW

comctl32

DrawShadowText _TrackMouseEvent

msimg32

AlphaBlend

ws2_32

getaddrinfo freeaddrinfo accept listen recvfrom sendto ioctlsocket gethostname WSAStartup gethostbyname inet_ntoa WSAGetLastError getnameinfo WSACleanup WSAIoctl setsockopt ntohs htons getsockopt getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet socket shutdown

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

gdiplus

GdipCreateLineBrushI GdipFree GdipDeleteFont GdipCreateFont GdipCreateFontFromDC GdipMeasureString GdipDrawString GdipFillRectangleI GdipDrawLinesI GdipSetTextRenderingHint GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipDeletePen GdipCreatePen1 GdipCreateFontFromLogfontW GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdiplusShutdown GdiplusStartup GdipDeleteFontFamily GdipPrivateAddFontFile GdipDeletePrivateFontCollection GdipNewPrivateFontCollection GdipCloneFontFamily GdipGetFontCollectionFamilyList GdipGetFontCollectionFamilyCount GdipDeleteGraphics GdipCreateFromHDC GdipAlloc

wldap32

ord30 ord79 ord35 ord33 ord200 ord301 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord211 ord46 ord143 ord217

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

672KB

Virtual Size

671KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

492B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=19, id=241, version=40116,

count=206, id=243, version=40116,

count=31, id=242, version=40116,

count=100, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=11, id=199, version=41118,

count=26, id=259, version=24123,

count=64, id=261, version=24123,

count=36, id=260, version=24123,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=23, productName=Unmarked objects (old),

count=558, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=580, id=1, productName=Unmarked objects,

count=96, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,