95615dae3f38b3c6a741d5a5fb12b34d4c80f37abf572aa5994bce440d7cb030

Sharing

Copy URL Twitter E-mail

General

Target
95615dae3f38b3c6a741d5a5fb12b34d4c80f37abf572aa5994bce440d7cb030
Size 4.4MB
Sample261014-e7engsee29
SHA256 95615dae3f38b3c6a741d5a5fb12b34d4c80f37abf572aa5994bce440d7cb030
MD5 fd50b4c04ff9a07a2b5f0e3e1c5ea55d
SHA1 115bd126e9e06357b77b69bf4a0110d447f045c8
SHA512 6d287c4c5e0e77451c190430d8a29abc012a144c42724bb24fb81e53b45b7cc05ae7c25ddba1fb94fc91055448c7d55b6a00d42b8d43a53c10153994b55ab2f1
SSDEEP 98304:z2v6pNGTZVujFaDvHeUbw1qHvUxbn8JajfLx:m6WIFmHebqHsxbn8JajfL
TLSH
T11526AD02B7818072F8B70572A5BEC57F4E39AD201328A8D7B7CC74695B729E02A37757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95615dae3f38b3c6a741d5a5fb12b34d4c80f37abf572aa5994bce440d7cb030

File Explorer

95615dae3f38b3c6a741d5a5fb12b34d4c80f37abf572aa5994bce440d7cb030

.exe 4.4MB

95615dae3f38b3c6a741d5a5fb12b34d4c80f37abf572aa5994bce440d7cb030

IMPHASH e8b0cb865acb20887bcb62ccc3dca2b5
SHA256 95615dae3f38b3c6a741d5a5fb12b34d4c80f37abf572aa5994bce440d7cb030
MD5 fd50b4c04ff9a07a2b5f0e3e1c5ea55d
SHA1 115bd126e9e06357b77b69bf4a0110d447f045c8
SHA512 6d287c4c5e0e77451c190430d8a29abc012a144c42724bb24fb81e53b45b7cc05ae7c25ddba1fb94fc91055448c7d55b6a00d42b8d43a53c10153994b55ab2f1
SSDEEP 98304:z2v6pNGTZVujFaDvHeUbw1qHvUxbn8JajfLx:m6WIFmHebqHsxbn8JajfL
TLSH
T11526AD02B7818072F8B70572A5BEC57F4E39AD201328A8D7B7CC74695B729E02A37757
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

709679

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\winmasterforclean\product\win32\dbginfo\aslive.pdb

kernel32

CopyFileW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW RemoveDirectoryW FindClose FindNextFileW FindFirstFileW DeleteFileW GetModuleFileNameW FreeLibrary LoadLibraryW FindResourceExW ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber ReadConsoleA SetConsoleMode GetEnvironmentVariableW GetSystemTime WriteConsoleW FlushFileBuffers GetFullPathNameW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler FindResourceW GetConsoleCP GetTimeZoneInformation ReadConsoleW GetConsoleMode EnumSystemLocalesW IsValidLocale SetFilePointerEx GetDriveTypeW GetACP ExitProcess GetFileAttributesExW GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW RtlUnwind FormatMessageA PeekNamedPipe GetStdHandle GetFileType ExpandEnvironmentStringsA VerifyVersionInfoA GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerSetConditionMask SleepEx LoadLibraryExA FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx GetCPInfo GetStringTypeW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer FormatMessageW SetEnvironmentVariableW CreateThread GetCurrentProcessId OutputDebugStringW InterlockedDecrement InterlockedIncrement GetLocaleInfoW GetUserDefaultLCID K32GetModuleFileNameExW MoveFileW GetStartupInfoW CreatePipe MoveFileExW GlobalUnlock GlobalLock FreeResource InterlockedExchange SetFileAttributesW GetDiskFreeSpaceExW Sleep GetLocalTime OpenEventW GetExitCodeThread GetFileTime LocalFree SetLastError SetEndOfFile GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTickCount GetVersionExW GetSystemDirectoryW GetWindowsDirectoryW GetCommandLineW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetModuleHandleW GetProcAddress DecodePointer RaiseException GetCurrentThreadId InitializeCriticalSectionAndSpinCount WaitForMultipleObjects CreateDirectoryW GetFileAttributesW WideCharToMultiByte MultiByteToWideChar GetCurrentDirectoryW SystemTimeToFileTime ResetEvent SetEvent CreateEventW WaitForSingleObject InitializeCriticalSection ReleaseSemaphore DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc VirtualFree GetLastError WriteFile ReadFile GetFileSize CloseHandle CreateFileW GetExitCodeProcess CreateProcessW TerminateProcess Process32NextW Module32NextW Module32FirstW Process32FirstW CreateToolhelp32Snapshot ReadProcessMemory ExpandEnvironmentStringsW OpenProcess GetCurrentProcess QueryDosDeviceW QueryPerformanceFrequency GetLogicalDriveStringsW SetFilePointer CreateProcessA

user32

SetWindowRgn IsChild GetWindow ScreenToClient FillRect KillTimer EnumWindows MapWindowPoints SystemParametersInfoW GetMonitorInfoW MonitorFromWindow GetCursorPos SetTimer ReleaseCapture SetCapture EndPaint BeginPaint GetClientRect MoveWindow IsRectEmpty IsIconic IsWindowVisible ShowWindow GetNextDlgTabItem IsDialogMessageW GetDlgCtrlID SetRect PtInRect PostThreadMessageW TranslateMessage PeekMessageW DispatchMessageW UnregisterClassW GetMessageW RegisterWindowMessageW GetWindowThreadProcessId GetLastInputInfo FindWindowW GetDC ReleaseDC CreateWindowExW MessageBoxW GetUserObjectInformationW GetProcessWindowStation GetDesktopWindow DefWindowProcW LoadCursorW RegisterClassExW InflateRect PostMessageW IsWindow GetFocus SetWindowPos SetWindowLongW GetWindowLongW GetParent SetFocus SendMessageW GetWindowTextW GetWindowTextLengthW InvalidateRect MessageBeep IsClipboardFormatAvailable OpenClipboard GetClipboardData CloseClipboard HideCaret DestroyCaret DestroyWindow GetDlgItem CallWindowProcW FindWindowExW GetWindowRect DrawTextW CopyRect UpdateLayeredWindow SetCursor GetClassInfoExW

gdi32

GetStockObject GetObjectW DeleteObject GetDeviceCaps CreateFontIndirectW CreateCompatibleDC CreateRectRgnIndirect CreateRoundRectRgn RectInRegion GetCurrentObject GetTextColor SetViewportOrgEx SetBkMode CombineRgn CreateSolidBrush SelectClipRgn Rectangle SetTextColor CreateCompatibleBitmap CreateDIBSection CreateRectRgn BitBlt DeleteDC ExtTextOutW SetBkColor SelectObject

advapi32

OpenEventLogW CryptSignHashW CryptDestroyHash CloseEventLog ReadEventLogW StartServiceW RegEnumKeyExW RegQueryValueExA RegOpenKeyExA SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor CloseServiceHandle OpenServiceW OpenSCManagerW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegCreateKeyExW RegOpenKeyW CryptCreateHash DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptEnumProvidersW

shell32

SHGetFolderPathW ShellExecuteW SHGetSpecialFolderPathW

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime

shlwapi

StrToIntA StrToIntW PathFileExistsW PathAddBackslashW PathFindFileNameW PathAppendW PathRemoveFileSpecW

comctl32

DrawShadowText _TrackMouseEvent

msimg32

AlphaBlend

ws2_32

getaddrinfo freeaddrinfo accept listen recvfrom sendto ioctlsocket gethostname WSAStartup gethostbyname inet_ntoa inet_addr WSAGetLastError getnameinfo WSACleanup WSAIoctl setsockopt ntohs htons getsockopt getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet socket shutdown

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

gdiplus

GdipCreateLineBrushI GdipFree GdipDeleteFont GdipCreateFont GdipCreateFontFromDC GdipMeasureString GdipDrawString GdipFillRectangleI GdipDrawLinesI GdipSetTextRenderingHint GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipDeletePen GdipCreatePen1 GdipCreateFontFromLogfontW GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdiplusShutdown GdiplusStartup GdipDeleteFontFamily GdipPrivateAddFontFile GdipDeletePrivateFontCollection GdipNewPrivateFontCollection GdipCloneFontFamily GdipGetFontCollectionFamilyList GdipGetFontCollectionFamilyCount GdipDeleteGraphics GdipCreateFromHDC GdipAlloc

iphlpapi

IcmpCloseHandle IcmpSendEcho IcmpCreateFile

wldap32

ord30 ord79 ord35 ord33 ord200 ord301 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord211 ord46 ord143 ord217

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

678KB

Virtual Size

677KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

492B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=19, id=241, version=40116,

count=206, id=243, version=40116,

count=31, id=242, version=40116,

count=100, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=11, id=199, version=41118,

count=26, id=259, version=24123,

count=64, id=261, version=24123,

count=36, id=260, version=24123,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=23, productName=Unmarked objects (old),

count=558, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=580, id=1, productName=Unmarked objects,

count=97, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,