XyronFreeMacro[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
XyronFreeMacro.exe
Size 674KB
Sample261014-flcgnswt9j
SHA256 74263475b68cfe8f65fc637b52fb90389a504112bd4d8cc4b60abea28eb7fa59
MD5 811e3fc52126a72a7708541a599b0657
SHA1 35305ee09e49475196460fd6bd9252f15cd47c44
SHA512 ca6098cfa83eaa7014d61e7eeeb12b8ce9ddab731b2627f6093700178fe65dec355aaa7643e0e3ce94b35327cc41cd0fa0868a543af703a06632836c7b86dc41
SSDEEP 12288:E3TCweQE39Na8PnQ4x6NcLM57Q4x6NcLM5Ezj5oWQ9/4gZ:YS9NaQQQxLMBQQxLMOOW6Q
TLSH
T193E4D02162D501FDE27B967094A25E26EA73B84103B49ADF33AC86570F276C09F3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XyronFreeMacro.exe

File Explorer

XyronFreeMacro.exe

.exe 674KB

XyronFreeMacro.exe

IMPHASH ebce26e7e20a1969d82075cd0572bd80
SHA256 74263475b68cfe8f65fc637b52fb90389a504112bd4d8cc4b60abea28eb7fa59
MD5 811e3fc52126a72a7708541a599b0657
SHA1 35305ee09e49475196460fd6bd9252f15cd47c44
SHA512 ca6098cfa83eaa7014d61e7eeeb12b8ce9ddab731b2627f6093700178fe65dec355aaa7643e0e3ce94b35327cc41cd0fa0868a543af703a06632836c7b86dc41
SSDEEP 12288:E3TCweQE39Na8PnQ4x6NcLM57Q4x6NcLM5Ezj5oWQ9/4gZ:YS9NaQQQxLMBQQxLMOOW6Q
TLSH
T193E4D02162D501FDE27B967094A25E26EA73B84103B49ADF33AC86570F276C09F3F721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

121024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

DeleteDC CreateCompatibleDC SelectObject CreateDIBSection CreateCompatibleBitmap DeleteObject CreateRoundRectRgn BitBlt

gdiplus

GdiplusStartup GdiplusShutdown GdipAlloc GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDrawImageRectI GdipFillPath GdipFillEllipseI GdipFillEllipse GdipFillRectangleI GdipDrawPath GdipDrawPolygon GdipDrawEllipseI GdipDrawEllipse GdipDrawLineI GdipDrawLine GdipSetTextRenderingHint GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipDeletePen GdipCreatePen1 GdipGetPathGradientPointCount GdipSetPathGradientSurroundColorsWithCount GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipCreateLineBrush GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipAddPathEllipse GdipAddPathArc GdipClosePathFigure GdipDeletePath GdipCreatePath GdipFree

user32

DispatchMessageW GetWindowTextW MessageBoxW EnumWindows GetClassNameW DestroyWindow IsWindow ReleaseDC GetDC UpdateLayeredWindow PeekMessageW TranslateMessage SetWindowLongPtrW GetWindowLongPtrW GetCursorPos InvalidateRect SetWindowRgn EndPaint BeginPaint UpdateWindow GetSystemMetrics KillTimer SetTimer ReleaseCapture SetCapture SetWindowPos ShowWindow CreateWindowExW LoadCursorW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW GetKeyNameTextW MapVirtualKeyW SendInput GetAsyncKeyState GetMessageW

winmm

timeEndPeriod timeBeginPeriod

shell32

SHGetFolderPathW ShellExecuteW ShellExecuteExW

advapi32

GetTokenInformation OpenProcessToken

ole32

CreateStreamOnHGlobal

kernel32

HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx GetFileType LCMapStringW LoadLibraryExW HeapFree HeapAlloc UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle CreateFileW IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx GlobalFree GlobalLock GlobalUnlock GlobalAlloc WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetFileAttributesW FindNextFileW FindFirstFileW FindClose WriteConsoleW TerminateProcess CreateDirectoryW QueryPerformanceFrequency IsDebuggerPresent OutputDebugStringA CheckRemoteDebuggerPresent CloseHandle GetLastError SetLastError ReleaseMutex CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId ExitProcess CreateThread GetCurrentThread GetThreadContext SetThreadContext VirtualProtect GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress SetDllDirectoryW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GetTickCount64 QueryPerformanceCounter

Name

.text

Size

185KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

350KB

Virtual Size

350KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

XyronFreeMacro.exe

gdi32

gdiplus

user32

winmm

shell32

advapi32

ole32

kernel32

generic