18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f

Sharing

Copy URL Twitter E-mail

General

Target
18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f
Size 4.2MB
Sample261014-knmsmsfc95
SHA256 18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f
MD5 04ca9805257d809a27e83e5c8556d9c9
SHA1 c8b44bafb3c9eb843b6291a830b8a1c87d8ccd2b
SHA512 d9113d6fb8026c063d7c69f68d5adc1bdf126b0136ecab343bb6275d6ed1825e7635d4d28381db789bd7395ebc6ea8a184d0c912a864feaffa0394c769a8067d
SSDEEP 49152:DV8T2iaqKZzMLDBJGCa//VThMY+2plID6znMKSyklFV2PJ5yyqM5zlmHCSjdidYe:DWa5q65CMnMbCMKdPJT5zIHCSjPAO
TLSH
T1E2268E10D7419127F4F300F6C6BE467AAD247B30232594DBA3C46E5E6BB46D1BA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f

File Explorer

18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f

.exe 4.2MB

18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f

IMPHASH c52c0b49e20f91827e5c83938cbbd14f
SHA256 18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f
MD5 04ca9805257d809a27e83e5c8556d9c9
SHA1 c8b44bafb3c9eb843b6291a830b8a1c87d8ccd2b
SHA512 d9113d6fb8026c063d7c69f68d5adc1bdf126b0136ecab343bb6275d6ed1825e7635d4d28381db789bd7395ebc6ea8a184d0c912a864feaffa0394c769a8067d
SSDEEP 49152:DV8T2iaqKZzMLDBJGCa//VThMY+2plID6znMKSyklFV2PJ5yyqM5zlmHCSjdidYe:DWa5q65CMnMbCMKdPJT5zIHCSjPAO
TLSH
T1E2268E10D7419127F4F300F6C6BE467AAD247B30232594DBA3C46E5E6BB46D1BA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2189367

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\autobuild-components-v5\workspace\360sesvc\360sesvc\bin\Release\sesvc.pdb

kernel32

FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetCurrentProcessId LockFileEx LocalFree CreateFileMappingA UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileA GetVersionExA WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA LockFile GetDiskFreeSpaceW InterlockedCompareExchange GetFullPathNameW HeapFree HeapCreate AreFileApisANSI TryEnterCriticalSection GetPrivateProfileStringW WritePrivateProfileStringW CopyFileW OpenProcess DebugBreak lstrlenA lstrlenW GetDiskFreeSpaceExW CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenMutexW GetCurrentThread WaitForMultipleObjects CreateProcessW GetPrivateProfileIntW GetSystemDirectoryW GetTempFileNameW QueryDosDeviceW GetFileType DuplicateHandle DosDateTimeToFileTime GetCurrentDirectoryW GetExitCodeProcess ReleaseMutex GetSystemTimes LockResource InterlockedExchange MoveFileW VirtualQuery SetUnhandledExceptionFilter GetCommandLineW WritePrivateProfileStructW DeviceIoControl ResetEvent TlsAlloc TlsSetValue TlsFree CreateWaitableTimerW SetWaitableTimer CancelWaitableTimer IsBadReadPtr IsBadWritePtr GetModuleHandleA FindResourceW lstrcpynW TerminateThread SuspendThread lstrcmpA lstrcmpiA GetFileSizeEx ExitProcess LocalFileTimeToFileTime OutputDebugStringA GetModuleHandleW LoadLibraryExW lstrcmpiW FlushFileBuffers LoadResource Sleep SetErrorMode TerminateProcess GetCurrentProcess InterlockedDecrement InterlockedIncrement GetTickCount FindNextFileW FindFirstFileW RemoveDirectoryW FindClose FreeLibrary InitializeCriticalSection ExitThread MoveFileExW SetFileAttributesW GetModuleFileNameW LoadLibraryW CreateThread GetProcAddress CreateMutexW LeaveCriticalSection EnterCriticalSection GetCurrentThreadId CreateEventW WaitForSingleObject SetEvent WideCharToMultiByte MultiByteToWideChar WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA SetStdHandle GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode GetModuleFileNameA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW SetEnvironmentVariableA GetModuleHandleExW FreeLibraryAndExitThread ResumeThread RtlUnwind OpenThread HeapWalk HeapUnlock HeapLock SetFilePointerEx FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo DeleteFileW DeleteCriticalSection InitializeCriticalSectionAndSpinCount RaiseException DecodePointer GetFileAttributesW TlsGetValue SwitchToThread GetStringTypeW EncodePointer LoadLibraryExA VirtualProtect VerifyVersionInfoA VerSetConditionMask PeekNamedPipe GetStdHandle GetEnvironmentVariableA MoveFileExA GetSystemDirectoryA QueryPerformanceFrequency SleepEx GetLongPathNameW GetACP QueryPerformanceCounter IsProcessInJob SizeofResource QueryInformationJobObject CreateDirectoryW SetFileTime SetLastError GetVersionExW VirtualFree VirtualAlloc CreateFileA SetFilePointer ReadFile WriteFile GetFileSize GetLastError CreateFileW CreateFileMappingW UnmapViewOfFile MapViewOfFile CloseHandle

user32

SetWindowTextW KillTimer SetTimer GetAsyncKeyState GetKeyState SetWindowPos ShowWindow IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW GetWindowRect GetWindowLongW SetWindowLongW GetDesktopWindow LoadCursorW MonitorFromWindow GetMonitorInfoW TranslateMessage DispatchMessageW SendMessageW UnregisterClassW GetMessageW PostThreadMessageW GetMessagePos GetShellWindow PostMessageW MsgWaitForMultipleObjects CloseWindow RealGetWindowClassW SystemParametersInfoW GetWindowThreadProcessId WindowFromPoint GetLastInputInfo SendMessageTimeoutW wsprintfW EnumDisplayDevicesW EnumDisplaySettingsW CharLowerW EnumDisplayMonitors GetWindowTextW wvsprintfW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW FindWindowExW FindWindowW SetForegroundWindow CharNextW PeekMessageW ReleaseDC GetDC GetSystemMetrics DestroyWindow GetClassNameW GetForegroundWindow

gdi32

GetDeviceCaps

shell32

SHChangeNotify ord680 SHFileOperationW ord155 SHGetFolderPathW ord190 ShellExecuteExW SHAppBarMessage SHGetSpecialFolderPathW ShellExecuteW ord165

ws2_32

socket send gethostname ioctlsocket sendto recvfrom recv listen freeaddrinfo getaddrinfo __WSAFDIsSet select htons htonl accept WSAStartup WSACleanup WSAIoctl WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSAGetLastError bind connect getpeername getsockname getsockopt ntohs setsockopt WSASetLastError closesocket

wldap32

ord60 ord45 ord50 ord301 ord200 ord30 ord79 ord35 ord33 ord143 ord217 ord46 ord41 ord22 ord26 ord27 ord32 ord211

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertCloseStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenStore CertAddCertificateContextToStore

shlwapi

PathFindExtensionW SHGetValueA PathIsRootW PathGetDriveNumberW PathAddBackslashW PathIsDirectoryW StrDupW StrStrIW PathFindFileNameA PathFileExistsW PathRemoveFileSpecW PathCombineW SHGetValueW SHSetValueW PathAppendW StrCmpIW PathFindFileNameW SHDeleteValueW StrStrIA

psapi

GetModuleFileNameExW GetProcessImageFileNameW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

powrprof

CallNtPowerInformation

wintrust

WinVerifyTrust

setupapi

SetupIterateCabinetW

netapi32

Netbios NetUserChangePassword

generic

count=20, id=241, version=40116,

count=205, id=243, version=40116,

count=30, id=242, version=40116,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=8, id=199, version=41118,

count=27, id=259, version=26706,

count=35, id=260, version=26706,

count=77, id=261, version=26706,

count=113, id=260, version=27034,

count=33, id=261, version=27034,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=710, id=1, productName=Unmarked objects,

count=111, id=261, version=27054,

count=49, id=260, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,