1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c

Sharing

Copy URL Twitter E-mail

General

Target
1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c
Size 2.2MB
Sample261014-n2zwxacw21
SHA256 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c
MD5 838487818811ce9e2dbc75423687b996
SHA1 5aec60c58504c037f2f3713d7d2bfce0cb14e0ef
SHA512 66b6198fd1c80d18aac0faf0a0fc72ebc1240555e15569315f676a250a7659f641c2b7ebefd27029cfa33bc171e756dc891c1690ba8f33cdf207f80d1f044cc1
SSDEEP 49152:DWxtFa5lOmeJQJwAYhyJesqEw/+SPT7tRIpCcP1IPoO2qk:DWxtI57eowAHeoe+mxRIpCgIQO2qk
TLSH
T16FB5E0227566C031C3731931597FE22681A8AE614F7485CFB7DC362E4A748C6AB3972F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c

File Explorer

1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c

.exe 2.2MB

1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c

IMPHASH 5a2e4c7c65d65ad712bbb31470f02fe5
SHA256 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c
MD5 838487818811ce9e2dbc75423687b996
SHA1 5aec60c58504c037f2f3713d7d2bfce0cb14e0ef
SHA512 66b6198fd1c80d18aac0faf0a0fc72ebc1240555e15569315f676a250a7659f641c2b7ebefd27029cfa33bc171e756dc891c1690ba8f33cdf207f80d1f044cc1
SSDEEP 49152:DWxtFa5lOmeJQJwAYhyJesqEw/+SPT7tRIpCcP1IPoO2qk:DWxtI57eowAHeoe+mxRIpCgIQO2qk
TLSH
T16FB5E0227566C031C3731931597FE22681A8AE614F7485CFB7DC362E4A748C6AB3972F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

623529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Project\seapp\bin\Release\SeAppService.pdb

kernel32

IsBadReadPtr MulDiv GetCommandLineW CreateDirectoryW MoveFileW FindClose FindFirstFileW FindNextFileW OpenProcess LockResource WriteFile FreeResource GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetCurrentProcessId InitializeCriticalSection DeviceIoControl CreateProcessW GetModuleHandleA FindResourceExW WritePrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStructW GetExitCodeProcess WaitForSingleObject MoveFileExW GetVersionExW VirtualQuery SetUnhandledExceptionFilter ReadFile LocalFree CreateThread TerminateThread SuspendThread SetEvent CreateEventW SetFilePointer ExitProcess Sleep DuplicateHandle GetSystemTimeAsFileTime GetSystemInfo ResetEvent SetEndOfFile SetFileTime SystemTimeToFileTime TlsAlloc TlsSetValue TlsFree lstrcmpA lstrcmpiA AssignProcessToJobObject GetPrivateProfileStringW GetTickCount VirtualFree VirtualAlloc DeleteFileW CopyFileW GetTempPathW GetSystemDirectoryW WideCharToMultiByte CreateFileW GetFileSize MultiByteToWideChar FindResourceW LoadLibraryExW LoadLibraryW OpenMutexW CreateMutexW lstrcmpiW CloseHandle SizeofResource LoadResource SetErrorMode TerminateProcess SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA WriteConsoleW GetTimeZoneInformation SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetModuleFileNameA GetConsoleMode GetConsoleCP RtlUnwind OpenThread HeapWalk HeapUnlock HeapLock GetFileSizeEx CreateFileA LocalFileTimeToFileTime GetStartupInfoW UnhandledExceptionFilter WaitForSingleObjectEx GetLocalTime DosDateTimeToFileTime GetFileType GetACP GetCurrentProcess FreeLibrary InterlockedDecrement InterlockedIncrement GetModuleHandleW GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection SetLastError GetLastError GetCurrentThreadId RaiseException GetProcessHeap GetModuleHandleExA GetStdHandle ResumeThread InterlockedExchangeAdd InterlockedCompareExchange GetFileAttributesW GetCurrentDirectoryW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleExW TlsGetValue SwitchToThread PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort InterlockedExchange SetFilePointerEx FlushFileBuffers IsProcessorFeaturePresent QueryPerformanceFrequency QueryPerformanceCounter OutputDebugStringA ReleaseMutex HeapSize HeapFree FlushInstructionCache InterlockedPushEntrySList HeapReAlloc HeapAlloc HeapDestroy GetProcAddress DecodePointer VirtualProtect LoadLibraryExA IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList

user32

PostMessageW DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW IsWindow SetWindowPos GetKeyState SetForegroundWindow GetDC SendMessageW GetWindowRect GetWindowLongW SetWindowLongW GetDesktopWindow FindWindowW FindWindowExW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx LoadCursorW MonitorFromWindow GetMonitorInfoW ReleaseDC DestroyWindow InvalidateRect IsIconic PeekMessageW DispatchMessageW TranslateMessage GetMessageW GetShellWindow PostThreadMessageW WindowFromPoint GetParent MapWindowPoints MoveWindow ReplyMessage IntersectRect ClientToScreen ShowWindow EnumDisplayMonitors EnumDisplayDevicesW GetWindowThreadProcessId PtInRect AllowSetForegroundWindow KillTimer SetTimer IsWindowVisible PostQuitMessage SendMessageTimeoutW GetMessagePos MonitorFromPoint GetCursorPos GetSystemMetrics OffsetRect FillRect MessageBoxW WaitMessage CallMsgFilterW GetQueueStatus MsgWaitForMultipleObjectsEx wvsprintfW SetCursor UnionRect SetFocus GetActiveWindow GetFocus SetCapture ReleaseCapture GetUpdateRect ScreenToClient IsRectEmpty GetWindow RegisterClassW EnableWindow SetPropW GetPropW IsZoomed SetWindowRgn CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos GetSysColor CharPrevW DrawTextW SetRect SetWindowTextW GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo GetClientRect EndPaint BeginPaint UpdateLayeredWindow CharNextW

gdi32

TextOutW MoveToEx ExtTextOutW GdiFlush CreateRectRgnIndirect SetTextColor GetDIBits BitBlt SetBrushOrgEx GetObjectW CreateDIBSection GdiAlphaBlend SetStretchBltMode StretchBlt SelectObject GetStockObject DeleteObject DeleteDC CreateCompatibleDC GetDeviceCaps CreateCompatibleBitmap CreateFontIndirectW CreatePen Rectangle RestoreDC SaveDC GetTextMetricsW SetWindowOrgEx CreateRoundRectRgn GetObjectA CombineRgn CreateDCW CreatePenIndirect SetBkMode CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo RoundRect SelectClipRgn ExtSelectClipRgn SetBkColor CreatePatternBrush

shell32

SHAppBarMessage ShellExecuteW SHGetSpecialFolderPathW SHGetFolderPathW SHChangeNotify ord680 CommandLineToArgvW

shlwapi

SHGetValueA PathFileExistsW PathFindFileNameW SHGetValueW PathAppendW SHSetValueW StrDupW SHStrDupW PathRemoveFileSpecW PathCombineW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ws2_32

bind closesocket send recv listen inet_addr htons socket accept WSAStartup

netapi32

Netbios

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

imm32

ImmReleaseContext ImmSetCompositionFontW ImmSetCompositionWindow ImmGetContext

generic

count=26, id=241, version=40116,

count=186, id=243, version=40116,

count=34, id=242, version=40116,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=8, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=26, id=259, version=26706,

count=35, id=260, version=26706,

count=78, id=261, version=26706,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=625, id=1, productName=Unmarked objects,

count=10, id=260, version=27048,

count=178, id=261, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,