8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b

Sharing

Copy URL Twitter E-mail

General

Target
8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b
Size 2.9MB
Sample261015-wsllxsdf67
SHA256 8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b
MD5 7f96773e90c1d5d8c79bba47e53e0777
SHA1 b9f247053c1c02db96c28b13ce84e1a2ccaede62
SHA512 b27d23a3b4d9c5cf889449a639066aa593280e19a0aa7ce9e8d6abd4a79e4b18869290791ee2442cad21ed1227bd094aab62902861714ba98d2bbfb3762fc1a2
SSDEEP 49152:ZWlvPeTSHlLU/a4hseXbrtvY3ORX8kcPK8UmzYDGk66PXMcHl46:Al9HJObrtvY3BFK8TavMcHl46
TLSH
T164E56B317605C023D5602871993CEB6DB04CAE355B64A4C7B3847FADDA639D3E932F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b

File Explorer

8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b

.exe 2.9MB

8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b

IMPHASH da0d551ee91dd677d5e04e0ef0dc5ecd
SHA256 8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b
MD5 7f96773e90c1d5d8c79bba47e53e0777
SHA1 b9f247053c1c02db96c28b13ce84e1a2ccaede62
SHA512 b27d23a3b4d9c5cf889449a639066aa593280e19a0aa7ce9e8d6abd4a79e4b18869290791ee2442cad21ed1227bd094aab62902861714ba98d2bbfb3762fc1a2
SSDEEP 49152:ZWlvPeTSHlLU/a4hseXbrtvY3ORX8kcPK8UmzYDGk66PXMcHl46:Al9HJObrtvY3BFK8TavMcHl46
TLSH
T164E56B317605C023D5602871993CEB6DB04CAE355B64A4C7B3847FADDA639D3E932F2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1199110

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\pay_group\omni_zip\client\build\x86\Release\omni_zip.pdb

kernel32

GetTickCount GetTempFileNameW WriteFile WaitForMultipleObjects GetLongPathNameW QueryDosDeviceW OpenProcess CreateFileMappingW MapViewOfFile UnmapViewOfFile lstrlenW K32GetModuleFileNameExW K32GetProcessImageFileNameW GetSystemTime SystemTimeToFileTime GetSystemDirectoryW WideCharToMultiByte SetFileTime FormatMessageA MoveFileW GetFileInformationByHandle RemoveDirectoryW CreateDirectoryW CreateProcessW GetFullPathNameW GetFileAttributesExW FindFirstFileW ReadDirectoryChangesW GetPrivateProfileIntW CompareStringOrdinal FindNextFileW LocalFree Process32NextW Process32FirstW CreateToolhelp32Snapshot lstrcmpiW GetCurrentThread GetVolumeInformationW GetLogicalDriveStringsW DeleteFileW SetFilePointerEx ReadFile GetFileSizeEx CreateFileW LoadLibraryExW IsBadReadPtr GetModuleHandleW FreeLibrary VirtualProtect GetCurrentProcessId GetCurrentProcess WaitForSingleObject SetUnhandledExceptionFilter CopyFileW WritePrivateProfileStringW GetPrivateProfileStringW FindResourceW LoadLibraryW SizeofResource LockResource LoadResource GetProcAddress FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage WriteConsoleW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID GetExitCodeProcess TerminateProcess PeekNamedPipe IsValidLocale GetACP ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleCP GetFileType CreatePipe SetEnvironmentVariableA GetTempPathW ExitThread RtlUnwind CreateFileA lstrcmpiA QueryDepthSList InterlockedFlushSList FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber FormatMessageW LocalAlloc GetModuleFileNameW FindResourceExW GetCurrentThreadId CreateEventW SetEvent SetLastError CloseHandle GetVolumePathNameW GetFileAttributesW FindClose MultiByteToWideChar Sleep DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException GetShortPathNameW DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait CreateTimerQueue lstrcmpA GetSystemWindowsDirectoryW FreeResource CreateSemaphoreW WaitForMultipleObjectsEx WaitNamedPipeW UnhandledExceptionFilter GetVersionExW UnregisterWaitEx RegisterWaitForSingleObject OutputDebugStringA GetModuleHandleExW GetModuleHandleExA GetModuleHandleA FlushFileBuffers GetStdHandle ResetEvent PostQueuedCompletionStatus GetQueuedCompletionStatus DecodePointer CreateIoCompletionPort SetThreadPriority CreateThread InterlockedCompareExchange InterlockedExchange SetHandleInformation SetFilePointer OpenFileMappingW MapViewOfFileEx MoveFileExW SetFileAttributesW GlobalUnlock GlobalLock GlobalAlloc GetCommandLineW ReleaseSemaphore GetStartupInfoW CreateMutexW ReleaseMutex OutputDebugStringW IsDebuggerPresent LoadLibraryExA VirtualFree VirtualAlloc GetStringTypeW TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetNativeSystemInfo EncodePointer QueryPerformanceCounter QueryPerformanceFrequency GetCurrentDirectoryW FindFirstFileExW AreFileApisANSI DeviceIoControl SetEndOfFile InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent

user32

GetWindow SystemParametersInfoW IsWindow GetTopWindow GetClassNameW ShowWindow SetForegroundWindow LoadCursorW FindWindowW PeekMessageW DestroyIcon GetParent GetWindowRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RemovePropW CreateWindowExW GetClassInfoExW RegisterClassExW PostMessageW RegisterWindowMessageW SetWindowLongW GetWindowLongW GetPropW SetPropW GetKeyState GetDlgCtrlID GetDlgItem EndDialog MoveWindow SendMessageW GetIconInfo DestroyWindow SetTimer UnregisterClassW CallWindowProcW PostQuitMessage DefWindowProcW DispatchMessageW TranslateMessage GetMessageW CharUpperBuffW CharLowerBuffW ChangeWindowMessageFilterEx SendMessageTimeoutW EmptyClipboard RegisterClipboardFormatW SetClipboardData IsClipboardFormatAvailable GetClipboardData CloseClipboard OpenClipboard wsprintfW WaitForInputIdle PostThreadMessageW KillTimer CharNextW WaitMessage CallMsgFilterW GetQueueStatus MsgWaitForMultipleObjectsEx

gdi32

DeleteObject GetObjectW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW SHFileOperationW SHCreateDirectoryExW ShellExecuteW DragQueryFileW SHChangeNotify SHCreateItemFromParsingName SHGetFileInfoW ShellExecuteExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CreateStreamOnHGlobal OleRun CoCreateGuid StringFromGUID2 CoInitializeEx CoTaskMemFree CoCreateInstance CoInitialize

oleaut32

SysAllocString GetErrorInfo VarUI4FromStr SysAllocStringByteLen SysStringByteLen SysStringLen SysAllocStringLen SysFreeString

comdlg32

GetOpenFileNameW

advapi32

RegQueryInfoKeyW RegEnumKeyExW ConvertSidToStringSidW RegDeleteTreeW RegSetKeyValueW RegSetKeySecurity RegQueryValueExW RegOpenKeyExW RegDeleteValueW SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor RegSetValueExW RegCreateKeyExW RegCloseKey GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken OpenProcessToken RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegGetValueW RegDeleteKeyW

shlwapi

SHSetValueA SHGetValueA StrCmpNIW StrCmpIW StrStrIA PathCombineW StrStrIW PathAppendW PathFileExistsW PathFindFileNameW PathRemoveFileSpecW PathRenameExtensionW SHGetValueW SHSetValueW PathIsDirectoryW PathIsRelativeW PathIsRootW PathFindExtensionW AssocQueryStringW StrTrimA

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipGetImageEncodersSize GdipGetImageEncoders GdipImageRotateFlip GdipGetPropertyItemSize GdipCloneImage GdipSaveImageToStream GdipDeleteGraphics GdipBitmapUnlockBits GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetInterpolationMode GdipGraphicsClear GdipDrawImageRectRectI GdiplusShutdown GdipLoadImageFromFile GdipBitmapLockBits GdipCreateBitmapFromHICON GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipGetImagePixelFormat GdipGetImageHeight GdipSaveImageToFile GdipGetImageWidth GdiplusStartup GdipSetCompositingQuality GdipDisposeImage GdipFree GdipAlloc GdipGetPropertyItem GdipGetImageGraphicsContext

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

crypt32

CertGetNameStringW CryptStringToBinaryW CryptBinaryToStringW

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

winmm

timeGetTime timeBeginPeriod timeEndPeriod

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

generic

count=26, id=241, version=40116,

count=188, id=243, version=40116,

count=33, id=242, version=40116,

count=3, id=261, version=27031,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=1, id=209, version=65501,

count=25, id=259, version=26706,

count=7, id=261, version=27032,

count=142, id=261, version=26706,

count=38, id=260, version=26706,

count=4, id=206, version=65501,

count=2, id=208, version=65501,

count=39, id=203, version=65501,

count=518, id=1, productName=Unmarked objects,

count=58, id=261, version=27054,

count=92, id=261, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,