b11164e00abad02dd06b64837c65b5b7d2b3d630dddebfe19c8216f40e342318

Sharing

Copy URL Twitter E-mail

General

Target
b11164e00abad02dd06b64837c65b5b7d2b3d630dddebfe19c8216f40e342318
Size 949KB
Sample261017-d292rsch77
SHA256 b11164e00abad02dd06b64837c65b5b7d2b3d630dddebfe19c8216f40e342318
MD5 647d4bb6746d65f521b29be7a7235f9d
SHA1 5c4d61ccfcbba532d448e4b66945c05bb6104a5e
SHA512 f4005212f696385904b12dd35876685219785c7e7b60d5d6bc53e3fd39d0f9d287fecbaa09cbf3a3536910a254ed87c025bc970e9e4832b4fa89f3ac65c2981a
SSDEEP 24576:TQj13UzOsYxfTIL2QVBK2+7Q0nwx497dZM:8Z3U9Yx7/oKL62xP
TLSH
T1DB25F1135248D176C79613B05DAFF8A8B6ACEE640724A1CFD6C83E390E715D2A53329F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b11164e00abad02dd06b64837c65b5b7d2b3d630dddebfe19c8216f40e342318

File Explorer

b11164e00abad02dd06b64837c65b5b7d2b3d630dddebfe19c8216f40e342318

.exe 949KB

b11164e00abad02dd06b64837c65b5b7d2b3d630dddebfe19c8216f40e342318

IMPHASH 6631f17abf7622c80e6386a07d73a6f8
SHA256 b11164e00abad02dd06b64837c65b5b7d2b3d630dddebfe19c8216f40e342318
MD5 647d4bb6746d65f521b29be7a7235f9d
SHA1 5c4d61ccfcbba532d448e4b66945c05bb6104a5e
SHA512 f4005212f696385904b12dd35876685219785c7e7b60d5d6bc53e3fd39d0f9d287fecbaa09cbf3a3536910a254ed87c025bc970e9e4832b4fa89f3ac65c2981a
SSDEEP 24576:TQj13UzOsYxfTIL2QVBK2+7Q0nwx497dZM:8Z3U9Yx7/oKL62xP
TLSH
T1DB25F1135248D176C79613B05DAFF8A8B6ACEE640724A1CFD6C83E390E715D2A53329F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

108941

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\For_Jenkins\WorkSpace\MusicBox_PUBLIC_FULL\KwResource\bin\Release\pdb\KwWebKit.pdb

kernel32

CloseHandle ReadFile DeleteFileW WriteFile CreateThread GetModuleHandleW GetModuleFileNameW OutputDebugStringW Sleep CreateProcessA GetCurrentThread CreateToolhelp32Snapshot Process32FirstW GetCurrentProcessId OpenProcess WaitForSingleObject Process32NextW GetVersionExW TerminateThread GetSystemInfo VirtualAlloc VirtualFree LoadLibraryExW FreeLibrary GetProcAddress LoadLibraryW SetUnhandledExceptionFilter SetErrorMode GetLocalTime GetPrivateProfileStringW IsDebuggerPresent CreateProcessW RaiseException GetCurrentThreadId MultiByteToWideChar GetFileSize LocalFree VirtualQuery VirtualProtect EncodePointer DecodePointer QueryPerformanceCounter GetSystemTimeAsFileTime IsProcessorFeaturePresent SetLastError LoadLibraryExA SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache GetCPInfo CreateFileW GetLastError WideCharToMultiByte GetCurrentProcess CreateDirectoryW

user32

RegisterClassExW DefWindowProcW PostMessageW GetMessageW CreateWindowExW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathW

shlwapi

PathIsDirectoryW

msvcp120

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Orphan_all@_Container_base0@std@@QAEXXZ ?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z

msvcr120

_wmakepath_s swprintf_s wcscpy_s vswprintf_s isxdigit toupper memcpy memset ??_V@YAXPAX@Z strcmp ??1type_info@@UAE@XZ _lock _unlock _calloc_crt __dllonexit _onexit _XcptFilter __crtGetShowWindowMode _amsg_exit __wgetmainargs __set_app_type exit _cexit _configthreadlocale __setusermatherr _initterm_e _initterm _wcmdln _fmode _commode ?terminate@@YAXXZ _except_handler4_common __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s _crt_debugger_hook __crtUnhandledException __crtTerminateProcess _wsplitpath_s _exit _errno _read _filelength wcsncmp free wcstok_s _close ?_wopen@@YAHPB_WHH@Z _purecall _strlwr_l memchr __free_locale _create_locale atoi _time64 _snprintf_s memmove ??2@YAPAXI@Z ??3@YAXPAX@Z _wcsdup _CxxThrowException __CxxFrameHandler3 _wcslwr_l _except_handler3

kwsharememmgr

?InitShareMem@KwShareMemMgr@@YAHXZ ?ExitShareMem@KwShareMemMgr@@YAXXZ ?GetDataByCmd@KwShareMemMgr@@YAIABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV23@@Z

Sharing

General

Malware Config

Signatures

File Explorer

b11164e00abad02dd06b64837c65b5b7d2b3d630dddebfe19c8216f40e342318

kernel32

user32

advapi32

shell32

shlwapi

msvcp120

msvcr120

kwsharememmgr

generic