755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49

Sharing

Copy URL Twitter E-mail

General

Target
755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49
Size 3.6MB
Sample261022-tyttdavz7m
SHA256 755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49
MD5 7cfceed7109c2fadb2201a9bab6ffb69
SHA1 23ca65056865836d06eef76621541d7b9396dfcd
SHA512 5d95a0069500356a8d93408b28ed9d8ea7f12ca5d3eb3e64ddb19abe71de9d32cd6a988bb5dcb7524c7791544876a4064aed8a489b242d15c5b9ae582c9fd0f9
SSDEEP 49152:J3E67R6STN//xbyBPmEv37+z8Wmk14aPRnx1VOnWBIJwf1HUEPCoG44agx8EaKU:Rb7R6SX2BPmE/6oLkGKoEqNajsU
TLSH
T1D706CF11B693C533E99301719A7DAB7F443DE7211B2986C3D3D41EA80D70AD22B3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49

File Explorer

755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49

.exe 3.6MB

755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49

IMPHASH af21059c5c5f91c92779746693f459fb
SHA256 755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49
MD5 7cfceed7109c2fadb2201a9bab6ffb69
SHA1 23ca65056865836d06eef76621541d7b9396dfcd
SHA512 5d95a0069500356a8d93408b28ed9d8ea7f12ca5d3eb3e64ddb19abe71de9d32cd6a988bb5dcb7524c7791544876a4064aed8a489b242d15c5b9ae582c9fd0f9
SSDEEP 49152:J3E67R6STN//xbyBPmEv37+z8Wmk14aPRnx1VOnWBIJwf1HUEPCoG44agx8EaKU:Rb7R6SX2BPmE/6oLkGKoEqNajsU
TLSH
T1D706CF11B693C533E99301719A7DAB7F443DE7211B2986C3D3D41EA80D70AD22B3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1865998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\code_version\code_3.3.7.7\rel\PdfQuick.pdb

kernel32

WriteFile TerminateThread TerminateProcess SetEndOfFile SetFilePointer RemoveDirectoryW MoveFileExW SetFileAttributesW GetDiskFreeSpaceExW lstrlenA GetPrivateProfileStringW GetComputerNameW GetNativeSystemInfo GetSystemTime GetSystemInfo GetSystemDirectoryW PostQueuedCompletionStatus GetExitCodeThread CreateIoCompletionPort GetQueuedCompletionStatus GetLocalTime GetThreadLocale SetThreadLocale VirtualProtect lstrcmpA GetFileAttributesExW FlushFileBuffers FormatMessageA SleepEx GetFileType GetStdHandle PeekNamedPipe ExpandEnvironmentStringsA QueryPerformanceCounter LoadLibraryA GlobalMemoryStatus FlushConsoleInputBuffer WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage GetCurrentDirectoryW GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTempPathW GetDateFormatW GetConsoleCP ReadConsoleW GetVersion SetConsoleMode ReadConsoleInputA GetConsoleMode SetConsoleCtrlHandler ExitProcess SetFilePointerEx SystemTimeToTzSpecificLocalTime FindFirstFileExW GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait CreateTimerQueue SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc QueryPerformanceFrequency EncodePointer GetStringTypeW GetCurrentThread TryEnterCriticalSection GlobalFree GlobalAlloc MulDiv VerifyVersionInfoW VerSetConditionMask OutputDebugStringA IsWow64Process CreateRemoteThread CreateMutexW GetPrivateProfileIntW WritePrivateProfileStringW GetWindowsDirectoryW GetCurrentProcess GetTickCount SetEvent CreateEventW VirtualAllocEx ResetEvent GetModuleHandleA DuplicateHandle WriteProcessMemory GetModuleFileNameA CreatePipe ReadFile GetStartupInfoW GetVersionExW GetCurrentProcessId GetLogicalDriveStringsW GetLongPathNameW QueryDosDeviceW MapViewOfFile CreateFileMappingW UnmapViewOfFile SetEnvironmentVariableW lstrlenW GetFullPathNameW LoadLibraryExW lstrcmpiW Process32FirstW Process32NextW ProcessIdToSessionId CreateToolhelp32Snapshot ReleaseMutex GetDriveTypeW lstrcmpW GetFileTime ReadDirectoryChangesW WaitForSingleObjectEx ResumeThread GetACP WaitForSingleObject WaitForMultipleObjects InterlockedCompareExchange InterlockedExchange CopyFileW GetFileSize CreateThread DeleteFileW OutputDebugStringW Sleep GetCurrentThreadId FindClose FindNextFileW SetLastError FindFirstFileW CreateDirectoryW InterlockedIncrement FreeLibrary FindResourceW LoadResource FindResourceExW LockResource InitializeCriticalSection LeaveCriticalSection GetModuleFileNameW InterlockedDecrement EnterCriticalSection SizeofResource SystemTimeToFileTime LoadLibraryW FileTimeToSystemTime WideCharToMultiByte GetModuleHandleW CreateProcessW LocalFree GetProcAddress CloseHandle HeapFree MultiByteToWideChar OpenProcess CreateFileW DeviceIoControl GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount GetTimeFormatW

user32

RegisterClassExW LoadCursorW SetWindowLongW GetClassInfoExW GetWindowThreadProcessId FindWindowExW SendMessageW SetCaretPos CreateCaret GetCaretBlinkTime GetUserObjectInformationW MessageBoxA ShowWindow IsWindow CreateWindowExW DestroyWindow CallWindowProcW DefWindowProcW GetWindowLongW GetParent GetDlgItem GetClientRect MoveWindow MapWindowPoints GetMonitorInfoW MonitorFromWindow SetWindowPos SetFocus GetWindowRect GetWindow GetDesktopWindow KillTimer SetTimer TranslateMessage CharNextW PeekMessageW DispatchMessageW GetMessageW GetAncestor EnumDisplaySettingsW GetForegroundWindow GetWindowInfo WindowFromPoint GetShellWindow MonitorFromPoint wsprintfW PostMessageW GetCursorPos PtInRect CopyRect SetRectEmpty EqualRect SetCursor ClientToScreen ScreenToClient GetDoubleClickTime IntersectRect GetDC ReleaseDC IsRectEmpty SetForegroundWindow UnregisterClassW GetSysColor RegisterClipboardFormatW IsClipboardFormatAvailable BringWindowToTop AttachThreadInput SetActiveWindow GetKeyState UpdateWindow FillRect GetIconInfo DrawIconEx SystemParametersInfoW BeginPaint EndPaint IsIconic InvalidateRect TrackMouseEvent SetCapture ReleaseCapture SetLayeredWindowAttributes SetWindowRgn EnableWindow GetWindowTextW PostQuitMessage IsWindowVisible IsZoomed MonitorFromRect OffsetRect DrawTextW UpdateLayeredWindow SetWindowTextW GetWindowTextLengthW GetFocus CharLowerBuffW GetProcessWindowStation

gdi32

SetTextCharacterExtra GetCurrentObject GetTextColor CreateFontIndirectW Rectangle CreatePen CreateSolidBrush SetBkColor SetTextColor SetBkMode CreateRectRgn CombineRgn CreateRoundRectRgn SaveDC GetBitmapBits StretchBlt SetStretchBltMode DeleteDC BitBlt SetPixel SelectObject CreateCompatibleDC GetObjectW DeleteObject CreateDIBSection GetStockObject GetDeviceCaps CreateRectRgnIndirect ExtSelectClipRgn RestoreDC GetViewportOrgEx SetBitmapBits

advapi32

CheckTokenMembership RegSetKeySecurity SetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityInfo DeleteAce EqualSid GetAce GetSecurityInfo FreeSid AllocateAndInitializeSid RegNotifyChangeKeyValue LookupPrivilegeValueW RegEnumKeyExW CreateProcessAsUserW RegDeleteValueW DuplicateTokenEx CryptGenRandom RegRenameKey RegDeleteTreeW OpenProcessToken GetTokenInformation CryptAcquireContextW RegQueryInfoKeyW CryptCreateHash CryptHashData CryptDestroyHash CryptReleaseContext RegCloseKey RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegOpenKeyExW ConvertSidToStringSidW GetUserNameW RegQueryValueExW LookupAccountNameW CryptDestroyKey CryptDeriveKey CryptEncrypt CryptDecrypt DeregisterEventSource RegisterEventSourceA ReportEventA

shell32

SHCreateDirectoryExW ord165 ShellExecuteW SHGetSpecialFolderPathW SHGetSpecialFolderPathA ord2 ord4 SHChangeNotify

ole32

CoCreateGuid CoInitializeSecurity CoInitializeEx RegisterDragDrop StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CreateStreamOnHGlobal CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoTaskMemAlloc CoUninitialize CoInitialize

oleaut32

VariantClear VarDateFromStr SystemTimeToVariantTime VariantTimeToSystemTime VariantInit SysStringByteLen VarBstrCmp SysAllocStringLen VarUI4FromStr SysAllocStringByteLen SysAllocString LoadRegTypeLi LoadTypeLi SysStringLen SysFreeString

shlwapi

SHDeleteValueW SHSetValueW SHDeleteKeyW SHGetValueW AssocQueryStringW PathSearchAndQualifyW StrCmpIW PathFileExistsW PathRemoveFileSpecW PathAppendW PathIsDirectoryW PathCombineW PathFindFileNameW PathFindExtensionW StrStrIW PathAppendA PathSearchAndQualifyA PathRemoveFileSpecA PathIsRootW PathCanonicalizeW PathRemoveBackslashW PathIsPrefixW

comctl32

ord17 InitCommonControlsEx

msimg32

AlphaBlend

secur32

GetUserNameExW

wininet

InternetConnectW HttpOpenRequestW HttpSendRequestW InternetCloseHandle InternetReadFile InternetOpenW InternetCrackUrlW HttpQueryInfoW InternetSetOptionW

setupapi

SetupIterateCabinetW

gdiplus

GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDrawImageRectI GdipSetInterpolationMode GdipGetImageGraphicsContext GdipDisposeImage GdipFillRectangle GdipSetSmoothingMode GdipDeleteGraphics GdipGetImagePixelFormat GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipAlloc GdipFree GdiplusStartup GdipSetTextRenderingHint GdipDrawString GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipCreateFromHDC GdipCreateBitmapFromScan0

psapi

GetProcessImageFileNameW GetModuleFileNameExW EnumProcessModules

riched20

ord4

crypt32

CryptBinaryToStringW CryptStringToBinaryW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wintrust

CryptCATCatalogInfoFromContext WinVerifyTrust CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext CryptCATAdminEnumCatalogFromHash CryptCATAdminAcquireContext CryptCATAdminCalcHashFromFileHandle

ws2_32

ntohs closesocket bind send recv WSASetLastError select __WSAFDIsSet WSAGetLastError gethostbyname inet_ntoa gethostname WSACleanup WSAStartup htons getsockopt getsockname connect getservbyname htonl shutdown ioctlsocket sendto recvfrom setsockopt socket WSAIoctl getaddrinfo freeaddrinfo accept listen getpeername

wldap32

ord26 ord27 ord127 ord167 ord142 ord79 ord133 ord147 ord301 ord46 ord14 ord216 ord145 ord118 ord41 ord208

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW WTSFreeMemory

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

netapi32

Netbios

iphlpapi

GetAdaptersInfo GetIpAddrTable

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

575KB

Virtual Size

575KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

67KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

872KB

Virtual Size

876KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=27, id=241, version=40116,

count=205, id=243, version=40116,

count=33, id=242, version=40116,

count=2, id=19, version=9049,

count=6, id=199, version=41118,

count=27, id=259, version=24123,

count=3, id=261, version=23013,

count=132, id=261, version=24123,

count=39, id=260, version=24123,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=650, id=1, productName=Unmarked objects,

count=85, id=260, productName=VS2015 [14.0] build 23026, version=23026,

count=495, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=124, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=164, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,