7246f1996b7a5e2d9166572ac8b17cdf91f6c6fc800211a97cce399c07f0ce98

Sharing

Copy URL Twitter E-mail

General

Target
7246f1996b7a5e2d9166572ac8b17cdf91f6c6fc800211a97cce399c07f0ce98
Size 4.9MB
Sample261027-jef33abt5z
SHA256 7246f1996b7a5e2d9166572ac8b17cdf91f6c6fc800211a97cce399c07f0ce98
MD5 055e13a55b1272f8960864c92e222cd8
SHA1 a33dd4c9a008917c08166bdd474cdcb52ddd856f
SHA512 9cce8b98ca8db5d4845acb4e230b84b0d6a75fc888cedf98ef8e8d1756b5acc723a5fd91a959e872b4cbd5023172aaf05387564636feea3d8289328f208d648e
SSDEEP 98304:H6uNktoOlEwtUGrpe7qiJlRqRCc+CqEdhFHH5j70:au1wUlRGCWqOhN50
TLSH
T1E636B0213A45C03AD69111F28939AFAE847CA7204F3155D7A3A827BD5F307D32B36E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7246f1996b7a5e2d9166572ac8b17cdf91f6c6fc800211a97cce399c07f0ce98

File Explorer

7246f1996b7a5e2d9166572ac8b17cdf91f6c6fc800211a97cce399c07f0ce98

.exe 4.9MB

7246f1996b7a5e2d9166572ac8b17cdf91f6c6fc800211a97cce399c07f0ce98

IMPHASH bc726051ec9f6b0c9d943fa2a67070a4
SHA256 7246f1996b7a5e2d9166572ac8b17cdf91f6c6fc800211a97cce399c07f0ce98
MD5 055e13a55b1272f8960864c92e222cd8
SHA1 a33dd4c9a008917c08166bdd474cdcb52ddd856f
SHA512 9cce8b98ca8db5d4845acb4e230b84b0d6a75fc888cedf98ef8e8d1756b5acc723a5fd91a959e872b4cbd5023172aaf05387564636feea3d8289328f208d648e
SSDEEP 98304:H6uNktoOlEwtUGrpe7qiJlRqRCc+CqEdhFHH5j70:au1wUlRGCWqOhN50
TLSH
T1E636B0213A45C03AD69111F28939AFAE847CA7204F3155D7A3A827BD5F307D32B36E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1456342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\webview\WebView\webview\Release\CefView2.pdb

oleacc

LresultFromObject AccessibleObjectFromWindow

imm32

ImmNotifyIME ImmReleaseContext ImmGetCompositionStringW ImmAssociateContextEx ImmGetContext ImmSetCandidateWindow

kernel32

GlobalSize GlobalUnlock GlobalLock GetCurrentProcess TerminateProcess IsBadStringPtrW GetCommandLineW WinExec MulDiv GetEnvironmentVariableW SetEnvironmentVariableW SetUnhandledExceptionFilter VirtualProtect IsBadReadPtr GetFileSize ReadFile SetFilePointer Sleep ReleaseMutex GetLocalTime GetCurrentProcessId PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode GetConsoleCP FlushConsoleInputBuffer GlobalMemoryStatus LoadLibraryA GetSystemDirectoryA lstrcatA lstrlenA ResetEvent RtlCaptureStackBackTrace LoadLibraryW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW GetModuleFileNameW FindResourceExW GetTickCount OpenProcess GetExitCodeProcess WaitForSingleObject DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException CloseHandle DecodePointer OutputDebugStringW GetTempPathW SetFileAttributesW WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetCurrentDirectoryW SetCurrentDirectoryW SetConsoleCtrlHandler GetTempFileNameW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW CreateProcessW GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetStdHandle ExitProcess GetFileAttributesExW GetFullPathNameW GetDriveTypeW GetModuleHandleExW ResumeThread ExitThread GetFileSizeEx LocalFree WaitForMultipleObjectsEx CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore DuplicateHandle GlobalAlloc UnregisterWait RegisterWaitForSingleObject WaitForMultipleObjects CreateEventW SetEvent LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetLastError InitializeCriticalSectionAndSpinCount GetCurrentThreadId OutputDebugStringA FreeLibrary GetFileTime DeleteFileW CreateFileW WideCharToMultiByte K32GetModuleFileNameExW K32EnumProcessModules GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes GetCurrentThread SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait WaitForSingleObjectEx FormatMessageA Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetProcessImageFileNameW lstrlenW QueryDosDeviceW GetLongPathNameW GetLogicalDriveStringsW GetDiskFreeSpaceExW DosDateTimeToFileTime FileTimeToDosDateTime LocalFileTimeToFileTime FileTimeToLocalFileTime SystemTimeToFileTime GetSystemTime SetFileTime SetEndOfFile InterlockedExchangeAdd GetVersionExW GetSystemWindowsDirectoryW FreeResource InterlockedCompareExchange CreateFileA GetSystemDirectoryW lstrcmpiA lstrcmpA DeviceIoControl FlushFileBuffers GetStartupInfoW UnhandledExceptionFilter WriteFile FindNextFileW FindNextFileA FindFirstFileW FindFirstFileA FindClose lstrcmpiW MapViewOfFileEx UnmapViewOfFile MapViewOfFile OpenFileMappingW CreateFileMappingW LoadLibraryExW GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetCPInfo TryEnterCriticalSection QueryPerformanceFrequency QueryPerformanceCounter FormatMessageW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent SetProcessAffinityMask CreateMutexW MultiByteToWideChar MoveFileExW MoveFileW RtlUnwind CopyFileW ReadConsoleW

user32

SendMessageW SendMessageTimeoutW GetClassInfoExW MessageBoxA GetWindowThreadProcessId UnregisterClassW CreateWindowExW GetUserObjectInformationW IsWindow DestroyWindow SetWindowTextW GetWindowLongW SetWindowLongW PostMessageW DefWindowProcW CallWindowProcW GetProcessWindowStation RegisterClassExW GetKeyState LoadStringW UnhookWindowsHookEx DeregisterShellHookWindow RegisterShellHookWindow IsRectEmpty CopyRect MessageBoxW AdjustWindowRectEx GetForegroundWindow UpdateWindow RemoveMenu GetSubMenu SetMenu GetMenu SetTimer LoadIconW CallNextHookEx SetWindowsHookExW SetClassLongW FrameRect WindowFromPoint GetCursorPos SetCursor GetWindowRect EndPaint BeginPaint ReleaseDC GetDC GetSystemMetrics KillTimer ReleaseCapture SetCapture GetCapture SetFocus UpdateLayeredWindow GetDoubleClickTime ReplyMessage GetMessageTime GetMessagePos TrackMouseEvent IsIconic BringWindowToTop CharNextW SetForegroundWindow PeekMessageW PostThreadMessageW UnregisterClassA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetDesktopWindow GetShellWindow GetWindow EnumDisplaySettingsW SystemParametersInfoW MonitorFromPoint MonitorFromWindow GetMonitorInfoW GetWindowInfo GetAncestor wsprintfW SetCaretPos DestroyCaret CreateCaret GetKeyboardLayoutNameW ScreenToClient RegisterClipboardFormatW NotifyWinEvent GetParent PtInRect SetRect ClientToScreen GetClientRect InvalidateRect GetFocus IsDialogMessageW TranslateAcceleratorW LoadAcceleratorsW PostQuitMessage DispatchMessageW TranslateMessage GetMessageW SetParent IsWindowVisible SetWindowPos ShowWindow RegisterWindowMessageW LoadCursorW FindWindowW

gdi32

GetObjectA GetDIBits SetPixelFormat DeleteObject GetStockObject GetTextExtentPoint32W GetDeviceCaps CreateSolidBrush SwapBuffers CreateDIBSection CreateCompatibleBitmap DeleteDC CreateCompatibleDC ChoosePixelFormat SelectObject

advapi32

DeregisterEventSource ReportEventA RegisterEventSourceA LookupPrivilegeValueW DuplicateTokenEx AdjustTokenPrivileges QueryServiceStatus OpenServiceW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyW RegCloseKey OpenSCManagerW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegGetValueW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt CryptDecrypt CryptContextAddRef RegEnumKeyExA RegOpenKeyExA RegQueryValueExA OpenProcessToken GetTokenInformation CloseServiceHandle RegEnumValueW

shell32

ShellExecuteExW SHCreateDirectoryExA SHCreateDirectoryExW SHGetSpecialFolderPathW SHGetFolderPathA ShellExecuteW SHGetFolderPathW DragQueryFileW DragFinish SHChangeNotify ord165

ole32

CoCreateInstance CoTaskMemRealloc RevokeDragDrop RegisterDragDrop ReleaseStgMedium CoUninitialize CoTaskMemFree CoTaskMemAlloc CoCreateGuid StringFromGUID2 CoInitialize DoDragDrop CoSetProxyBlanket CoInitializeSecurity CoInitializeEx

oleaut32

VarUI4FromStr VariantInit VariantClear SysFreeString SysAllocString SysAllocStringLen

shlwapi

StrStrIW AssocQueryStringW StrTrimA PathFindFileNameW StrCmpIW StrTrimW PathFileExistsA PathCombineA PathIsDirectoryW PathFindFileNameA PathFindExtensionW PathFindExtensionA PathCompactPathW PathCombineW SHGetValueW PathRemoveFileSpecW StrStrIA PathFileExistsW PathCanonicalizeW PathAppendW PathAppendA PathIsRelativeW StrCmpNIW PathIsRootW SHSetValueA SHGetValueA StrToIntExW

opengl32

glBegin glBindTexture glBlendFunc glClear glClearColor glColor3f glColor4f glDeleteTextures glDisable glDrawArrays glEnable glEnd glGenTextures glHint glInterleavedArrays glLineWidth wglMakeCurrent wglDeleteContext wglCreateContext glViewport glVertex2i glVertex2f glTexSubImage2D glTexParameteri glTexImage2D glTexEnvf glRotatef glPushMatrix glPushAttrib glPopMatrix glPopAttrib glPixelStorei glOrtho glMatrixMode glLoadIdentity

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

libcef

cef_string_utf8_to_utf16 cef_string_utf16_clear cef_string_utf8_clear cef_string_utf16_to_utf8 cef_string_utf16_set cef_string_utf16_cmp cef_get_current_platform_thread_id cef_get_min_log_level cef_time_delta cef_time_now cef_string_utf16_to_lower cef_string_userfree_utf16_free cef_string_list_alloc cef_string_list_free cef_visit_web_plugin_info cef_refresh_web_plugins cef_unregister_internal_web_plugin cef_register_web_plugin_crash cef_is_web_plugin_unstable cef_register_widevine_cdm cef_currently_on cef_post_task cef_post_delayed_task cef_register_extension cef_register_scheme_handler_factory cef_clear_scheme_handler_factories cef_execute_process cef_initialize cef_shutdown cef_do_message_loop_work cef_run_message_loop cef_quit_message_loop cef_set_osmodal_loop cef_enable_highdpi_support cef_crash_reporting_enabled cef_set_crash_key_value cef_create_directory cef_get_temp_directory cef_create_new_temp_directory cef_create_temp_directory_in_directory cef_directory_exists cef_delete_file cef_zip_directory cef_load_crlsets_file cef_add_cross_origin_whitelist_entry cef_remove_cross_origin_whitelist_entry cef_clear_cross_origin_whitelist cef_parse_url cef_create_url cef_format_url_for_security_display cef_get_mime_type cef_get_extensions_for_mime_type cef_base64encode cef_base64decode cef_uriencode cef_uridecode cef_parse_json cef_parse_jsonand_return_error cef_write_json cef_get_path cef_launch_process cef_is_cert_status_error cef_is_cert_status_minor_error cef_begin_tracing cef_end_tracing cef_now_from_system_trace_time cef_time_from_timet cef_api_hash cef_browser_host_create_browser cef_browser_host_create_browser_sync cef_log cef_string_wide_to_utf8 cef_string_map_alloc cef_string_map_free cef_command_line_create cef_command_line_get_global cef_cookie_manager_get_global_manager cef_cookie_manager_get_blocking_manager cef_cookie_manager_create_manager cef_image_create cef_stream_writer_create_for_file cef_stream_writer_create_for_handler cef_drag_data_create cef_request_context_get_global_context cef_request_context_create_context cef_create_context_shared cef_process_message_create cef_menu_model_create cef_menu_button_create cef_panel_create cef_browser_view_create cef_browser_view_get_for_browser cef_label_button_create cef_textfield_create cef_window_create_top_level cef_v8value_create_undefined cef_v8value_create_null cef_v8value_create_bool cef_v8value_create_int cef_v8value_create_uint cef_v8value_create_double cef_v8value_create_date cef_v8value_create_string cef_v8value_create_object cef_v8value_create_array cef_v8value_create_array_buffer cef_v8value_create_function cef_v8context_get_current_context cef_v8context_get_entered_context cef_v8context_in_context cef_stream_reader_create_for_file cef_stream_reader_create_for_data cef_stream_reader_create_for_handler cef_binary_value_create cef_value_create cef_string_list_size cef_string_list_value cef_string_list_append cef_string_map_size cef_string_map_key cef_string_map_value cef_string_map_append cef_string_multimap_size cef_string_multimap_key cef_string_multimap_value cef_string_multimap_append cef_dictionary_value_create cef_list_value_create cef_scroll_view_create cef_display_get_primary cef_display_get_nearest_point cef_display_get_matching_bounds cef_display_get_count cef_display_get_alls cef_task_runner_get_for_current_thread cef_task_runner_get_for_thread cef_string_multimap_alloc cef_string_multimap_free cef_request_create cef_zip_reader_create cef_v8stack_trace_get_current cef_response_create cef_post_data_create cef_print_settings_create cef_post_data_element_create cef_execute_java_script_with_user_gesture_for_tests cef_time_to_timet

crypt32

CryptBinaryToStringA CryptStringToBinaryW CryptStringToBinaryA CryptBinaryToStringW CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

568KB

Virtual Size

567KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

35KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.upx0

Size

970KB

Virtual Size

970KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

564KB

Virtual Size

568KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=23, id=259, version=30795,

count=216, id=261, version=30795,

count=135, id=261, version=27045,

count=1, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=7, id=261, version=27031,

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=9, productName=Unmarked objects (old),

count=236, id=264, version=27051,

count=12, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=261, version=27032,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=36, id=260, version=26706,

count=134, id=261, version=26706,

count=33, id=260, version=30795,

count=35, id=257, version=30795,

count=641, id=1, productName=Unmarked objects,

count=99, id=261, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,