6018c1f0342393516f9756ad16ddbe7d3e5e385d029ddb1730b4e466deab3c61

Sharing

Copy URL Twitter E-mail

General

Target
6018c1f0342393516f9756ad16ddbe7d3e5e385d029ddb1730b4e466deab3c61
Size 4.8MB
Sample261027-kc1kcsswev
SHA256 6018c1f0342393516f9756ad16ddbe7d3e5e385d029ddb1730b4e466deab3c61
MD5 6c07d96b5ca4a199ce491b4df8aed530
SHA1 28b9146c556976f3fa38ab1324a43900dc4d8dd9
SHA512 72b62a9167adf8112bd51e0b5886be75627d452199e4cfe8b7687eedda1cddefefa088e4db3bc7891b4099c5d76042634f95999d1318e2ac06f200f0936524ce
SSDEEP 98304:8Fg7tljONEIl2MwS4YlY1SK3/O/XOt3fF47YhWlrU+ACiBZUh8uqeDfa824qJqFi:s7wHusGq0FF0XQ
TLSH
T1DD36CF21BB07C136F4E285B1417C576B882DAF2B1764D4C7E2D419AA19B43C362FAE1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6018c1f0342393516f9756ad16ddbe7d3e5e385d029ddb1730b4e466deab3c61

File Explorer

6018c1f0342393516f9756ad16ddbe7d3e5e385d029ddb1730b4e466deab3c61

.exe 4.8MB

6018c1f0342393516f9756ad16ddbe7d3e5e385d029ddb1730b4e466deab3c61

IMPHASH f6a4a38be29de80ef6c239e1fdd1e303
SHA256 6018c1f0342393516f9756ad16ddbe7d3e5e385d029ddb1730b4e466deab3c61
MD5 6c07d96b5ca4a199ce491b4df8aed530
SHA1 28b9146c556976f3fa38ab1324a43900dc4d8dd9
SHA512 72b62a9167adf8112bd51e0b5886be75627d452199e4cfe8b7687eedda1cddefefa088e4db3bc7891b4099c5d76042634f95999d1318e2ac06f200f0936524ce
SSDEEP 98304:8Fg7tljONEIl2MwS4YlY1SK3/O/XOt3fF47YhWlrU+ACiBZUh8uqeDfa824qJqFi:s7wHusGq0FF0XQ
TLSH
T1DD36CF21BB07C136F4E285B1417C576B882DAF2B1764D4C7E2D419AA19B43C362FAE1F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1702493

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\docker\Documents\workspace\build-v2\common\hrappstore2\bin\HrAppStoreHive.pdb

kernel32

RaiseException DecodePointer FindResourceW SizeofResource LockResource LoadResource FindResourceExW InitializeCriticalSectionEx GetProcessHeap GetLastError HeapFree DeleteCriticalSection SetEvent Sleep GetCurrentProcess CreateNamedPipeW TerminateProcess GetCurrentThreadId GetProcAddress LoadLibraryW GetFileInformationByHandleEx CopyFileA MoveFileExA ConnectNamedPipe WaitNamedPipeW GetOverlappedResult WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindFirstFileExW DisconnectNamedPipe HeapSize SetFilePointerEx SetStdHandle GetOEMCP IsValidCodePage GetConsoleCP ReadConsoleW GetConsoleMode HeapReAlloc HeapAlloc HeapDestroy EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP GetTimeZoneInformation ExitThread GetFileType GetModuleHandleExW ExitProcess RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList GetStartupInfoW ReadFile EnterCriticalSection VirtualFree WriteFile VirtualAlloc GetModuleFileNameW WaitForMultipleObjects GetProcessId LeaveCriticalSection CreatePipe PeekNamedPipe WaitForSingleObject CreateFileW GetVersionExW OpenProcess CreateToolhelp32Snapshot CreateEventW MultiByteToWideChar Process32NextW GlobalAlloc DeleteFileW Process32FirstW GlobalFree CloseHandle GetNativeSystemInfo GetSystemInfo GetWindowsDirectoryW LocalFree WTSGetActiveConsoleSessionId GetFileSize GetCurrentProcessId CreateProcessW GetModuleHandleW FreeLibrary CopyFileW WideCharToMultiByte GetSystemTimeAsFileTime GetTickCount VirtualQuery GetExitCodeProcess GetFileSizeEx SetConsoleTextAttribute GetStdHandle GetPrivateProfileIntW GetTempPathW CreateMutexW ReleaseMutex OutputDebugStringW GetLocalTime MoveFileW QueryDosDeviceW FindFirstFileW SetLastError FindNextFileW DeviceIoControl K32GetModuleFileNameExW FindClose GetLogicalDriveStringsW GetPrivateProfileStringW lstrcatW MoveFileExW VerSetConditionMask GlobalMemoryStatusEx lstrcpyW VerifyVersionInfoW GetSystemTime lstrcmpiW InitializeCriticalSection ProcessIdToSessionId GetFullPathNameW GetFileAttributesW CreateFileA CreateDirectoryW ExpandEnvironmentStringsW RemoveDirectoryW SetFileAttributesW FileTimeToSystemTime CreateDirectoryA SetThreadPriority ResumeThread GetSystemFirmwareTable LoadLibraryExW GetLogicalDrives GetDiskFreeSpaceExW GetDriveTypeW FormatMessageW GetFileAttributesExW SystemTimeToFileTime SystemTimeToTzSpecificLocalTime SetFilePointer FlushFileBuffers AreFileApisANSI TryEnterCriticalSection HeapCreate GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile LoadLibraryA WaitForSingleObjectEx DeleteFileA HeapCompact UnlockFile CreateFileMappingA LockFileEx FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter CreateWaitableTimerW SetWaitableTimer OpenMutexW GetTickCount64 InitializeProcThreadAttributeList UpdateProcThreadAttribute IsProcessorFeaturePresent GetBinaryTypeW TerminateThread IsDebuggerPresent DuplicateHandle GetCurrentThread GetStringTypeW ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead SetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryA GetCurrentDirectoryW CreateTimerQueue SignalObjectAndWait SwitchToThread CreateThread GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList

user32

IsWindowVisible GetWindow GetWindowTextLengthW GetWindowThreadProcessId SendMessageW SetProcessDPIAware MonitorFromWindow MonitorFromPoint PostMessageW BringWindowToTop SetWindowPos GetFocus GetIconInfo wsprintfW KillTimer RegisterClassW CreateWindowExW GetDesktopWindow SetForegroundWindow ReleaseDC GetWindowTextW GetShellWindow PostThreadMessageW DispatchMessageW TranslateMessage IsWindow DestroyIcon AttachThreadInput GetForegroundWindow EnumWindows FindWindowW GetMessageW GetDC

ole32

CoInitializeSecurity CoInitialize CoCreateInstance CoReleaseServerProcess CoSetProxyBlanket CoAddRefServerProcess CoInitializeEx CoUninitialize

oleaut32

VariantInit VariantClear SysFreeString SysAllocString

libcrypto-3

RSA_public_encrypt RSA_size BIO_new BIO_ctrl SHA256_Update SHA256_Final RC4_set_key BIO_write AES_cbc_encrypt PEM_read_bio_RSA_PUBKEY BIO_free_all BIO_s_mem AES_set_encrypt_key BIO_set_flags RSA_free SHA256_Init RC4 AES_set_decrypt_key BIO_push BIO_new_mem_buf BIO_f_base64

shlwapi

PathIsDirectoryA PathAppendW PathIsDirectoryW PathFindExtensionW PathFileExistsW PathRemoveFileSpecW PathFindFileNameW PathRemoveExtensionW

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

wininet

InternetReadFile InternetGetConnectedStateExW HttpSendRequestW InternetAttemptConnect InternetQueryDataAvailable HttpAddRequestHeadersW InternetSetOptionW InternetConnectW InternetCloseHandle HttpSendRequestExW HttpEndRequestW HttpQueryInfoW InternetOpenW InternetWriteFile HttpOpenRequestW InternetQueryOptionW

gdiplus

GdipCreateBitmapFromScan0 GdipGetImageWidth GdipCreateBitmapFromHICON GdipSaveImageToFile GdipBitmapLockBits GdipFree GdipGetImagePixelFormat GdipDisposeImage GdipBitmapGetPixel GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdipBitmapSetPixel GdipAlloc GdipBitmapUnlockBits GdipCloneImage GdipGetImageHeight GdiplusShutdown GdiplusStartup GdipGetImageEncodersSize

dxgi

CreateDXGIFactory1

iphlpapi

GetAdaptersInfo GetAdaptersAddresses

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeExW GetFileVersionInfoExW GetFileVersionInfoSizeW

pdh

PdhGetFormattedCounterValue PdhAddCounterW PdhOpenQueryW PdhCollectQueryData

gdi32

DeleteObject GetObjectW GetDeviceCaps

advapi32

RegQueryValueExW DuplicateTokenEx OpenServiceW RegOpenKeyExW RegOpenKeyExA StartServiceW OpenProcessToken ControlService OpenSCManagerW RegQueryValueExA CloseServiceHandle QueryServiceStatus RegCloseKey InitializeSecurityDescriptor SetSecurityDescriptorDacl CreateProcessWithTokenW RegEnableReflectionKey RegOpenCurrentUser RegQueryInfoKeyW RegDeleteKeyW RegFlushKey RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegGetValueW RevertToSelf ImpersonateLoggedOnUser

shell32

SHGetFolderPathW ShellExecuteW SHGetSpecialFolderPathW SHCreateDirectoryExW ExtractIconExW ShellExecuteExW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc

libcurl

curl_easy_strerror curl_easy_cleanup curl_easy_perform curl_slist_append curl_slist_free_all curl_easy_getinfo curl_easy_init curl_easy_setopt

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1009KB

Virtual Size

1009KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=23, id=241, version=40116,

count=188, id=243, version=40116,

count=32, id=242, version=40116,

count=3, id=199, version=41118,

count=27, id=259, version=24123,

count=129, id=261, version=24123,

count=39, id=260, version=24123,

count=2, id=261, version=23013,

count=4, id=257, version=30145,

count=119, id=265, version=24215,

count=2, id=209, version=65501,

count=7, id=206, version=65501,

count=3, id=208, version=65501,

count=51, id=203, version=65501,

count=619, id=1, productName=Unmarked objects,

count=3, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=115, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,