99446258d2f7785f54da74d6c072af893b0183c3d1e95af19075126bba2dedc3

Sharing

Copy URL Twitter E-mail

General

Target
99446258d2f7785f54da74d6c072af893b0183c3d1e95af19075126bba2dedc3
Size 2.0MB
Sample261027-khvlasswhy
SHA256 99446258d2f7785f54da74d6c072af893b0183c3d1e95af19075126bba2dedc3
MD5 0afbc0ae9f23cd0e641dd7ed42d6ba58
SHA1 a844fd92bd6d495100c7761ed2dec4274a7bd353
SHA512 a062ea7d12f93e08d9abc6862ca1f3e69b56d64ea73d4b39b3d1888a9d271c353efe9d3adbef670bc653ba5431ff7e842f69f71529de9e6d1788c92ad33d660c
SSDEEP 49152:75yJkhq8wSY6Y+5YbSTXS8J+Orydl237qbHoNS8puurXq2VhIa:7r/5YjgzAsqbglga9VhD
TLSH
T140A5CF217686C033CD6211F25A3CEBAE409DBE304B6651D7A3D8176E5D608D36F39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99446258d2f7785f54da74d6c072af893b0183c3d1e95af19075126bba2dedc3

File Explorer

99446258d2f7785f54da74d6c072af893b0183c3d1e95af19075126bba2dedc3

.exe 2.0MB

99446258d2f7785f54da74d6c072af893b0183c3d1e95af19075126bba2dedc3

IMPHASH a755cb4ea503d1ee23bf84ab0989f696
SHA256 99446258d2f7785f54da74d6c072af893b0183c3d1e95af19075126bba2dedc3
MD5 0afbc0ae9f23cd0e641dd7ed42d6ba58
SHA1 a844fd92bd6d495100c7761ed2dec4274a7bd353
SHA512 a062ea7d12f93e08d9abc6862ca1f3e69b56d64ea73d4b39b3d1888a9d271c353efe9d3adbef670bc653ba5431ff7e842f69f71529de9e6d1788c92ad33d660c
SSDEEP 49152:75yJkhq8wSY6Y+5YbSTXS8J+Orydl237qbHoNS8puurXq2VhIa:7r/5YjgzAsqbglga9VhD
TLSH
T140A5CF217686C033CD6211F25A3CEBAE409DBE304B6651D7A3D8176E5D608D36F39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

443644

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\largeclean-DumpUper\DumpUpper\Haokan_Release\DumpUper.pdb

kernel32

FormatMessageW SetFilePointer LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache GetFileSizeEx MulDiv GlobalFree GlobalUnlock GlobalLock GlobalAlloc Process32NextW Process32FirstW CreateToolhelp32Snapshot GetVersionExW CreateFileW CreateDirectoryW GetTempPathW OutputDebugStringW CloseHandle ReadProcessMemory TerminateProcess OpenProcess MultiByteToWideChar GetModuleFileNameW LoadLibraryExW lstrcmpiW InterlockedDecrement InterlockedIncrement DecodePointer LocalFree DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection SetLastError GetCurrentThreadId RaiseException TlsAlloc WritePrivateProfileStringW GetPrivateProfileStringW FindResourceExW OutputDebugStringA SetEnvironmentVariableW GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA LockResource TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime InitializeCriticalSection GetTempFileNameW FlushFileBuffers ReadFile WriteFile GetFileSize GetCurrentProcessId FindNextFileW FindFirstFileW DeleteFileW GetCommandLineW CreateEventW FindResourceW GetModuleHandleExW GetModuleHandleW LoadLibraryW SizeofResource LoadResource GetLastError GetCurrentProcess GetProcessHeap InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead WriteConsoleW SetEndOfFile SetStdHandle SetConsoleCtrlHandler ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale EncodePointer IsDebuggerPresent SetEnvironmentVariableA SwitchToThread CompareStringW LCMapStringW GetLocaleInfoW WideCharToMultiByte HeapSize HeapFree HeapReAlloc HeapAlloc GetTimeFormatW HeapDestroy GetProcAddress FreeLibrary GetDateFormatW GetCurrentThread FreeLibraryAndExitThread ResumeThread ExitThread CreateThread GetACP GetStdHandle GetModuleFileNameA FindClose ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType InterlockedFlushSList RtlUnwind CreateProcessW lstrlenW GetExitCodeProcess LocalAlloc GetLocalTime QueryPerformanceCounter GetStartupInfoW WaitForSingleObjectEx ResetEvent SetEvent SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemWindowsDirectoryW FreeResource Sleep InterlockedCompareExchange CreateFileA GetSystemDirectoryW lstrcmpiA lstrcmpA DeviceIoControl CreateMutexW WaitForSingleObject GetCPInfo ReleaseMutex GetTickCount

user32

GetMonitorInfoW GetForegroundWindow SendMessageW PostMessageW WindowFromPoint GetDesktopWindow WaitForInputIdle UnregisterClassA DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW GetWindowLongW SetWindowLongW LoadCursorW GetMessageW TranslateMessage DispatchMessageW PeekMessageW DestroyWindow CharNextW InvalidateRect wsprintfW SetTimer KillTimer GetDC ReleaseDC IsWindow SetRect OffsetRect PtInRect CopyRect SetCursor DrawFocusRect BeginPaint EndPaint IsRectEmpty PostQuitMessage ShowWindow MoveWindow SetWindowPos SetFocus MonitorFromPoint SetWindowTextW GetWindowTextW GetWindowTextLengthW GetClientRect GetWindowRect MapWindowPoints GetParent GetWindow GetShellWindow SystemParametersInfoW SetWindowRgn IsWindowVisible UpdateLayeredWindow GetAncestor GetWindowInfo GetWindowThreadProcessId EnumDisplaySettingsW MonitorFromWindow

gdi32

CreateRectRgn CombineRgn SetViewportOrgEx CreateCompatibleDC CreateCompatibleBitmap BitBlt ExtTextOutW SetBkColor DeleteDC SelectObject GetTextExtentPoint32W GetDeviceCaps CreateFontIndirectW EnumFontFamiliesW DeleteObject CreateFontW

advapi32

ChangeServiceConfigW StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceLockStatusW QueryServiceConfig2W QueryServiceConfigW OpenServiceW OpenSCManagerW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt CryptDecrypt CryptContextAddRef RegEnumKeyExA RegOpenKeyExA RegQueryValueExA OpenProcessToken GetTokenInformation RegQueryValueExW SetTokenInformation AdjustTokenPrivileges CreateWellKnownSid GetLengthSid LookupPrivilegeValueW DuplicateTokenEx LockServiceDatabase ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService UnlockServiceDatabase

shell32

SHGetSpecialFolderPathW ShellExecuteExW ShellExecuteW CommandLineToArgvW ord165

ole32

CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateGuid CoCreateInstance CoInitialize

oleaut32

SysFreeString VariantClear VariantInit SysAllocString VarUI4FromStr

shlwapi

wnsprintfW PathCombineW PathFindFileNameW PathFileExistsW PathRemoveFileSpecW StrCmpW PathRenameExtensionW StrCmpIW StrStrIA StrStrIW StrToIntExW SHGetValueA SHSetValueA StrCmpNIW StrTrimA SHGetValueW AssocQueryStringW PathAppendW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipCreateSolidFill GdipDrawImagePointRectI GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageRectRect GdipDrawImageRectRectI GdipCloneBrush GdipDeleteBrush GdipCreateBitmapFromFile GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipSetTextRenderingHint GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipDeleteStringFormat GdipCreateStringFormat GdipMeasureString

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

psapi

GetModuleFileNameExW

dbghelp

MakeSureDirectoryPathExists

crypt32

CryptBinaryToStringA CryptBinaryToStringW CryptStringToBinaryW CryptStringToBinaryA CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

iphlpapi

GetAdaptersInfo

generic

count=17, id=241, version=40116,

count=166, id=243, version=40116,

count=30, id=242, version=40116,

count=1, id=199, version=41118,

count=24, id=259, version=26706,

count=2, id=264, version=27045,

count=1, productName=Unmarked objects (old),

count=6, id=261, version=27048,

count=4, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=1, id=261, version=27031,

count=35, id=260, version=26706,

count=9, id=261, version=27051,

count=70, id=261, version=26706,

count=8, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=366, id=1, productName=Unmarked objects,

count=1, id=260, version=27045,

count=39, id=261, version=27045,

count=1, id=255, version=27045,

count=1, id=151,

count=1, id=258, version=27045,