272e0990b2c04e31d212bba257fec2829acae3b003dadea064cb85ba89138951

Sharing

Copy URL Twitter E-mail

General

Target
272e0990b2c04e31d212bba257fec2829acae3b003dadea064cb85ba89138951
Size 366KB
Sample261027-nktcss1s7q
SHA256 272e0990b2c04e31d212bba257fec2829acae3b003dadea064cb85ba89138951
MD5 b00bbb03c1bc179341bdece0ac4c948a
SHA1 1bfcb8783652dc32bcf8dd6270bac54ae8444de1
SHA512 765d4246faf0eeb373a4c7f46380f5dcd21778a612cea04c30cb8f7a716ec010e925c483386c0f1d2b3a1f9ceb35fc607742cb91ee3aa1aa2a9fa1bc3371870e
SSDEEP 6144:8l1QzsoQZr+zSJ+Q1rPB7wiKOpkK5W2xzCBLUWajLHMOvt7rpMNArD3:8MQ9reKU2BCBLUWa0OTMN+
TLSH
T19084922173E88A21F5F33F3468B846625F3A7C919E3CC19F1290956E2DB1A94DC74B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
272e0990b2c04e31d212bba257fec2829acae3b003dadea064cb85ba89138951

File Explorer

272e0990b2c04e31d212bba257fec2829acae3b003dadea064cb85ba89138951

.exe 366KB

272e0990b2c04e31d212bba257fec2829acae3b003dadea064cb85ba89138951

IMPHASH 5a7c310832cab5d107fd0b9789a65b85
SHA256 272e0990b2c04e31d212bba257fec2829acae3b003dadea064cb85ba89138951
MD5 b00bbb03c1bc179341bdece0ac4c948a
SHA1 1bfcb8783652dc32bcf8dd6270bac54ae8444de1
SHA512 765d4246faf0eeb373a4c7f46380f5dcd21778a612cea04c30cb8f7a716ec010e925c483386c0f1d2b3a1f9ceb35fc607742cb91ee3aa1aa2a9fa1bc3371870e
SSDEEP 6144:8l1QzsoQZr+zSJ+Q1rPB7wiKOpkK5W2xzCBLUWajLHMOvt7rpMNArD3:8MQ9reKU2BCBLUWa0OTMN+
TLSH
T19084922173E88A21F5F33F3468B846625F3A7C919E3CC19F1290956E2DB1A94DC74B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

87470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\work\nssm\out\Release\win32\nssm.pdb

psapi

GetModuleFileNameExW

shlwapi

PathQuoteSpacesW PathUnquoteSpacesW PathFindExtensionW

kernel32

SystemTimeToFileTime GetStdHandle GetCommandLineW TlsAlloc GetModuleFileNameW GetProcessTimes GetCurrentThread OpenProcess GenerateConsoleCtrlEvent SetConsoleCtrlHandler CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next SetCurrentDirectoryW GetCurrentDirectoryW GetWindowsDirectoryW InitializeCriticalSection DeleteCriticalSection SetWaitableTimer ResumeThread SetProcessAffinityMask CreateWaitableTimerW RegisterWaitForSingleObject UnregisterWait MultiByteToWideChar WideCharToMultiByte GetConsoleOutputCP SetConsoleOutputCP GetConsoleMode FileTimeToSystemTime GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetStdHandle GetStringTypeW GetFileType LCMapStringW CompareStringW GetACP GetCommandLineA GetModuleHandleExW ExitProcess RaiseException EncodePointer SetLastError CopyFileW MoveFileW GetSystemTime Sleep CreatePipe SetHandleInformation DuplicateHandle WriteFile SetFilePointerEx SetFilePointer SetEndOfFile ReadFile GetFileInformationByHandle FlushFileBuffers CreateFileW CompareFileTime LoadLibraryW GetProcAddress FreeLibrary GetSystemTimeAsFileTime GetExitCodeThread CreateThread GetExitCodeProcess WaitForSingleObject LeaveCriticalSection EnterCriticalSection CloseHandle GetProcessAffinityMask LoadResource FindResourceExW GetCurrentProcess GetEnvironmentVariableW GetUserDefaultLangID FormatMessageW LocalFree LocalAlloc GetModuleHandleW TlsSetValue TlsGetValue TerminateProcess ExpandEnvironmentStringsW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetConsoleWindow AllocConsole FreeConsole GetCurrentProcessId GetComputerNameW GetProcessHeap HeapFree HeapAlloc GetLastError HeapSize HeapReAlloc WriteConsoleW DecodePointer RtlUnwind GetConsoleCP LoadLibraryExW TlsFree SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId InitializeSListHead InitializeCriticalSectionAndSpinCount

user32

IsDialogMessageW LoadImageW GetDesktopWindow SetWindowLongW GetWindowLongW GetWindowRect GetSystemMetrics EnableWindow SetFocus SendDlgItemMessageW CheckRadioButton GetDlgItemTextW SetDlgItemTextW PostMessageW SetDlgItemInt GetDlgItem CreateDialogIndirectParamW SetWindowPos MoveWindow ShowWindow DestroyWindow PostQuitMessage SendMessageW DispatchMessageW TranslateMessage GetMessageW MessageBoxIndirectW MessageBoxW GetWindowThreadProcessId PostThreadMessageW EnumWindows GetDlgItemInt GetProcessWindowStation

comdlg32

GetOpenFileNameW

advapi32

SystemFunction036 StartServiceW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx QueryServiceStatus QueryServiceConfig2W QueryServiceConfigW OpenServiceW OpenSCManagerW GetServiceDisplayNameW GetServiceKeyNameW EnumServicesStatusExW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW DuplicateTokenEx OpenProcessToken CreateProcessAsUserW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegEnumValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW ImpersonateSelf AdjustTokenPrivileges OpenThreadToken StartServiceCtrlDispatcherW CheckTokenMembership AllocateAndInitializeSid RegDeleteValueW IsTextUnicode ReportEventW RegisterEventSourceW DeregisterEventSource LsaNtStatusToWinError LsaAddAccountRights LsaEnumerateAccountRights LsaLookupSids LsaLookupNames LsaOpenPolicy LsaClose LsaFreeMemory IsValidSid InitializeSid GetSidSubAuthorityCount GetSidSubAuthority GetSidLengthRequired GetSidIdentifierAuthority FreeSid

shell32

ShellExecuteExW

Sharing

General

Malware Config

Signatures

File Explorer

272e0990b2c04e31d212bba257fec2829acae3b003dadea064cb85ba89138951

psapi

shlwapi

kernel32

user32

comdlg32

advapi32

shell32

generic