TgWsProxyPlus-windows-x86_64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
TgWsProxyPlus-windows-x86_64.exe
Size 1.2MB
Sample261027-s8shmae16r
SHA256 4a06d0524d7952af58157e8cb774a717086e65987da2b723c7a6c3d453134e4e
MD5 c453db5db7e31f19f3c985d9c2ea379d
SHA1 c124d2886cdc4636b0b7dc46bf28bb1503dc956f
SHA512 aa28c950d58b9035477cfb0d0878b40dbf491c5c7baa40a28da96531b5528b977707c8664691c061dfc4080eb79e13f86baed91c4a459ae5df5390679650850f
SSDEEP 24576:Hsj3OniK0KM9fe7y0d8No742ilvPtdJsEsi+W:HY36iK0KM9fvC49lvFDsti+W
TLSH
T195456C03E69581F9C09EC078C3569637EE72B88A4735B5EF0BD40A113E67BA06F2D749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TgWsProxyPlus-windows-x86_64.exe

File Explorer

TgWsProxyPlus-windows-x86_64.exe

.exe 1.2MB

TgWsProxyPlus-windows-x86_64.exe

IMPHASH 708b2e59e2edf2a513b0a8c3d6054b8b
SHA256 4a06d0524d7952af58157e8cb774a717086e65987da2b723c7a6c3d453134e4e
MD5 c453db5db7e31f19f3c985d9c2ea379d
SHA1 c124d2886cdc4636b0b7dc46bf28bb1503dc956f
SHA512 aa28c950d58b9035477cfb0d0878b40dbf491c5c7baa40a28da96531b5528b977707c8664691c061dfc4080eb79e13f86baed91c4a459ae5df5390679650850f
SSDEEP 24576:Hsj3OniK0KM9fe7y0d8No742ilvPtdJsEsi+W:HY36iK0KM9fvC49lvFDsti+W
TLSH
T195456C03E69581F9C09EC078C3569637EE72B88A4735B5EF0BD40A113E67BA06F2D749
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

857584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

TgWsProxyPlus.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

kernel32

GlobalFree CompareStringW LoadLibraryExW VirtualProtect LCMapStringW GetStringTypeW GetFileType SetStdHandle SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCPInfo SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx GetOEMCP GetACP IsValidCodePage FindNextFileW CreateIoCompletionPort SetFileCompletionNotificationModes IsProcessorFeaturePresent SetFilePointerEx GetModuleHandleW CreateMutexW GetUserDefaultUILanguage CloseHandle WaitForSingleObject GetModuleHandleExW GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcess HeapSize GetCurrentProcessId CreateMutexA WideCharToMultiByte ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP FreeLibrary MultiByteToWideChar WriteConsoleW HeapAlloc TerminateProcess ReadFileEx SleepEx WriteFileEx WriteFile FlsFree FlsSetValue CreateThread GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx FlushFileBuffers GetSystemTimePreciseAsFileTime CreateDirectoryW ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW SetHandleInformation FlsGetValue DeleteFileW MoveFileExW FlsAlloc GetStartupInfoW GetSystemTimeAsFileTime GlobalUnlock GlobalLock AttachConsole SwitchToThread GetLastError GlobalAlloc lstrlenW DuplicateHandle PostQueuedCompletionStatus SetConsoleCtrlHandler SetEnvironmentVariableW RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA RtlPcToFileHeader DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RaiseException EncodePointer RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead RtlVirtualUnwind GetCurrentDirectoryW GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency GetEnvironmentVariableW AddVectoredExceptionHandler

ntdll

NtCreateNamedPipeFile NtWriteFile NtOpenFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile RtlNtStatusToDosError NtReadFile

user32

AppendMenuW CreatePopupMenu DestroyMenu SetClassLongPtrW SendMessageW CreateWindowExW IsDialogMessageW PostMessageW GetDpiForSystem RegisterClassW TranslateMessage TrackPopupMenu ShowWindow SetForegroundWindow DispatchMessageW GetMessageW SetProcessDpiAwarenessContext RegisterWindowMessageW SetWindowLongPtrW GetCursorPos DefWindowProcW GetSystemMetrics FillRect LoadImageW LoadCursorW GetClientRect PostQuitMessage GetWindowTextLengthW GetWindowTextW OpenClipboard EmptyClipboard SetClipboardData FindWindowW DestroyWindow DestroyIcon GetWindowLongPtrW SetWindowTextW MessageBoxW InvalidateRect GetDlgItem CloseClipboard

advapi32

RegSetValueExW RegCloseKey RegGetValueW RegDeleteValueW RegCreateKeyExW

gdi32

SetBkColor CreateSolidBrush CreateFontW DeleteObject SetTextColor

dwmapi

DwmSetWindowAttribute

shell32

ShellExecuteW Shell_NotifyIconW

uxtheme

SetWindowTheme

secur32

DecryptMessage FreeContextBuffer ApplyControlToken EncryptMessage AcquireCredentialsHandleA AcceptSecurityContext InitializeSecurityContextW QueryContextAttributesW FreeCredentialsHandle DeleteSecurityContext

ws2_32

listen accept WSAGetLastError WSASocketW ioctlsocket WSAIoctl closesocket WSACleanup getaddrinfo freeaddrinfo getsockname bind connect getsockopt WSAStartup WSASend shutdown send recv setsockopt

crypt32

CertAddCertificateContextToStore CertOpenStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertDuplicateStore CertFreeCertificateContext CertDuplicateCertificateContext CertFreeCertificateChain CertDuplicateCertificateChain CertEnumCertificatesInStore CertCloseStore

Name

.text

Size

907KB

Virtual Size

907KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

255KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

TgWsProxyPlus-windows-x86_64.exe

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

user32

advapi32

gdi32

dwmapi

shell32

uxtheme

secur32

ws2_32

crypt32

generic