974ae0f3119d2b61311eec4fb82126bacb818e182f37e46e149557b776dadda6

Sharing

Copy URL Twitter E-mail

General

Target
974ae0f3119d2b61311eec4fb82126bacb818e182f37e46e149557b776dadda6
Size 10.4MB
Sample261029-3fv36acf98
SHA256 974ae0f3119d2b61311eec4fb82126bacb818e182f37e46e149557b776dadda6
MD5 70680ef2b1f7de8a71c081fe4786e232
SHA1 58d6dd7259427c96fc597fae35ed8419a0e37001
SHA512 2522d7d62fcc9e2199d62d5d5c2e72a8697bc51b5281bc92016e1fcd78256c2bb43f94bb8a0ca95f53a303fefd2e73aff4c0ded89732725df9f7b7cdbf02ac9a
SSDEEP 196608:XvgKkAYsLQHTZWJtTifpgjUMtuCQOMXtvw3XgPdZuhuqfVxYR7gZi:XvgKkAY0TepgjH5ydv8XgChuKVxhi
TLSH
T1D3B613317B85C130F1A24171697E9B7A897DB93C5B3045CBA3C00E2E59707D2BA36B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
974ae0f3119d2b61311eec4fb82126bacb818e182f37e46e149557b776dadda6

File Explorer

974ae0f3119d2b61311eec4fb82126bacb818e182f37e46e149557b776dadda6

.exe 10.4MB

974ae0f3119d2b61311eec4fb82126bacb818e182f37e46e149557b776dadda6

IMPHASH ac7b85edeaea0a451f501ac339da7171
SHA256 974ae0f3119d2b61311eec4fb82126bacb818e182f37e46e149557b776dadda6
MD5 70680ef2b1f7de8a71c081fe4786e232
SHA1 58d6dd7259427c96fc597fae35ed8419a0e37001
SHA512 2522d7d62fcc9e2199d62d5d5c2e72a8697bc51b5281bc92016e1fcd78256c2bb43f94bb8a0ca95f53a303fefd2e73aff4c0ded89732725df9f7b7cdbf02ac9a
SSDEEP 196608:XvgKkAYsLQHTZWJtTifpgjUMtuCQOMXtvw3XgPdZuhuqfVxYR7gZi:XvgKkAY0TepgjH5ydv8XgChuKVxhi
TLSH
T1D3B613317B85C130F1A24171697E9B7A897DB93C5B3045CBA3C00E2E59707D2BA36B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

963112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\build\trunk14_en\package\install.pdb

kernel32

DeleteFileW CreateFileW LoadLibraryW CreateFileA WaitForMultipleObjects GetEnvironmentVariableA MoveFileExA SleepEx LoadLibraryA GetSystemDirectoryA FormatMessageW GetSystemDirectoryW DecodePointer GetProcAddress GetModuleHandleW FindResourceExW FindResourceW SizeofResource LockResource LoadResource FreeLibrary GetLastError RaiseException MultiByteToWideChar LocalFree GetTickCount WideCharToMultiByte LeaveCriticalSection EnterCriticalSection SetEvent CreateEventW InitializeCriticalSection DeleteCriticalSection ReadFile HeapDestroy HeapAlloc HeapFree HeapSize GetProcessHeap FindNextFileW FindClose RemoveDirectoryW MoveFileExW GetDiskFreeSpaceExW GetVolumeInformationW CreateProcessW GetExitCodeProcess OpenProcess K32EnumProcessModules K32GetModuleFileNameExW GetWindowsDirectoryW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW CopyFileW GetCurrentProcess DuplicateHandle Module32FirstW Module32NextW TerminateProcess GetPriorityClass GetSystemInfo GetVersionExW GetStartupInfoW GetLogicalDriveStringsW WritePrivateProfileStringW GetCommandLineW SetProcessWorkingSetSize FreeResource CreateMutexW GetCurrentProcessId Sleep GetUserDefaultUILanguage FindFirstFileW GetModuleFileNameW HeapReAlloc lstrcmpiW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage WaitForSingleObject SetStdHandle GetTimeZoneInformation ReadConsoleW SetLastError DeviceIoControl InitializeCriticalSectionEx GetDriveTypeW ResumeThread CloseHandle FormatMessageA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection GetCurrentThreadId InitOnceComplete InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle SetEndOfFile SetFilePointerEx AreFileApisANSI InitOnceBeginInitialize GetStringTypeW EncodePointer LCMapStringEx QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimeAsFileTime WaitForSingleObjectEx CompareStringEx GetCPInfo TerminateThread GetLocalTime OutputDebugStringW GetFileAttributesW GlobalLock GlobalUnlock GlobalAlloc GlobalFree WriteFile SetFilePointer GetStdHandle CreateThread GetFileSizeEx GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile GetACP ExitProcess GetCurrentDirectoryW GetPrivateProfileStringW MulDiv InitializeCriticalSectionAndSpinCount ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InitializeSListHead InterlockedDecrement InterlockedIncrement LocalAlloc GetModuleHandleA LoadLibraryExW GetModuleFileNameA VerifyVersionInfoW lstrcmpW ExpandEnvironmentStringsW GetFullPathNameW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread SetEnvironmentVariableW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteConsoleW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode FlushFileBuffers

user32

RegisterClassW FindWindowExW SetPropW GetPropW IsWindow wvsprintfW SetCursor UnionRect OffsetRect LoadCursorW wsprintfW GetMessageW TranslateMessage DispatchMessageW CallWindowProcW RegisterClassExW GetClassInfoExW SetFocus GetMenu AdjustWindowRectEx GetParent GetWindow LoadImageW IsZoomed SetWindowRgn ScreenToClient FillRect CharNextW GetActiveWindow GetFocus GetKeyState SetCapture BeginPaint GetUpdateRect InvalidateRect MapWindowPoints IntersectRect IsRectEmpty CharPrevW DrawTextW SetRect CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen GetSysColor GetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo MoveWindow GetDC GetMonitorInfoW MonitorFromWindow BringWindowToTop SetWindowPos ShowWindow PostMessageW GetDesktopWindow SetWindowTextW IsWindowVisible ReleaseCapture SetTimer KillTimer GetClassNameW EnumWindows ExitWindowsEx PostQuitMessage IsIconic SendMessageW PtInRect GetCursorPos GetClientRect ReleaseDC GetWindowLongW GetSystemMetrics DestroyWindow SetWindowLongW CreateWindowExW DefWindowProcW GetWindowRect EnableWindow SetForegroundWindow EndPaint

gdi32

GetTextMetricsW GdiFlush ExtTextOutW TextOutW GetDeviceCaps DeleteDC GetObjectW GetStockObject CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteObject CreateRoundRectRgn CreateSolidBrush CreateFontIndirectW CreatePen Rectangle RestoreDC SaveDC SetStretchBltMode CreatePatternBrush SetWindowOrgEx GetObjectA CreatePenIndirect CreateRectRgnIndirect GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo RoundRect SelectClipRgn ExtSelectClipRgn AddFontResourceExW RemoveFontResourceW MoveToEx SetBkColor SetBkMode StretchBlt SetTextColor CreateDIBSection

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam RegOpenKeyExW RegOpenKeyExA RegQueryValueExA CryptAcquireContextA CryptReleaseContext RegDeleteValueW RegOpenKeyW RegQueryValueExW RegCreateKeyW RegCloseKey RegCreateKeyExW RegSetValueExW GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW SetSecurityInfo SetEntriesInAclW OpenProcessToken DuplicateTokenEx

shell32

SHGetMalloc SHGetFolderPathW SHChangeNotify SHBrowseForFolderW SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteExW ord165 SHGetSpecialFolderPathW

ole32

CLSIDFromString CoInitialize CoSetProxyBlanket CoUninitialize CoInitializeSecurity CLSIDFromProgID OleLockRunning CoCreateGuid CoCreateInstance CreateStreamOnHGlobal CoTaskMemFree

gdiplus

GdipDeleteFontFamily GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI GdipCloneImage GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipGraphicsClear GdipDrawImage GdipDrawImageRectI GdipDisposeImage GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipGetFamily GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipLoadImageFromFile GdipLoadImageFromStream

shlwapi

PathFileExistsW PathAppendW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueA

msi

ord173 ord217

iphlpapi

GetAdaptersInfo

ntdll

VerSetConditionMask

comctl32

_TrackMouseEvent ord17

msimg32

AlphaBlend

d2d1

ord1

imm32

ImmReleaseContext ImmSetCompositionFontW ImmSetCompositionWindow ImmGetContext

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

wininet

InternetCloseHandle HttpQueryInfoW InternetReadFile HttpSendRequestW HttpOpenRequestW InternetOpenW InternetCrackUrlW InternetConnectW

ws2_32

connect getpeername getaddrinfo WSAWaitForMultipleEvents htons recv setsockopt socket WSAIoctl __WSAFDIsSet closesocket WSAStartup WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSAGetLastError ntohs WSASetLastError WSACleanup accept gethostname ioctlsocket sendto bind select recvfrom getsockname htonl listen WSAResetEvent freeaddrinfo WSACloseEvent getsockopt send

bcrypt

BCryptGenRandom

wldap32

ord200 ord30 ord143 ord301 ord35 ord33 ord32 ord27 ord79 ord22 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord26

crypt32

CertFreeCertificateContext CertFreeCertificateChain CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateChainEngine CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertGetCertificateChain

normaliz

IdnToUnicode IdnToAscii

generic

count=19, id=259, version=27412,

count=209, id=261, version=27412,

count=1, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=8, id=253, version=28518,

count=21, id=260, version=30034,

count=26, id=259, version=30034,

count=1, id=263, version=27412,

count=1, id=260, version=30159,

count=42, id=261, version=30159,

count=127, id=260, version=30157,

count=100, id=261, version=30034,

count=2, id=253, version=23601,

count=37, id=260, version=27412,

count=2, id=262, version=27412,

count=55, id=257, version=27412,

count=625, id=1, productName=Unmarked objects,

count=64, id=265, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,