13e10baea2739a718a1649913f0da9a78454eb7656473f897efb42d6106ed8cb

Sharing

Copy URL Twitter E-mail

General

Target
13e10baea2739a718a1649913f0da9a78454eb7656473f897efb42d6106ed8cb
Size 3.4MB
Sample261030-jasajaav2t
SHA256 13e10baea2739a718a1649913f0da9a78454eb7656473f897efb42d6106ed8cb
MD5 60fc13e9994b2b982a0d0909364572b8
SHA1 3d9c4dc2ff918731b4b6cfab697f040b8e9b0f0d
SHA512 360a67f526751a8faedfc1fb9f9fad173cd2b387c766f66d79afc62540f690a2052f02a4f7aec35849c76831bf5c2503eff83bb09ea926eabd280123919c949c
SSDEEP 49152:L8WslwOsn16hO92ZbI13GpRw5wF3rXNmGXDmg27RnWGjusUH7yXUv7SiRbvX/sMm:Lv2bI1SBmqD527BWGan7MUv73R7dm
TLSH
T139F5D01BA7A412E8E1B3C17DC9574A47EBB2BC151731D7CF02A446D61F232E14EBA722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13e10baea2739a718a1649913f0da9a78454eb7656473f897efb42d6106ed8cb

File Explorer

13e10baea2739a718a1649913f0da9a78454eb7656473f897efb42d6106ed8cb

.exe 3.4MB

13e10baea2739a718a1649913f0da9a78454eb7656473f897efb42d6106ed8cb

IMPHASH cd13eca80fc28b00e0054d78cdd9694e
SHA256 13e10baea2739a718a1649913f0da9a78454eb7656473f897efb42d6106ed8cb
MD5 60fc13e9994b2b982a0d0909364572b8
SHA1 3d9c4dc2ff918731b4b6cfab697f040b8e9b0f0d
SHA512 360a67f526751a8faedfc1fb9f9fad173cd2b387c766f66d79afc62540f690a2052f02a4f7aec35849c76831bf5c2503eff83bb09ea926eabd280123919c949c
SSDEEP 49152:L8WslwOsn16hO92ZbI13GpRw5wF3rXNmGXDmg27RnWGjusUH7yXUv7SiRbvX/sMm:Lv2bI1SBmqD527BWGan7MUv73R7dm
TLSH
T139F5D01BA7A412E8E1B3C17DC9574A47EBB2BC151731D7CF02A446D61F232E14EBA722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1000048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\A147\installer\Build\x64\UnicodeRelease\SamanUninstaller\SamanUninstaller.pdb

kernel32

WaitForMultipleObjects GetExitCodeProcess SetDllDirectoryW GetUserDefaultUILanguage HeapAlloc GetProcessHeap DuplicateHandle TerminateThread LoadLibraryExA VirtualQuery GetSystemInfo WriteConsoleW SetEndOfFile HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler GetFileSizeEx GetConsoleOutputCP FlushFileBuffers SetFilePointerEx ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetTempPathW HeapReAlloc HeapFree GetCurrentThread CreateEventW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread GetTimeZoneInformation GetFileType SetStdHandle GetCommandLineW GetCommandLineA FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader RaiseException OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo CompareStringEx GetStringTypeW LCMapStringEx EncodePointer GetLocaleInfoEx LeaveCriticalSection EnterCriticalSection FormatMessageA WaitForSingleObject K32GetProcessImageFileNameW K32GetModuleFileNameExW K32EnumProcessModules Process32NextW Process32FirstW CreateToolhelp32Snapshot AllocConsole VerifyVersionInfoW GetVersionExW GetSystemDirectoryW GetCurrentThreadId TerminateProcess GetCurrentProcess CreateMutexW SetFileAttributesW QueryDosDeviceW GetLogicalDriveStringsW GetFinalPathNameByHandleW GetDiskFreeSpaceExW FindNextFileW FindFirstFileW FindClose GetEnvironmentVariableW GetStdHandle VerSetConditionMask lstrcmpiW lstrcpyW lstrcpynW GetLocalTime GlobalFree DeleteFileW CreateFileA GlobalAlloc LockResource SizeofResource FreeResource LoadResource FindResourceW SystemTimeToFileTime LocalFileTimeToFileTime GetFileAttributesW SetFilePointer SetFileTime WriteFile CreateDirectoryW LocalFree FormatMessageW InitializeCriticalSectionAndSpinCount ExitProcess GlobalUnlock GlobalLock CloseHandle ReadFile GetFileSize CreateFileW lstrlenW GetTickCount WideCharToMultiByte GetCurrentDirectoryW GetModuleFileNameW OpenProcess MulDiv GetProcAddress LoadLibraryW GetACP MultiByteToWideChar LoadLibraryExW MoveFileW CopyFileW Sleep DeleteCriticalSection InitializeCriticalSectionEx DecodePointer RemoveDirectoryW SetCurrentDirectoryW MoveFileExW GetModuleHandleW GetCurrentProcessId GetLastError GetModuleHandleExW RtlUnwind

user32

GetKeyboardLayout GetKeyNameTextW GetShellWindow SetFocus SetWindowTextW GetWindowRect MapVirtualKeyExW InflateRect UnionRect SetCursor LoadCursorW MonitorFromPoint MonitorFromWindow EnumWindows GetWindowThreadProcessId EnumChildWindows PostQuitMessage UnregisterClassW TrackPopupMenu EnableMenuItem AppendMenuW CreatePopupMenu MessageBoxW SetForegroundWindow DestroyMenu IsWindowEnabled UpdateWindow EqualRect GetWindowTextLengthW GetWindowTextW InvalidateRgn CreateAcceleratorTableW GetGUIThreadInfo OffsetRect DrawTextA GetCaretBlinkTime ClientToScreen SetCaretPos GetCaretPos HideCaret ShowCaret CreateCaret CharPrevW SetRect DrawTextW FillRect GetWindowRgn UpdateLayeredWindow SetWindowRgn MoveWindow GetMenu AdjustWindowRectEx GetPropW SetPropW CallWindowProcW GetWindowLongPtrW RegisterClassExW GetClassInfoExW RegisterClassW GetSystemMetrics EnableWindow ShowWindow SetWindowLongPtrW DefWindowProcW LoadImageW GetParent PostMessageW SetCapture KillTimer SetTimer GetFocus IsZoomed DispatchMessageW TranslateMessage GetMessageW InvalidateRect GetSysColor ReleaseCapture PtInRect GetCursorPos CreateWindowExW GetMonitorInfoW MapWindowPoints IntersectRect IsWindowVisible IsWindow IsRectEmpty GetUpdateRect EndPaint BeginPaint GetWindow GetActiveWindow IsIconic SetWindowLongW GetWindowLongW SetWindowPos GetClientRect DestroyWindow CharNextW GetKeyState ScreenToClient SendMessageW RegisterWindowMessageW ReleaseDC GetDC

gdi32

StretchBlt CombineRgn ExtSelectClipRgn CreateRectRgnIndirect GetClipBox SelectClipRgn PtInRegion CreateRectRgn CreateDIBSection CreateRoundRectRgn PlayEnhMetaFile CreateCompatibleBitmap GetEnhMetaFileHeader CreateDIBitmap AddFontMemResourceEx CreateDCA CloseEnhMetaFile CreateEnhMetaFileW SetWindowOrgEx Rectangle RestoreDC BitBlt SaveDC SelectObject CreateCompatibleDC RemoveFontMemResourceEx DeleteObject CreatePen CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps SelectPalette RealizePalette GetDIBits GetCurrentObject SetStretchBltMode CreateSolidBrush CreatePenIndirect MoveToEx LineTo GetObjectA SetBkMode SetTextColor SetBkColor GetCharABCWidthsW GetTextExtentPoint32W TextOutW GdiFlush EnumFontFamiliesExW CreatePatternBrush GetTextExtentPointA GetBitmapBits SetBitmapBits GetTextMetricsW DeleteDC

advapi32

CheckTokenMembership RegDeleteKeyExW RegDeleteValueW RegEnumValueW GetUserNameW RegSetValueExW LookupPrivilegeValueW GetTokenInformation FreeSid EqualSid DuplicateTokenEx RegCloseKey AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken RegDeleteTreeW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW

shell32

SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHCreateDirectoryExW DragQueryFileW SHChangeNotify ShellExecuteW

ole32

CoInitializeSecurity CoTaskMemFree CoTaskMemAlloc CoCreateGuid CLSIDFromProgID CLSIDFromString OleLockRunning CreateStreamOnHGlobal ReleaseStgMedium RegisterDragDrop DoDragDrop CoCreateInstance OleDuplicateData CoInitialize CoUninitialize StringFromGUID2

oleaut32

SysAllocString SysFreeString VariantClear VariantChangeType SetErrorInfo CreateErrorInfo GetErrorInfo VariantInit

comctl32

_TrackMouseEvent InitCommonControlsEx ord17

shlwapi

SHGetValueW PathIsDirectoryW PathFindExtensionW PathFindFileNameW SHDeleteKeyW SHDeleteValueW SHSetValueW PathIsRelativeW StrChrW StrStrIW PathFileExistsW PathIsNetworkPathW

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

451KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

13e10baea2739a718a1649913f0da9a78454eb7656473f897efb42d6106ed8cb

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

generic