98ae25745d22b5b998d944b8095206037266dac18ea75917299ab18198061179

Sharing

Copy URL Twitter E-mail

General

Target
98ae25745d22b5b998d944b8095206037266dac18ea75917299ab18198061179
Size 2.3MB
Sample261030-jpbw4adh57
SHA256 98ae25745d22b5b998d944b8095206037266dac18ea75917299ab18198061179
MD5 a46c9c29bb0b711958f3139d2e210d70
SHA1 3aeed65f7cdd1acb90239d50d4f6b1899b7be6f7
SHA512 02897a9e1ce9136aa669b01fd544af42c22767947cc1de6e3f345bf4fd7cf6448167b68727d1556497fca4db805c7ba33442b55e0bc6881820f043f70adad7ad
SSDEEP 49152:fbPWFT0w8GSDGrGnyMv1lTLK6S5MOAakuSGH4FTkOL:TIx4dnyIa5VAoilL
TLSH
T1ECB5AF21B245C327E56201B0562D8EAF5158B9301BA558C7F3C84F2EB9F0DE39636F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
98ae25745d22b5b998d944b8095206037266dac18ea75917299ab18198061179

File Explorer

98ae25745d22b5b998d944b8095206037266dac18ea75917299ab18198061179

.exe 2.3MB

98ae25745d22b5b998d944b8095206037266dac18ea75917299ab18198061179

IMPHASH e363b785996278272a20225244a3145c
SHA256 98ae25745d22b5b998d944b8095206037266dac18ea75917299ab18198061179
MD5 a46c9c29bb0b711958f3139d2e210d70
SHA1 3aeed65f7cdd1acb90239d50d4f6b1899b7be6f7
SHA512 02897a9e1ce9136aa669b01fd544af42c22767947cc1de6e3f345bf4fd7cf6448167b68727d1556497fca4db805c7ba33442b55e0bc6881820f043f70adad7ad
SSDEEP 49152:fbPWFT0w8GSDGrGnyMv1lTLK6S5MOAakuSGH4FTkOL:TIx4dnyIa5VAoilL
TLSH
T1ECB5AF21B245C327E56201B0562D8EAF5158B9301BA558C7F3C84F2EB9F0DE39636F6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1021508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Work\rcimage\bin\Win32\Release\dbgsym\2345PicLoader.pdb

kernel32

GetFileAttributesW GetVersionExW LockResource GetSystemInfo LoadResource FindResourceW lstrcmpiW GetACP MultiByteToWideChar WideCharToMultiByte ExpandEnvironmentStringsW LoadLibraryA WaitForMultipleObjects LocalFree GetCurrentProcessId CreateProcessW GetExitCodeProcess GetTickCount InitializeCriticalSection FindFirstFileW FindNextFileW FindClose GetLongPathNameW CreateFileW GetFileAttributesExW HeapFree GlobalAlloc GlobalFree HeapAlloc GetProcessHeap GetLogicalDriveStringsW ReadFile WriteFile SetFileTime SetFilePointer SetEndOfFile GetFileSize GetFileTime FormatMessageW lstrlenW lstrcatW lstrcpyW DeleteFileW GetFileSizeEx CreateEventW SetEvent ResetEvent InterlockedExchangeAdd CreateDirectoryW GetFullPathNameW RemoveDirectoryW GetTempPathW SetFileAttributesW GetCurrentDirectoryW MoveFileExW CopyFileW GetTempFileNameW MoveFileW InterlockedExchange SystemTimeToFileTime GlobalMemoryStatusEx FileTimeToSystemTime IsBadStringPtrW GlobalLock SearchPathW SizeofResource OutputDebugStringW TerminateProcess ExitThread MapViewOfFile CreateFileMappingW UnmapViewOfFile DeviceIoControl LocalAlloc ResumeThread GetEnvironmentVariableW WriteConsoleW HeapSize SetStdHandle CreateThread SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW HeapReAlloc SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle GetModuleHandleExW ExitProcess GetTimeZoneInformation RtlUnwind OpenFileMappingW GetModuleHandleW GetModuleFileNameW GetCurrentProcess QueryDosDeviceW Sleep ReleaseMutex WaitForSingleObject CreateMutexW CloseHandle OpenProcess DeleteCriticalSection DecodePointer RaiseException GetLastError WritePrivateProfileStringW GetCurrentThreadId SetErrorMode LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection SetLastError FreeLibrary GetProcAddress LoadLibraryW GetFileType LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExW GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetPrivateProfileStringW GlobalUnlock GetStringTypeW EncodePointer GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceCounter FreeLibraryAndExitThread

user32

SetWindowPos GetDC DialogBoxParamW SetWindowLongW GetParent ReleaseDC PtInRect OffsetRect GetMonitorInfoW MonitorFromPoint GetClientRect SetWindowTextW InvalidateRect EndPaint BeginPaint KillTimer SetTimer GetDlgItem EndDialog SendMessageW SystemParametersInfoW GetWindowThreadProcessId GetSystemMetrics WindowFromPoint GetForegroundWindow GetDesktopWindow UnregisterClassW GetActiveWindow

gdi32

SetViewportOrgEx CreateCompatibleBitmap BitBlt SelectObject CreateCompatibleDC DeleteDC DeleteObject

advapi32

RegEnumKeyExW RegCreateKeyExW RegCloseKey GetUserNameW BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW RegCreateKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegOpenCurrentUser QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetFolderPathW SHChangeNotify SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal CoSetProxyBlanket CoTaskMemFree CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

VariantChangeType VariantClear VariantInit SysAllocString

shlwapi

SHDeleteKeyW

imm32

ImmDisableIME

wtsapi32

WTSQuerySessionInformationW

gdiplus

GdipAlloc GdipCreateSolidFill GdipCloneImage GdipGetImageHeight GdiplusStartup GdipDeleteBrush GdipDisposeImage GdipDrawImageRectRectI GdipGetImageWidth GdipDeleteGraphics GdipCloneBrush GdiplusShutdown GdipDrawImageRectI GdipCreateFromHDC GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFontFromLogfontW GdipSetTextRenderingHint GdipCreateBitmapFromStream GdipFree

generic

count=17, id=241, version=40116,

count=167, id=243, version=40116,

count=31, id=242, version=40116,

count=2, id=199, version=41118,

count=25, id=259, version=26706,

count=6, id=261, version=27054,

count=75, id=261, version=26706,

count=36, id=260, version=26706,

count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=346, id=1, productName=Unmarked objects,

count=54, id=261, version=27053,

count=1, productName=Unmarked objects (old),

count=1, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,

count=161, id=265, version=27053,

count=1, id=256, version=27053,

count=1, id=255, version=27053,

count=2, id=151,

count=1, id=258, version=27053,