SwiftTunnel-Setup-3[.]9[.]7[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SwiftTunnel-Setup-3.9.7.exe
Size 19.3MB
Sample261101-2kh4qade37
SHA256 8ee00507d493f44b28fb53a740e9c43d545105b6fa1d23bd8dfb3a317c9ca140
MD5 f842ea4821f26c27f66657313563b340
SHA1 ecfea5d119a47f512cd88444372cbd61e48f46f3
SHA512 ec3a52fd542869fcc9ca254f2e787212877f851c3d241806a59141d864d5519b1a8098411bbda55bbc99bdeab70f0314beb077f280c03493d1dcd2907e3d23ee
SSDEEP 393216:omz1YY2qyocX5dJLAa/3nBYxdVnWFTdK+sHYXRNtbSAnxaheKppIHH:oO1tBqM+3BYxvWddPqwRNtbUheVH
TLSH
T1781712137E4698ACD54ACC74827687625B2178EA0B21A9EF01C5663CFEF97F01B393D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SwiftTunnel-Setup-3.9.7.exe

File Explorer

SwiftTunnel-Setup-3.9.7.exe

.exe 19.3MB

SwiftTunnel-Setup-3.9.7.exe

IMPHASH 9efad00d9bce098a3af20f5f34d76004
SHA256 8ee00507d493f44b28fb53a740e9c43d545105b6fa1d23bd8dfb3a317c9ca140
MD5 f842ea4821f26c27f66657313563b340
SHA1 ecfea5d119a47f512cd88444372cbd61e48f46f3
SHA512 ec3a52fd542869fcc9ca254f2e787212877f851c3d241806a59141d864d5519b1a8098411bbda55bbc99bdeab70f0314beb077f280c03493d1dcd2907e3d23ee
SSDEEP 393216:omz1YY2qyocX5dJLAa/3nBYxdVnWFTdK+sHYXRNtbSAnxaheKppIHH:oO1tBqM+3BYxvWddPqwRNtbUheVH
TLSH
T1781712137E4698ACD54ACC74827687625B2178EA0B21A9EF01C5663CFEF97F01B393D4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1502156

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SwiftTunnel_Setup.pdb

msi

ord70 ord205 ord92 ord113 ord32 ord8 ord160 ord159 ord118

user32

DrawTextW SetWindowPos KillTimer PostQuitMessage ScreenToClient DefWindowProcW InvalidateRect SetTimer EndPaint GetClientRect MoveWindow SetWindowRgn EnableWindow GetWindowTextW SetWindowTextW PostMessageW SetProcessDpiAwarenessContext BeginPaint GetDpiForWindow LoadIconW GetWindowLongPtrW SetWindowLongPtrW MessageBoxW DestroyWindow DispatchMessageW TranslateMessage LoadCursorW RegisterClassW IsDialogMessageW GetMessageW ShowWindow SendMessageW GetDpiForSystem LoadImageW FillRect CreateWindowExW AdjustWindowRectExForDpi GetWindowRect

kernel32

ExitProcess SetFileTime GetCurrentThreadId GetFullPathNameW GetModuleHandleA SetHandleInformation WriteFileEx ReadFileEx GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle CreateFileW LocalFree FlushFileBuffers MoveFileExW DeleteFileW GetFileInformationByHandle GetSystemTimeAsFileTime IsProcessorFeaturePresent TerminateProcess CreateDirectoryW GetFileInformationByHandleEx TlsAlloc TlsGetValue LoadLibraryExA TlsFree FreeLibrary SleepEx GetProcAddress GetModuleFileNameW GetProcessHeap HeapAlloc LoadLibraryExW FlsFree FormatMessageW EncodePointer FlsSetValue IsThreadAFiber GetModuleHandleExW FlsAlloc ReleaseMutex CancelIoEx WriteFile SetFileCompletionNotificationModes CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus GetFinalPathNameByHandleW SetLastError GetQueuedCompletionStatusEx HeapReAlloc GetCurrentThread SetThreadStackGuarantee GetModuleHandleW GetExitCodeProcess WaitForSingleObject CreateMutexA GetSystemDirectoryW GetCurrentProcessId CreateThread GetLastError IsWow64Process2 GetCurrentProcess LoadLibraryA WaitForSingleObjectEx SwitchToThread CloseHandle TlsSetValue HeapFree SetFileInformationByHandle InitializeCriticalSectionAndSpinCount MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW RtlPcToFileHeader QueryPerformanceFrequency QueryPerformanceCounter RaiseException AddVectoredExceptionHandler DeleteCriticalSection CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetConsoleOutputCP GetConsoleMode GetStdHandle WideCharToMultiByte RtlVirtualUnwind lstrlenW RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead RtlUnwindEx

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

crypt32

CertAddCertificateContextToStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertCloseStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateChain CertFreeCertificateContext CertDuplicateCertificateContext CertDuplicateStore CertOpenStore

bcryptprimitives

ProcessPrng

ws2_32

closesocket recv ioctlsocket WSAIoctl bind getsockopt setsockopt WSAStartup getaddrinfo freeaddrinfo send WSASend WSASocketW connect getsockname WSAGetLastError getpeername shutdown

ntdll

NtDeviceIoControlFile NtCreateFile NtCancelIoFileEx NtWriteFile NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile NtReadFile

bcrypt

BCryptGenRandom

advapi32

EqualSid SystemFunction036 GetSecurityDescriptorOwner GetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorControl GetSecurityDescriptorDacl

secur32

ApplyControlToken FreeCredentialsHandle InitializeSecurityContextW AcquireCredentialsHandleA QueryContextAttributesW DeleteSecurityContext FreeContextBuffer EncryptMessage AcceptSecurityContext DecryptMessage

oleaut32

SysFreeString GetErrorInfo SysStringLen

gdiplus

GdipFillPath GdipDeleteBrush GdiplusStartup GdipFillRectangleI GdipCreateSolidFill GdipDisposeImage GdipDrawImageRectI GdipSetInterpolationMode GdipCreateBitmapFromScan0 GdipDrawLine GdipDeleteGraphics GdipDeletePath GdipDeletePen GdipDrawPath GdipCreatePen1 GdipSetSmoothingMode GdipCreateFromHDC GdipClosePathFigure GdipAddPathArc GdipCreatePath

gdi32

SaveDC SetViewportOrgEx RestoreDC GetStockObject CreateFontW DeleteObject CreateSolidBrush SelectObject CreateCompatibleBitmap CreateCompatibleDC AddFontMemResourceEx DeleteDC ExcludeClipRect IntersectClipRect CreateRoundRectRgn SetBkMode SetTextColor CreateDIBSection SetStretchBltMode SetBrushOrgEx StretchDIBits GdiFlush BitBlt SetTextCharacterExtra

dwmapi

DwmSetWindowAttribute

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

api-ms-win-crt-math-l1-1-0

roundf __setusermatherr ceil

api-ms-win-crt-string-l1-1-0

strcmp wcsncmp strcpy_s strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_cexit terminate __p___argv _register_thread_local_exe_atexit_callback __p___argc abort _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _configure_narrow_argv _set_app_type _seh_filter_exe _c_exit _crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc malloc _set_new_mode free