f894e18590717d402493161b85cf141e50b74846c81a23e144488503c48fbb7b

Sharing

Copy URL Twitter E-mail

General

Target
f894e18590717d402493161b85cf141e50b74846c81a23e144488503c48fbb7b
Size 2.7MB
Sample261101-3ftkbsdf24
SHA256 f894e18590717d402493161b85cf141e50b74846c81a23e144488503c48fbb7b
MD5 fcc450216fb79574ebb822e7354e6071
SHA1 e7e7ed68e9c764477a78cdb1a9fad095902f17c3
SHA512 4a95027fa1108a2b07c1926a736a9bbf5f6d9103810cbfe2b147c6a49c37be2ffcbbe56f5082ea50215b860747048c4150d22d0fe4cf6faa9f1effda49402a94
SSDEEP 24576:H7a4+BIPJy60pkpPkZkBYZHqEwCxugAq6euGlqD672J8xPFZJwLgZ87z6jPVPvIZ:xQbCPkZTZHqEwCxlAq4qBPkgKWPV1r0
TLSH
T1ABD52912359A7320ECB2DAB11F7563C7861DFD217EA1D58A2E6871A8C6FDDCC7820316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f894e18590717d402493161b85cf141e50b74846c81a23e144488503c48fbb7b

File Explorer

f894e18590717d402493161b85cf141e50b74846c81a23e144488503c48fbb7b

.exe 2.7MB

f894e18590717d402493161b85cf141e50b74846c81a23e144488503c48fbb7b

IMPHASH b526c8d044a05117a3f852454b69bd6d
SHA256 f894e18590717d402493161b85cf141e50b74846c81a23e144488503c48fbb7b
MD5 fcc450216fb79574ebb822e7354e6071
SHA1 e7e7ed68e9c764477a78cdb1a9fad095902f17c3
SHA512 4a95027fa1108a2b07c1926a736a9bbf5f6d9103810cbfe2b147c6a49c37be2ffcbbe56f5082ea50215b860747048c4150d22d0fe4cf6faa9f1effda49402a94
SSDEEP 24576:H7a4+BIPJy60pkpPkZkBYZHqEwCxugAq6euGlqD672J8xPFZJwLgZ87z6jPVPvIZ:xQbCPkZTZHqEwCxlAq4qBPkgKWPV1r0
TLSH
T1ABD52912359A7320ECB2DAB11F7563C7861DFD217EA1D58A2E6871A8C6FDDCC7820316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

274424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\jenkins\workspace\A_MB4_MBSetup\bin\Win32\Release\MBSetup.pdb

kernel32

IsValidCodePage HeapReAlloc GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetACP HeapAlloc HeapFree WriteFile GetStdHandle ExitProcess GetModuleHandleExW ExitThread RtlUnwind LoadLibraryW UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile LockResource LoadResource SizeofResource FindResourceExW FindNextFileW OutputDebugStringW OpenProcess GetCurrentProcess GetLogicalDrives CreateProcessW FindClose GetWindowsDirectoryW GetDiskFreeSpaceExW GetCommandLineW GetNativeSystemInfo CreateMutexW GetModuleFileNameW FindFirstFileW GetSystemDirectoryW GetProcAddress GetModuleHandleW CloseHandle MulDiv VerifyVersionInfoW VerSetConditionMask FormatMessageW DecodePointer DeleteCriticalSection InitializeCriticalSectionEx RaiseException LocalFree LocalAlloc GlobalFree GetLastError GetFileType Sleep ReleaseSemaphore VirtualFree VirtualProtect VirtualAlloc GetVersionExW LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread FreeLibrary GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait SetEvent CreateTimerQueue InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WideCharToMultiByte MultiByteToWideChar CreateDirectoryW CreateFileW DeleteFileW FindFirstFileExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle RemoveDirectoryW GetTempPathW AreFileApisANSI SetLastError CopyFileW GetStringTypeW QueryPerformanceCounter DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetCurrentThreadId EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo

user32

SetWindowPos GetSystemMetrics MessageBoxW DialogBoxParamW GetDC ShowWindow SetDlgItemTextW FindWindowW LoadStringW IsProcessDPIAware GetDlgItem SendDlgItemMessageW ReleaseDC EndDialog GetWindowPlacement InvalidateRect LoadIconW DrawTextW FillRect GetClientRect SetWindowTextW GetFocus GetWindowThreadProcessId GetShellWindow LoadImageW LoadBitmapW InflateRect KillTimer SetTimer IsDlgButtonChecked GetDlgItemTextW GetWindowTextLengthW CheckDlgButton GetWindowRect GetDesktopWindow SetFocus SendMessageW GetWindowLongW SetWindowLongW DrawFocusRect EnableWindow

gdi32

RoundRect CreateFontIndirectW GetObjectW FrameRgn CreateRectRgn SetBkMode SetTextColor Rectangle DeleteObject LineTo MoveToEx SelectObject CreatePen GetStockObject GetDeviceCaps CreateSolidBrush CreateFontW

advapi32

RegGetValueW CloseServiceHandle InitiateSystemShutdownExW RevertToSelf ImpersonateLoggedOnUser CreateProcessWithTokenW DuplicateTokenEx AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken QueryServiceConfigW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW StartServiceW GetUserNameW RegSetValueExW RegSetKeyValueW RegCreateKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW CreateServiceW DeleteService ControlServiceExA QueryServiceStatusEx OpenServiceW OpenSCManagerW

shell32

ShellExecuteW SHGetKnownFolderPath CommandLineToArgvW SHChangeNotify

ole32

CoUninitialize CoCreateInstance CoTaskMemFree CoInitializeEx

winhttp

WinHttpOpenRequest WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpCloseHandle WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpGetIEProxyConfigForCurrentUser WinHttpSetOption WinHttpSetCredentials

mpr

WNetGetConnectionW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Sharing

General

Malware Config

Signatures

File Explorer

f894e18590717d402493161b85cf141e50b74846c81a23e144488503c48fbb7b

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

mpr

version

generic