MhQuickPrint-0[.]1[.]0-win-x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MhQuickPrint-0.1.0-win-x64.exe
Size 1.3MB
Sample261102-bm3ysses9z
SHA256 42db2fe9bf4e8decbc1a03e9c9a445a0101473e5ab47b9ef530de75acad2f605
MD5 326d5a9237c862a023d6044ab0352ec3
SHA1 6d039b15b100fb458504ddb03095f0d8f94d9a90
SHA512 654ad8217a398b87dca2651a9d8ccd2e60f592252ec8e4fc6821037c14078d0089c720a74dedf8c3753b8a1dfc77365a1c36e20bc4cc2b5d3e67e6063a3a4a00
SSDEEP 24576:04sdFeTl7WBz0QVTy48Ihh0lhSMXlRU6bZRXkcP7N8Q:04RJ74ynBU0RXN7N8
TLSH
T13D559E22B2A940FCD17AC1F5CB574906EB72784907306EDF0B90AB662F17AD45E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MhQuickPrint-0.1.0-win-x64.exe

File Explorer

MhQuickPrint-0.1.0-win-x64.exe

.exe 1.3MB

MhQuickPrint-0.1.0-win-x64.exe

IMPHASH 205297c9a4e19b14c48e3e4f7b918b9a
SHA256 42db2fe9bf4e8decbc1a03e9c9a445a0101473e5ab47b9ef530de75acad2f605
MD5 326d5a9237c862a023d6044ab0352ec3
SHA1 6d039b15b100fb458504ddb03095f0d8f94d9a90
SHA512 654ad8217a398b87dca2651a9d8ccd2e60f592252ec8e4fc6821037c14078d0089c720a74dedf8c3753b8a1dfc77365a1c36e20bc4cc2b5d3e67e6063a3a4a00
SSDEEP 24576:04sdFeTl7WBz0QVTy48Ihh0lhSMXlRU6bZRXkcP7N8Q:04RJ74ynBU0RXN7N8
TLSH
T13D559E22B2A940FCD17AC1F5CB574906EB72784907306EDF0B90AB662F17AD45E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

558112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

Shell_NotifyIconW SHGetKnownFolderPath ShellExecuteW

api-ms-win-core-file-l1-1-0

ReadFile GetFileType SetFilePointerEx GetFileSizeEx FlushFileBuffers DeleteFileW CreateFileW CreateDirectoryW WriteFile GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter RaiseException UnhandledExceptionFilter

api-ms-win-core-namedpipe-l1-1-0

ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW

api-ms-win-core-io-l1-1-0

GetOverlappedResult CancelIoEx

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken GetExitCodeThread TerminateProcess ExitThread ExitProcess CreateThread GetStartupInfoW GetCurrentThreadId GetCurrentProcess GetCurrentProcessId

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary GetModuleHandleW LoadLibraryExW GetModuleFileNameW

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-string-obsolete-l1-1-0

lstrcpynW

api-ms-win-ntuser-sysparams-l1-1-0

GetMonitorInfoW

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoGetActivationFactory

api-ms-win-core-string-l1-1-0

MultiByteToWideChar CompareStringW GetStringTypeW WideCharToMultiByte

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection LeaveCriticalSection ReleaseSRWLockExclusive WaitForSingleObjectEx SetEvent EnterCriticalSection AcquireSRWLockExclusive CreateEventW InitializeCriticalSectionEx ResetEvent

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-heap-l2-1-0

GlobalFree GlobalAlloc LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-localization-l1-2-0

GetUserDefaultLCID LCMapStringEx IsValidLocale GetLocaleInfoW LCMapStringW IsValidCodePage GetACP GetLocaleInfoEx FormatMessageA EnumSystemLocalesW GetOEMCP GetCPInfo

bcrypt

BCryptOpenAlgorithmProvider BCryptVerifySignature BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptHash BCryptImportKeyPair

crypt32

CryptUnprotectData CryptProtectData CryptStringToBinaryA

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx MoveFileExW

api-ms-win-core-com-l1-1-0

CoSetProxyBlanket CoCreateInstance CoInitializeEx CoCreateGuid CoUninitialize StringFromGUID2 CoTaskMemFree

iphlpapi

GetAdaptersAddresses GetIfEntry2

oleaut32

SysAllocString SetErrorInfo VariantClear VariantInit SysStringLen SysFreeString GetErrorInfo

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize GlobalUnlock GlobalLock

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo GetSystemTimePreciseAsFileTime

comctl32

ord345 InitCommonControlsEx

d2d1

ord1

winspool.drv

ord203 EnumPrintersW DeviceCapabilitiesW GetFormW AddFormW ClosePrinter DocumentPropertiesW PrinterProperties SetJobW OpenPrinterW

user32

SetDlgItemTextW SetDlgItemInt PeekMessageW GetDlgItemTextW CheckRadioButton IsDlgButtonChecked SetTimer KillTimer SystemParametersInfoForDpi LoadCursorW GetSysColorBrush GetSysColor MapWindowPoints GetWindowRect GetWindowTextLengthW GetWindowTextW SetWindowTextW ReleaseDC GetDC EnableWindow IsIconic ShowWindow EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetProcessDpiAwarenessContext GetDpiForWindow MonitorFromPoint IsDialogMessageW DrawIconEx LoadImageW LoadIconW UpdateWindow SetWindowLongPtrW GetWindowLongPtrW OffsetRect GetWindowThreadProcessId InflateRect FrameRect GetWindow GetDlgItemInt FillRect DrawFocusRect GetCursorPos MessageBoxW AdjustWindowRectExForDpi GetClientRect InvalidateRect EndPaint BeginPaint SetForegroundWindow DrawTextW TrackPopupMenu AppendMenuW DestroyMenu RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW PostThreadMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow MoveWindow SetWindowPos DialogBoxParamW EndDialog GetDlgItem SendDlgItemMessageW GetDlgCtrlID SetFocus GetFocus CreatePopupMenu

gdi32

CreateFontW RestoreDC DeleteDC SetDCPenColor RoundRect SetViewportOrgEx GetTextExtentPoint32W CreateFontIndirectW AbortDoc EndPage StartPage EndDoc StartDocW SetTextColor StretchDIBits SetBkMode SetDCBrushColor SetBkColor SelectObject SaveDC DeleteObject GetStockObject GetDeviceCaps CreateDCW

comdlg32

CommDlgExtendedError GetSaveFileNameW

ntdll

RtlGetVersion

kernel32

SetLastError

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeAllConditionVariable WakeByAddressAll

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW FreeEnvironmentStringsW GetCommandLineA GetCommandLineW SetStdHandle GetEnvironmentStringsW GetStdHandle

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsGetValue FlsSetValue FlsFree

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-heap-l1-1-0

HeapAlloc HeapReAlloc HeapSize GetProcessHeap HeapFree

api-ms-win-core-memory-l1-1-0

VirtualProtect

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-console-l1-1-0

GetConsoleMode GetConsoleOutputCP WriteConsoleW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

711KB

Virtual Size

711KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

303KB

Virtual Size

302KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

235KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MhQuickPrint-0.1.0-win-x64.exe

shell32

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-localization-l1-2-0

bcrypt

crypt32

api-ms-win-core-file-l2-1-0

api-ms-win-core-com-l1-1-0

iphlpapi

oleaut32

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

comctl32

d2d1

winspool.drv

user32

gdi32

comdlg32

ntdll

kernel32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-heap-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

generic