997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56

Sharing

Copy URL Twitter E-mail

General

Target
997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56
Size 799KB
Sample261102-g8ar2aec98
SHA256 997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56
MD5 921a04183d898fcf567c462d4545d715
SHA1 24d5b85a78b51643626ace4bd726f7e2896ec4ff
SHA512 94a0715f944c2db0e6440a915f656dbfcfb37864054509b8ed5e95f2927201f102f1bfed40114054666b659e89be076730df8f6d6d4d1797f15209b89f616622
SSDEEP 12288:M3EGFV7d73ZBJDZajLGoXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:Y7dvJ0jLGGfhOB95Dr47iJ0nQZo2vI3
TLSH
T1A505F1303B4AC832E6F341B25E6C9B7FA0697B991F6241C767C85B5D8C348D21B74A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56

File Explorer

997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56

.exe 799KB

997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56

IMPHASH 1f0d8fc096453c0d48b43a3af1721f01
SHA256 997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56
MD5 921a04183d898fcf567c462d4545d715
SHA1 24d5b85a78b51643626ace4bd726f7e2896ec4ff
SHA512 94a0715f944c2db0e6440a915f656dbfcfb37864054509b8ed5e95f2927201f102f1bfed40114054666b659e89be076730df8f6d6d4d1797f15209b89f616622
SSDEEP 12288:M3EGFV7d73ZBJDZajLGoXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:Y7dvJ0jLGGfhOB95Dr47iJ0nQZo2vI3
TLSH
T1A505F1303B4AC832E6F341B25E6C9B7FA0697B991F6241C767C85B5D8C348D21B74A27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

164659

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\workspace\p-ad0484fbdfe349d18f6d70b4084a70ba\src\product\win32\dbginfo\pdfaccountsvr.pdb

kernel32

CompareFileTime EnterCriticalSection WaitForMultipleObjects LeaveCriticalSection InitializeCriticalSection CreateEventW GetFileAttributesExW SetEvent CloseHandle LocalFree WideCharToMultiByte GetPrivateProfileIntW GetProcessId GetLocalTime ReadFile WriteFile SetFilePointer LocalAlloc CreateFileW GetFileSize CreateDirectoryW GetModuleFileNameW GetFileAttributesW DeleteFileW MultiByteToWideChar GetVersionExW GetSystemDirectoryW GetProcAddress GetModuleHandleW MoveFileW WaitForSingleObject ResetEvent K32GetModuleFileNameExW OpenProcess GetTickCount GetExitCodeThread Sleep OutputDebugStringW TerminateProcess CreateNamedPipeW UnmapViewOfFile DisconnectNamedPipe CreateToolhelp32Snapshot Process32NextW Process32FirstW QueryFullProcessImageNameW CreateFileMappingW MapViewOfFile ConnectNamedPipe CreateMutexW LoadLibraryW GetPrivateProfileStringW GetProcessHeap AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount IsDebuggerPresent DeleteCriticalSection HeapDestroy HeapAlloc FindResourceW LoadResource FindResourceExW RaiseException HeapReAlloc LockResource GetLastError HeapSize InitializeCriticalSectionEx HeapFree CreateThread SizeofResource

user32

DefWindowProcW SendMessageW GetWindowRect DestroyWindow IsWindowVisible CreateWindowExW PostMessageW GetMessageW RealGetWindowClassW RegisterClassExW ShowWindow IsWindow DispatchMessageW SetTimer IsChild GetForegroundWindow TranslateMessage LoadCursorW PostQuitMessage SetWinEventHook UnhookWinEvent GetWindowTextW GetWindowThreadProcessId wsprintfW FindWindowW

advapi32

GetLengthSid AddMandatoryAce GetTokenInformation RegNotifyChangeKeyValue RegOpenKeyExW RegCloseKey RegOpenKeyW RegQueryValueExW InitializeAcl InitializeSecurityDescriptor OpenProcessToken SetSecurityDescriptorSacl ConvertStringSidToSidW GetSidSubAuthority GetSidSubAuthorityCount SetSecurityDescriptorDacl GetSecurityDescriptorSacl

shell32

SHGetFolderPathW ShellExecuteExW ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathRemoveFileSpecW PathFileExistsW

msvcp140

?_Throw_C_error@std@@YAXH@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ _Mtx_lock _Mtx_init_in_situ _Mtx_unlock _Mtx_destroy_in_situ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

vcruntime140

wcsstr memcpy memchr _except_handler4_common __current_exception_context __current_exception memset memmove _CxxThrowException __CxxFrameHandler3 wcsrchr wcschr strchr __std_terminate __std_exception_destroy _purecall __std_exception_copy

api-ms-win-crt-string-l1-1-0

tolower isalnum strncmp _stricmp isspace strnlen wcscspn wcsspn wmemcpy_s iswspace wcstok wcsncmp _wcsicmp _wcslwr_s isalpha wcsnlen

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 _mktime64

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _errno _invalid_parameter_noinfo _controlfp_s _c_exit _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _register_thread_local_exe_atexit_callback _set_app_type _beginthreadex _seh_filter_exe _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free _recalloc calloc

api-ms-win-crt-convert-l1-1-0

_wtoi64 _wtoi wcstol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vswprintf_s __stdio_common_vswscanf fclose _set_fmode __stdio_common_vfprintf __stdio_common_vsnprintf_s fflush __p__commode _wfopen __stdio_common_vswprintf fputws __stdio_common_vsscanf __stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-filesystem-l1-1-0

_wstat32

api-ms-win-crt-locale-l1-1-0

_configthreadlocale setlocale

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sharing

General

Malware Config

Signatures

File Explorer

997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56

kernel32

user32

advapi32

shell32

shlwapi

msvcp140

version

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

generic