c0565981f3d16ac43b2062e3fa34c09d4f0a0eb50329f1322a6965bc9696239b

Sharing

Copy URL Twitter E-mail

General

Target
c0565981f3d16ac43b2062e3fa34c09d4f0a0eb50329f1322a6965bc9696239b
Size 1.0MB
Sample261102-hh1ffafx8v
SHA256 c0565981f3d16ac43b2062e3fa34c09d4f0a0eb50329f1322a6965bc9696239b
MD5 070a1d1e70ed626001eceb827944810a
SHA1 c9f94a82b04d55d49300292e29353082578385a1
SHA512 d9089403ec2a18e87ef74d3d5ec7dec3c78a94acc8e8b9e7a2f1814f24721af8f7af2d7c792644b17389dd5bbe304eba6932c6722697ff3c874cad328f69e95f
SSDEEP 24576:7iQ59OKqZA/kIeUn5VdiSuJuWQKgSDilmdc:7iQ59HqZYksn5HiSuJnz
TLSH
T1BC35F1303759C53BD6A306724CADA6BF142ABA050FE192C7A2D92F5ED8B06D30971F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0565981f3d16ac43b2062e3fa34c09d4f0a0eb50329f1322a6965bc9696239b

File Explorer

c0565981f3d16ac43b2062e3fa34c09d4f0a0eb50329f1322a6965bc9696239b

.exe 1.0MB

c0565981f3d16ac43b2062e3fa34c09d4f0a0eb50329f1322a6965bc9696239b

IMPHASH a7e4ba2dcbd2a58a77584c20ab65cd11
SHA256 c0565981f3d16ac43b2062e3fa34c09d4f0a0eb50329f1322a6965bc9696239b
MD5 070a1d1e70ed626001eceb827944810a
SHA1 c9f94a82b04d55d49300292e29353082578385a1
SHA512 d9089403ec2a18e87ef74d3d5ec7dec3c78a94acc8e8b9e7a2f1814f24721af8f7af2d7c792644b17389dd5bbe304eba6932c6722697ff3c874cad328f69e95f
SSDEEP 24576:7iQ59OKqZA/kIeUn5VdiSuJuWQKgSDilmdc:7iQ59HqZYksn5HiSuJnz
TLSH
T1BC35F1303759C53BD6A306724CADA6BF142ABA050FE192C7A2D92F5ED8B06D30971F17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

149340

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345softmgr-build\SoftMgr\main\bin\Win32\Release\pdb\2345SoftmgrSvc.pdb

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

kernel32

GetLastError SetEvent CreateFileMappingW MapViewOfFile WaitForSingleObject InterlockedExchange InterlockedCompareExchange GetCurrentProcess Sleep WTSGetActiveConsoleSessionId OpenMutexW GetProcAddress SetFileAttributesW GetFileAttributesW GetTempPathW lstrlenW GetFullPathNameW CreateDirectoryW GetFileSize ReadFile FindClose UnmapViewOfFile OpenEventW GetCurrentProcessId GetLocalTime CloseHandle GetCurrentThreadId CreateFileW SetFilePointer CreateEventW GetTempFileNameW GetLogicalDriveStringsW InterlockedExchangeAdd UnhandledExceptionFilter GetModuleFileNameW IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead Thread32Next Thread32First SuspendThread CreateToolhelp32Snapshot OpenThread Process32NextW Process32FirstW ReadProcessMemory IsWow64Process VirtualQuery CreateProcessW GetModuleHandleW GetExitCodeProcess ResetEvent FindFirstFileW GetLongPathNameW GetFileAttributesExW CreateMutexW ReleaseMutex WideCharToMultiByte SearchPathW EnterCriticalSection LeaveCriticalSection WriteFile WaitForMultipleObjects DeleteFileW GetWindowsDirectoryW InitializeCriticalSection DeleteCriticalSection ExpandEnvironmentStringsW GetEnvironmentVariableW MultiByteToWideChar GetVersionExW LockResource GetSystemInfo SetUnhandledExceptionFilter LoadResource FindResourceW lstrcmpiW QueryDosDeviceW LocalFree OpenProcess TerminateProcess HeapFree HeapAlloc GetProcessHeap LoadLibraryW FreeLibrary

user32

SetForegroundWindow IsWindow GetWindowLongW ShowWindow SendMessageW IsWindowVisible GetWindow FindWindowExW GetWindowThreadProcessId FindWindowW SystemParametersInfoW SetWindowLongW SendMessageTimeoutW

advapi32

SetTokenInformation OpenProcessToken CreateProcessAsUserW DuplicateTokenEx GetTokenInformation RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW

msvcp140

_Cnd_destroy_in_situ _Cnd_broadcast _Mtx_unlock _Cnd_wait _Cnd_register_at_thread_exit _Mtx_init_in_situ ?__ExceptionPtrRethrow@@YAXPBX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z _Mtx_lock ?__ExceptionPtrDestroy@@YAXPAX@Z _Mtx_destroy_in_situ ?__ExceptionPtrToBool@@YA_NPBX@Z ?_Syserror_map@std@@YAPBDH@Z ?_XGetLastError@std@@YAXXZ ?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z ?_Throw_C_error@std@@YAXH@Z ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z ?_Throw_future_error@std@@YAXABVerror_code@1@@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z _Cnd_init_in_situ ?__ExceptionPtrCreate@@YAXPAX@Z _Cnd_unregister_at_thread_exit ??0task_continuation_context@Concurrency@@AAE@XZ ?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z ?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ ?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ ?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?__ExceptionPtrAssign@@YAXPAXPBX@Z ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__std_terminate _purecall __std_exception_destroy __std_exception_copy wcschr wcsstr strstr memset _CxxThrowException memcpy wcsrchr __CxxFrameHandler3 _except_handler4_common memmove

api-ms-win-crt-runtime-l1-1-0

_initterm_e _exit _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _initterm exit _set_app_type _seh_filter_exe _c_exit _cexit _crt_atexit _register_onexit_function _initialize_onexit_table terminate _register_thread_local_exe_atexit_callback _controlfp_s _invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

_stricmp _wcsnicmp towupper wcsncpy_s towlower wcscpy_s

api-ms-win-crt-convert-l1-1-0

atoi _wtoi

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

c0565981f3d16ac43b2062e3fa34c09d4f0a0eb50329f1322a6965bc9696239b

wtsapi32

userenv

kernel32

user32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic