44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc

Sharing

Copy URL Twitter E-mail

General

Target
44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc
Size 1.3MB
Sample261102-ja322aed85
SHA256 44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc
MD5 7ac490ea13019e1d1fe9c79eeaf4ccfe
SHA1 d1b36e7d7632849e5ce45db815d801ed94d16f28
SHA512 51d56e2f863b71b6cf4ec53c67caaa3411d068b23dfc5fd7120783ea00d56ce91c21e2723300161d56455d0deba54896c45f6a3a0c24d29a2bd636dea4060b3e
SSDEEP 24576:lI52lSz3ioXPpFqgld6bEd8X+biNyBo4kx929bL3Hnx:lIFz3vRFR5S+bhB+kn3Hnx
TLSH
T18055E117739A01EDE16BE23C46879A02F1BA7C451B52CBCB2390B57A2F77AD41D3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc

File Explorer

44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc

.exe 1.3MB

44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc

IMPHASH 48c53e3b3c77617f4df5bfd3ac6a63f3
SHA256 44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc
MD5 7ac490ea13019e1d1fe9c79eeaf4ccfe
SHA1 d1b36e7d7632849e5ce45db815d801ed94d16f28
SHA512 51d56e2f863b71b6cf4ec53c67caaa3411d068b23dfc5fd7120783ea00d56ce91c21e2723300161d56455d0deba54896c45f6a3a0c24d29a2bd636dea4060b3e
SSDEEP 24576:lI52lSz3ioXPpFqgld6bEd8X+biNyBo4kx929bL3Hnx:lIFz3vRFR5S+bhB+kn3Hnx
TLSH
T18055E117739A01EDE16BE23C46879A02F1BA7C451B52CBCB2390B57A2F77AD41D3A350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

331568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\pub_1p3u3\master_kso_v12\Build\Release_x64\WPSOffice\wtoolex\updatepolicy_md.pdb

kernel32

lstrlenW CloseHandle SetEvent WaitForSingleObject CreateEventW GetProcAddress LoadLibraryW MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW GetLastError CreateMutexW CreateThread TerminateThread GetExitCodeThread GetCommandLineW SetCurrentDirectoryW GetSystemDirectoryW FreeLibrary GlobalFree LocalFree GetFileAttributesW GetModuleFileNameW GetModuleHandleW VerSetConditionMask CreateFileW DeviceIoControl GetPrivateProfileIntW VerifyVersionInfoW GetUserDefaultUILanguage ExpandEnvironmentStringsW Sleep GetCurrentProcess GetCurrentProcessId GetCurrentThread ProcessIdToSessionId OpenProcess WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadLibraryExW CreateFileA ReleaseMutex GetSystemTime QueryPerformanceCounter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemTimeAsFileTime GetCurrentThreadId InitializeSListHead WaitForSingleObjectEx ResetEvent LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx AreFileApisANSI GetFileAttributesExW FindNextFileW FindFirstFileExW FindClose FormatMessageA LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo OutputDebugStringW

msvcp140

?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?_Xbad_function_call@std@@YAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z _Mtx_unlock ?_Throw_C_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Xtime_get_ticks ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??Bid@locale@std@@QEAA_KXZ ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z _Strcoll _Strxfrm ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?uncaught_exception@std@@YA_NXZ _Mtx_init_in_situ _Mtx_destroy_in_situ _Mtx_lock

vcruntime140

strchr __std_terminate __std_exception_copy memchr __std_exception_destroy _purecall __C_specific_handler __current_exception _CxxThrowException __current_exception_context memcpy memmove memcmp memset

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e terminate _exit _beginthreadex _cexit _c_exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo_noreturn _invalid_parameter_noinfo _errno _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit exit _seh_filter_exe

api-ms-win-crt-heap-l1-1-0

realloc _callnewh malloc free _aligned_malloc _aligned_free _set_new_mode

api-ms-win-crt-string-l1-1-0

wcscpy_s _wcsicmp towupper wcsncpy_s tolower towlower _strnicmp strncpy_s strncpy toupper

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

strtol wcstol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __acrt_iob_func __stdio_common_vsprintf_s __p__commode __stdio_common_vswprintf_s _set_fmode __stdio_common_vsprintf __stdio_common_vsnwprintf_s

api-ms-win-crt-math-l1-1-0

_finite _dclass modf _isnan ceilf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

Name

.text

Size

340KB

Virtual Size

339KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

254KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

44fa5615d636ef5b6b1b9e0979f98da48aeef1499460cd7e1389e1376d23e7dc

kernel32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic