896e35b9befe7c8792446a03201fc54b68f2f7e917b4f8418ce1098d0e597cea

Sharing

Copy URL Twitter E-mail

General

Target
896e35b9befe7c8792446a03201fc54b68f2f7e917b4f8418ce1098d0e597cea
Size 3.5MB
Sample261102-jckcpsas4m
SHA256 896e35b9befe7c8792446a03201fc54b68f2f7e917b4f8418ce1098d0e597cea
MD5 27fa44c81c48d5737bbce1840d6cd6da
SHA1 0c8454d4008bd29162bb7ae6dc6cb21f91e33da0
SHA512 d00d7133fb0696105ab283fc04ed35db80d600ede8d43fad9048d89d7e86a1a028c14d74221746eaaa94ba6bc1c8898e6a063ad4fc72a3f1d8d8f130e5aa5ebf
SSDEEP 49152:BPAPmf7kUQ18tKWfrVUa+V5j+Us+yuMuSGOp09B/pwJrN6GFVfoPpNf9CX:6Pmjko7eJVQuBVPG5o28N1
TLSH
T179F5D0217681C037D96220728D6C8AAA186DBF311BB511CFA3D87B3E5D711E36E35F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
896e35b9befe7c8792446a03201fc54b68f2f7e917b4f8418ce1098d0e597cea

File Explorer

896e35b9befe7c8792446a03201fc54b68f2f7e917b4f8418ce1098d0e597cea

.exe 3.5MB

896e35b9befe7c8792446a03201fc54b68f2f7e917b4f8418ce1098d0e597cea

IMPHASH c8321dce5845ea433aa1e8fc6ac5cc3c
SHA256 896e35b9befe7c8792446a03201fc54b68f2f7e917b4f8418ce1098d0e597cea
MD5 27fa44c81c48d5737bbce1840d6cd6da
SHA1 0c8454d4008bd29162bb7ae6dc6cb21f91e33da0
SHA512 d00d7133fb0696105ab283fc04ed35db80d600ede8d43fad9048d89d7e86a1a028c14d74221746eaaa94ba6bc1c8898e6a063ad4fc72a3f1d8d8f130e5aa5ebf
SSDEEP 49152:BPAPmf7kUQ18tKWfrVUa+V5j+Us+yuMuSGOp09B/pwJrN6GFVfoPpNf9CX:6Pmjko7eJVQuBVPG5o28N1
TLSH
T179F5D0217681C037D96220728D6C8AAA186DBF311BB511CFA3D87B3E5D711E36E35F26
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

633732

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\master_lu\lds_install_and_uninstall\install_and_uninstall\Release\Install.pdb

kernel32

CreateProcessW GetStartupInfoW GetPrivateProfileStringW GetTempFileNameW GetPrivateProfileIntW OpenEventW GlobalAddAtomW GetFileSizeEx DecodePointer InterlockedIncrement InterlockedDecrement lstrcmpiW LoadLibraryExW GetCommandLineW CopyFileW VirtualAllocEx GetVersion ReadProcessMemory WriteProcessMemory OutputDebugStringA GlobalFree GlobalUnlock GlobalLock GlobalAlloc CreateEventW WaitForMultipleObjects ResetEvent GetSystemInfo GetShortPathNameW FormatMessageW CreateDirectoryW GetEnvironmentVariableW InterlockedExchange VirtualFreeEx WideCharToMultiByte InterlockedCompareExchange IsDebuggerPresent EncodePointer LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetDiskFreeSpaceExW GetSystemDirectoryW GetCurrentDirectoryW GetLogicalDriveStringsW MoveFileExW MoveFileW FindNextFileW FindFirstFileW DeleteFileW GetFileAttributesW SetFileAttributesW GetFullPathNameW RemoveDirectoryW GetWindowsDirectoryW GetTempPathW WaitForSingleObject FindClose SetLastError GetTickCount Sleep GetLastError LocalFree LocalAlloc GetVersionExW WriteConsoleW ReadConsoleW SetStdHandle WaitForSingleObjectEx SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCurrentThread GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetACP SetCurrentDirectoryW GetExitCodeProcess TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException MultiByteToWideChar GetFileSize UnlockFile LockFile MulDiv Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalFindAtomW CreateMutexW GlobalDeleteAtom GetCurrentProcessId OpenProcess GetDriveTypeW WritePrivateProfileStringW FindResourceExW FindResourceW GetModuleHandleW GetModuleFileNameW DeviceIoControl SizeofResource LoadResource FreeLibrary LockResource GetFileAttributesExW CreateFileW CreateFileMappingW UnmapViewOfFile MapViewOfFile OutputDebugStringW LoadLibraryW DosDateTimeToFileTime LocalFileTimeToFileTime SetFilePointer ReadFile GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetProcAddress DeleteFileA CreateFileA GetTempFileNameA InitializeSListHead GetLongPathNameW SetEvent lstrlenW DeleteCriticalSection InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree GetModuleFileNameA ExitProcess LoadLibraryExA GetTimeZoneInformation GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread InterlockedFlushSList RtlUnwind GetStringTypeW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo OpenFileMappingW UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter FlushFileBuffers SetFileTime SearchPathW FindFirstChangeNotificationW FindCloseChangeNotification CompareFileTime GetFileInformationByHandle SetEndOfFile GetStdHandle FreeResource GetSystemWindowsDirectoryW ReleaseMutex GetTempPathA CloseHandle WriteFile FindNextFileA FindFirstFileA lstrcmpiA lstrcmpA GetLocalTime

user32

DialogBoxParamW wsprintfW SetTimer KillTimer GetDC UnhookWinEvent DrawTextW GetWindowTextLengthW GetMessageW TranslateMessage DispatchMessageW ReleaseDC SendMessageW ShowWindow IsWindowVisible IsIconic SetForegroundWindow FindWindowExW GetWindowThreadProcessId PostMessageW IsWindow SetCursor SetRect OffsetRect LoadCursorW PtInRect CopyRect DrawFocusRect BeginPaint EndPaint IsRectEmpty DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW InvalidateRect GetClientRect GetWindowRect GetWindowLongW SetWindowLongW GetParent UpdateLayeredWindow SetWindowPos SetWindowRgn SystemParametersInfoW WaitForInputIdle SetWindowTextW GetShellWindow GetWindowTextW SetWinEventHook UnregisterClassA SendNotifyMessageW SendMessageTimeoutW RegisterWindowMessageW MessageBoxW IsDialogMessageW LoadStringW PeekMessageW EnableWindow FindWindowW RedrawWindow GetMonitorInfoW MonitorFromWindow LoadImageW GetWindow MapWindowPoints ScreenToClient DestroyWindow GetSystemMetrics MoveWindow PostQuitMessage ExitWindowsEx CharNextW BringWindowToTop EndDialog

gdi32

SaveDC RestoreDC SetTextColor SetBkMode CreateRectRgn CombineRgn SetViewportOrgEx CreateCompatibleDC CreateCompatibleBitmap BitBlt ExtTextOutW SetBkColor DeleteDC SelectObject GetTextExtentPoint32W GetDeviceCaps CreateFontIndirectW EnumFontFamiliesW DeleteObject CreateFontW

advapi32

CryptAcquireContextW RegOpenKeyExA RegEnumKeyExA GetTokenInformation RegSetValueExW RegQueryInfoKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegEnumValueW DuplicateTokenEx RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken UnlockServiceDatabase StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceLockStatusW QueryServiceConfig2W QueryServiceConfigW OpenServiceW OpenSCManagerW LockServiceDatabase DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW GetUserNameW AllocateAndInitializeSid FreeSid CheckTokenMembership EqualSid DeleteAce LookupAccountSidW LookupAccountNameW SetEntriesInAclW GetExplicitEntriesFromAclW GetNamedSecurityInfoW SetNamedSecurityInfoW BuildExplicitAccessWithNameW GetTrusteeNameW CryptContextAddRef CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt CryptDecrypt RegQueryValueExA

shell32

ord165 SHChangeNotify CommandLineToArgvW SHFileOperationW SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteExW SHBrowseForFolderW SHGetPathFromIDListW SHLoadInProc ShellExecuteW

ole32

CoInitializeEx CoInitializeSecurity CoCreateGuid CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoInitialize StringFromGUID2 CreateStreamOnHGlobal CoCreateInstance CoSetProxyBlanket OleRun

oleaut32

VariantCopy CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo VariantInit SysStringLen VariantClear SysFreeString VarUI4FromStr SysStringByteLen SysAllocString SysAllocStringByteLen

shlwapi

PathAppendA PathFindFileNameA PathRenameExtensionA PathAppendW PathCombineW PathFileExistsW PathRemoveFileSpecW PathFindExtensionW wnsprintfW StrCmpW PathFindFileNameW SHGetValueW PathUnquoteSpacesW SHSetValueW PathIsPrefixW PathIsRelativeW PathIsRootW SHSetValueA AssocQueryStringW StrStrIW SHDeleteValueW StrStrIA StrCmpNIW StrTrimA StrCmpIW StrToIntExW SHGetValueA PathIsDirectoryW SHDeleteKeyW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipDrawImagePointRectI GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipMeasureString GdipDeleteBrush GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageRectRect GdipDrawImageRectRectI GdipCloneBrush GdipDrawString GdipCreateSolidFill GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipSetTextRenderingHint GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipDeleteFont GdipCreateFont

cabinet

ord23 ord20 ord22

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW EnumProcesses

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

secur32

GetUserNameExW

crypt32

CryptBinaryToStringW CryptBinaryToStringA CertGetNameStringW CryptStringToBinaryW CryptStringToBinaryA

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

generic

count=18, id=241, version=40116,

count=172, id=243, version=40116,

count=31, id=242, version=40116,

count=2, id=264, version=27030,

count=1, productName=Unmarked objects (old),

count=21, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=261, version=27032,

count=3, id=199, version=41118,

count=25, id=259, version=26706,

count=8, id=261, version=27031,

count=35, id=260, version=26706,

count=78, id=261, version=26706,

count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=478, id=1, productName=Unmarked objects,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=90, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=256, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,

count=2, id=151,

count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,