937964a06610b1ae46f05b704d96b7cd4a7729dff1505099ae4ce57f1c52dc86

Sharing

Copy URL Twitter E-mail

General

Target
937964a06610b1ae46f05b704d96b7cd4a7729dff1505099ae4ce57f1c52dc86
Size 1.7MB
Sample261102-jf7bmsas7j
SHA256 937964a06610b1ae46f05b704d96b7cd4a7729dff1505099ae4ce57f1c52dc86
MD5 0e908db12a9955fcca7cb87f0834a7ac
SHA1 4fe4932bb2e6af9c93968fb65485fc7e8a727077
SHA512 34169c00ee01186283cc4d9c981f12e285d504149dc4424e4e7fce338f708584089eebfc57a4b134088d4c7d61477476b2fcdd315662ba6196dc07d8e4ebef37
SSDEEP 24576:d+d3zC9QNiY7A4iBOyLkyQkET3DMceJn/PPeUosPe7aVS8mSEmcCR1dAdiX:d83zCmNMOQQkETTMHJ/PtmuVS5gpRDQg
TLSH
T15385CF25FD22A173D49240B151B6BFE2E9EC6F21832988D7A3D0BF2E65190D33531B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
937964a06610b1ae46f05b704d96b7cd4a7729dff1505099ae4ce57f1c52dc86

File Explorer

937964a06610b1ae46f05b704d96b7cd4a7729dff1505099ae4ce57f1c52dc86

.exe 1.7MB

937964a06610b1ae46f05b704d96b7cd4a7729dff1505099ae4ce57f1c52dc86

IMPHASH 67904fa5fc7946f29c7ac9881ed81294
SHA256 937964a06610b1ae46f05b704d96b7cd4a7729dff1505099ae4ce57f1c52dc86
MD5 0e908db12a9955fcca7cb87f0834a7ac
SHA1 4fe4932bb2e6af9c93968fb65485fc7e8a727077
SHA512 34169c00ee01186283cc4d9c981f12e285d504149dc4424e4e7fce338f708584089eebfc57a4b134088d4c7d61477476b2fcdd315662ba6196dc07d8e4ebef37
SSDEEP 24576:d+d3zC9QNiY7A4iBOyLkyQkET3DMceJn/PPeUosPe7aVS8mSEmcCR1dAdiX:d83zCmNMOQQkETTMHJ/PtmuVS5gpRDQg
TLSH
T15385CF25FD22A173D49240B151B6BFE2E9EC6F21832988D7A3D0BF2E65190D33531B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

555928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Ugit\WXWork\WXWork\third_party\bugly\build_crashpad\crashpad\out\x86\release\crashpad_handler.pdb

kernel32

GetCurrentProcessId EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection SetLastError GetModuleFileNameW GetFileInformationByHandleEx GetCurrentProcess RegisterWaitForSingleObject GetQueuedCompletionStatus WaitForSingleObject DuplicateHandle DisconnectNamedPipe OpenProcess PostQueuedCompletionStatus CreateEventW SetEvent CreateThread UnregisterWaitEx CreateIoCompletionPort ConnectNamedPipe ExitProcess SetNamedPipeHandleState CreateNamedPipeW GetVersion TransactNamedPipe WaitNamedPipeW LoadLibraryW GetProcAddress FindClose TerminateProcess ReleaseSemaphore CreateSemaphoreW GetStdHandle WriteFile SetEndOfFile UnlockFileEx SetFilePointerEx LockFileEx GetFileType GetModuleHandleW FormatMessageA LocalFree CreateDirectoryW GetFileAttributesW DeleteFileW GetTimeZoneInformation GetSystemInfo IsProcessorFeaturePresent VerSetConditionMask VerifyVersionInfoW GetProcessId SuspendThread ResumeThread GetThreadContext GetProcessTimes GetSystemDefaultLCID GetThreadLocale GetUserDefaultLCID CreateProcessW IsWow64Process WriteProcessMemory RtlCaptureContext Sleep VirtualAllocEx ReadProcessMemory SleepEx IsDebuggerPresent SizeofResource MultiByteToWideChar LockResource GlobalAlloc GlobalFree FindResourceExW IsDBCSLeadByte LoadResource FindResourceW GlobalLock lstrcpyW GlobalUnlock GetPrivateProfileSectionW GetFileSizeEx VirtualAlloc VirtualProtect DeviceIoControl CreateFileA WideCharToMultiByte OutputDebugStringW ReadFile WritePrivateProfileStringW SetUnhandledExceptionFilter GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize GetCurrentDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW InitializeCriticalSectionEx SwitchToThread InitializeCriticalSection VirtualQueryEx GetFileTime RemoveDirectoryW WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleExW GetCommandLineW GetCommandLineA LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetStartupInfoW InitializeSListHead UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo GetStringTypeW GetSystemTimeAsFileTime InitOnceExecuteOnce LCMapStringEx EncodePointer QueryPerformanceCounter GetLocalTime FormatMessageW GetCurrentThreadId CloseHandle GetPrivateProfileStringW GetFullPathNameW CreateFileW SetProcessShutdownParameters HeapFree VirtualFree SetConsoleCtrlHandler

advapi32

RegQueryValueExA RevertToSelf BuildSecurityDescriptorW SystemFunction036 ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExA RegCloseKey ImpersonateNamedPipeClient RegOpenKeyExW RegQueryValueExW BuildExplicitAccessWithNameW

user32

SetWindowLongW CreateWindowExW DestroyWindow RegisterClassW DefWindowProcW GetMessageW GetWindowLongW TranslateMessage DispatchMessageW PostMessageW EnableWindow EndPaint BeginPaint InvalidateRect LoadImageW DialogBoxParamW GetSysColorBrush UnregisterClassW GetWindowTextW KillTimer DrawIconEx DrawTextW GetDlgItem GetClientRect MapDialogRect SetClipboardData SendDlgItemMessageW MapWindowPoints SetDlgItemTextW EmptyClipboard CloseClipboard ClientToScreen SetTimer GetWindowTextLengthW EndDialog SetWindowTextW GetWindowThreadProcessId GetMenuItemCount CreatePopupMenu TrackPopupMenu IsWindow DestroyMenu RegisterClipboardFormatW GetKeyState CallWindowProcW GetWindowRect SetWindowPos SendMessageW ShowWindow OpenClipboard

winhttp

WinHttpWriteData WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpSendRequest WinHttpSetTimeouts WinHttpCrackUrl

powrprof

CallNtPowerInformation

ole32

OleUninitialize CoTaskMemFree CoCreateGuid StringFromCLSID OleInitialize DoDragDrop

shlwapi

PathRemoveFileSpecW PathFileExistsW

gdiplus

GdiplusStartup

comctl32

ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx

gdi32

DeleteObject SetTextColor GetStockObject CreateFontW SelectObject SetBkMode

oleaut32

SysAllocString SysFreeString SysStringByteLen SysAllocStringByteLen SysStringLen

shell32

SHGetDesktopFolder SHGetFileInfoW SHBindToParent ShellExecuteW ord155

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Sharing

General

Malware Config

Signatures

File Explorer

937964a06610b1ae46f05b704d96b7cd4a7729dff1505099ae4ce57f1c52dc86

kernel32

advapi32

user32

winhttp

powrprof

ole32

shlwapi

gdiplus

comctl32

gdi32

oleaut32

shell32

version

generic