7b7555d38d153bd0c7599516f0615a9f63b41ba4e793f349583ec74ba6c78b9d

Sharing

Copy URL Twitter E-mail

General

Target
7b7555d38d153bd0c7599516f0615a9f63b41ba4e793f349583ec74ba6c78b9d
Size 2.2MB
Sample261102-jsd6maav2m
SHA256 7b7555d38d153bd0c7599516f0615a9f63b41ba4e793f349583ec74ba6c78b9d
MD5 05fb9ddeb86394ce20f9af7c55dd4c47
SHA1 2a1eed5459269bcad3932e85adc3556c6ce85c7e
SHA512 2d3b0a88dd4633447b1a099159645ecc6ff23fa822eb37126ac50e5707f7226d1899bcc63ac489d639d3dd509c5e06819837be802ff44e6ed9f76613db1d2f3b
SSDEEP 49152:Uf7OTvheBhVTDxnwyQHgum89ohD4WIai9q/xI:USTvhejnDQHlmPEWITg/x
TLSH
T1F6A5F13277A484BAC5A208308B1683349B76FD6657368BC77BE87F195F369C02D33916
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b7555d38d153bd0c7599516f0615a9f63b41ba4e793f349583ec74ba6c78b9d

File Explorer

7b7555d38d153bd0c7599516f0615a9f63b41ba4e793f349583ec74ba6c78b9d

.exe 2.2MB

7b7555d38d153bd0c7599516f0615a9f63b41ba4e793f349583ec74ba6c78b9d

IMPHASH f4a10960f7f77328e2d5cb2575566b48
SHA256 7b7555d38d153bd0c7599516f0615a9f63b41ba4e793f349583ec74ba6c78b9d
MD5 05fb9ddeb86394ce20f9af7c55dd4c47
SHA1 2a1eed5459269bcad3932e85adc3556c6ce85c7e
SHA512 2d3b0a88dd4633447b1a099159645ecc6ff23fa822eb37126ac50e5707f7226d1899bcc63ac489d639d3dd509c5e06819837be802ff44e6ed9f76613db1d2f3b
SSDEEP 49152:Uf7OTvheBhVTDxnwyQHgum89ohD4WIai9q/xI:USTvhejnDQHlmPEWITg/x
TLSH
T1F6A5F13277A484BAC5A208308B1683349B76FD6657368BC77BE87F195F369C02D33916
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

374817

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\jekins_work\workspace\mtz_zip_build_all\product\win32\dbginfo\uninstall.pdb

kernel32

FileTimeToLocalFileTime SetFilePointer lstrlenA GetLocalTime CreateFileA CreateProcessW GetExitCodeProcess lstrcmpW SetFileAttributesW GetCommandLineW GetCurrentThreadId FlushInstructionCache GetPrivateProfileStringW InterlockedExchange InterlockedDecrement InterlockedIncrement RaiseException FreeResource GetPrivateProfileIntW OutputDebugStringW GlobalFree GlobalUnlock GlobalLock GlobalAlloc OpenEventW SetEvent MapViewOfFileEx LoadLibraryExW lstrcmpiW SetThreadPriority CreateEventW ResetEvent WaitForMultipleObjects FindFirstFileA FormatMessageW GetExitCodeThread CreateMutexW ReleaseMutex DuplicateHandle SleepEx InitializeCriticalSectionAndSpinCount SetEnvironmentVariableA CompareStringW CompareStringA GetFullPathNameA GetDriveTypeA GetCurrentDirectoryA WriteConsoleW GetConsoleOutputCP WriteConsoleA Sleep GetStringTypeW GetStringTypeA QueryPerformanceCounter GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP GetTimeZoneInformation HeapCreate GetModuleFileNameA GetStartupInfoA GetStdHandle SetHandleCount TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetCPInfo LCMapStringW LCMapStringA RtlUnwind GetStartupInfoW ExitProcess GetModuleHandleA ExitThread GetFileType SetStdHandle IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA GetThreadLocale GetLocaleInfoA GetACP GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetVersionExA GetSystemTimeAsFileTime FileTimeToSystemTime DeleteCriticalSection WaitForSingleObject CreateThread TerminateThread ExpandEnvironmentStringsW SetEndOfFile FlushFileBuffers CopyFileW MoveFileExW SetLastError GetLongPathNameW CreateFileMappingW UnmapViewOfFile WriteFile GetTickCount InterlockedCompareExchange LocalFree LocalAlloc lstrlenW ReadFile MultiByteToWideChar GetFileSize CreateFileW WideCharToMultiByte GetVersionExW FreeLibrary InitializeCriticalSection LeaveCriticalSection LoadLibraryW EnterCriticalSection QueryDosDeviceW GetLogicalDriveStringsW RemoveDirectoryW GetLastError FindClose CreateToolhelp32Snapshot FindNextFileW DeleteFileW GetFileAttributesW FindFirstFileW GetModuleFileNameW GetTempPathW GetSystemDirectoryW GetWindowsDirectoryW GetProcAddress GetModuleHandleW GetCurrentProcess FindResourceExW LoadResource LockResource SizeofResource FindResourceW Process32NextW TerminateProcess OpenProcess GetCurrentProcessId CloseHandle Process32FirstW VirtualQuery

user32

SetWindowTextW BringWindowToTop GetNextDlgTabItem SystemParametersInfoW SetRectEmpty GetClientRect GetWindowLongW GetForegroundWindow DefWindowProcW GetWindowRect UnregisterClassA GetWindowThreadProcessId ScreenToClient IntersectRect ClientToScreen GetCursorPos LoadBitmapW CharNextW GetDlgCtrlID MapWindowPoints SetWindowPos SetTimer PeekMessageW AttachThreadInput IsWindow InflateRect SetForegroundWindow InvalidateRect GetMessageW GetWindowTextW KillTimer TranslateMessage MoveWindow PtInRect SetActiveWindow LoadCursorW DispatchMessageW GetClassInfoExW PostThreadMessageW OffsetRect GetKeyState DrawIconEx MonitorFromWindow SendMessageW SetCursor ReleaseCapture GetMonitorInfoW GetFocus FindWindowW EqualRect CopyRect IsChild SetCapture IsDialogMessageW SetWindowLongW ShowWindow WindowFromPoint GetDlgItem GetScrollPos RegisterWindowMessageW SetFocus CallWindowProcW LoadImageW ReleaseDC DrawFrameControl IsWindowVisible LoadIconW PostMessageW GetDC EndPaint GetActiveWindow IsRectEmpty DestroyIcon DrawTextW GetDesktopWindow BeginPaint IsWindowEnabled IsIconic UpdateLayeredWindow EnableWindow CreateWindowExW SetRect GetParent GetWindow DestroyWindow SetWindowRgn GetWindowTextLengthW FillRect RegisterClassExW

gdi32

OffsetRgn GetViewportOrgEx ExtSelectClipRgn SetViewportOrgEx SaveDC Rectangle CreatePen DeleteObject MoveToEx CreateFontIndirectW GetTextColor LineTo RoundRect GetDeviceCaps CreateCompatibleDC CreateRectRgn GetClipRgn GetObjectW CreateRoundRectRgn GetStockObject SelectClipRgn ExtTextOutW SetBkColor CreateDIBSection SetTextColor DeleteDC TextOutW RestoreDC BitBlt SetBkMode GetTextExtentPoint32W RectInRegion CreateCompatibleBitmap CreateRectRgnIndirect CreateBitmap StretchBlt CombineRgn SelectObject SetStretchBltMode GetCurrentObject CreateSolidBrush

advapi32

RegCloseKey OpenSCManagerW RegQueryInfoKeyW RegDeleteValueW CreateProcessAsUserW RegEnumKeyExW RegDeleteKeyW DuplicateTokenEx FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation SetTokenInformation RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegOpenKeyW CloseServiceHandle OpenServiceW ChangeServiceConfigW ChangeServiceConfig2W DeleteService QueryServiceStatus StartServiceW ControlService CreateServiceW

shell32

ShellExecuteW SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CreateStreamOnHGlobal CoInitializeEx CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysStringLen SysAllocString VarUI4FromStr SysFreeString

shlwapi

PathAppendW PathRemoveFileSpecW StrToIntW PathFileExistsW PathFindFileNameW StrToIntA PathIsDirectoryW PathAddBackslashW

comctl32

_TrackMouseEvent InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStream GdipGetImagePixelFormat GdipDrawImagePointsRectI GdipCloneBitmapArea GdipSetPenStartCap GdipSetPenEndCap GdipCreateBitmapFromScan0 GdipLoadImageFromStream GdipGetImageGraphicsContext GdipSetPixelOffsetMode GdipGetFamily GdipImageRotateFlip GdipScaleWorldTransform GdipAddPathStringI GdipSetInterpolationMode GdipGetFontSize GdipFillPath GdipDrawImageRectI GdipGraphicsClear GdipDrawImageI GdipDrawPath GdipAddPathArcI GdipDrawRectangleI GdipFillRectangle GdipSetCompositingQuality GdipCreateLineBrushFromRectWithAngleI GdipDrawLine GdipSetPenMode GdipCreateFont GdipClosePathFigure GdipCreateFromHDC GdipCreateSolidFill GdipTranslateWorldTransform GdipDeleteGraphics GdipNewPrivateFontCollection GdipDeleteFont GdipAddPathRectangleI GdipRotateWorldTransform GdipDeletePrivateFontCollection GdipCreateFontFromLogfontW GdipCreateImageAttributes GdipResetWorldTransform GdipDisposeImageAttributes GdiplusShutdown GdipPrivateAddFontFile GdipSetSmoothingMode GdipGetFontCollectionFamilyCount GdipDrawImageRectRectI GdipFillRectangleI GdipSetClipPath GdipDrawImageRectRect GdipGetImageHeight GdipSetImageAttributesColorMatrix GdiplusStartup GdipGetFontCollectionFamilyList GdipGetImageWidth GdipCloneFontFamily GdipCreateStringFormat GdipMeasureString GdipCreatePen1 GdipDisposeImage GdipDeleteStringFormat GdipCloneImage GdipDeletePen GdipSetStringFormatFlags GdipFree GdipLoadImageFromFile GdipDrawLinesI GdipSetStringFormatAlign GdipCloneBrush GdipSetStringFormatLineAlign GdipAlloc GdipDeleteFontFamily GdipSetStringFormatTrimming GdipDeleteBrush GdipCreatePath GdipSetTextRenderingHint GdipDeletePath GdipDrawString GdipAddPathPieI GdipSetPenDashStyle

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

psapi

GetModuleFileNameExW

??0?$_CallBack@VKSimpleDirectInfoc@@@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAE@ABU012@@Z ??0?$_CallBack@VKSimpleDirectInfoc@@@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAE@XZ ??0?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAE@XZ ??0?$kxThreadBase@VLocker@kbase@@@kbase@@QAE@XZ ??0ReportHelper@business_publish@@AAE@XZ ??1?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@UAE@XZ ??1?$kxThreadBase@VLocker@kbase@@@kbase@@UAE@XZ ??1ReportHelper@business_publish@@UAE@XZ ??4?$_CallBack@VKSimpleDirectInfoc@@@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAEAAU012@ABU012@@Z ??_7?$_CallBack@VKSimpleDirectInfoc@@@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@6B@ ??_7?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@6B@ ??_7?$kxThreadBase@VLocker@kbase@@@kbase@@6B@ ??_7ReportHelper@business_publish@@6B?$_CallBack@VKSimpleDirectInfoc@@@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@@ ??_7ReportHelper@business_publish@@6B?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@@ ?AddItem@ReportHelper@business_publish@@QAEHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAV?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@@2@@4@@Z ?AddItem@ReportHelper@business_publish@@QAEHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@HAAV?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@@2@@4@@Z ?AfterThreadFun@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@MAEXH@Z ?AfterThreadFun@?$kxThreadBase@VLocker@kbase@@@kbase@@MAEXH@Z ?BeginThreadFun@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@MAEXXZ ?BeginThreadFun@?$kxThreadBase@VLocker@kbase@@@kbase@@MAEXXZ ?GetHandle@?$kxThreadBase@VLocker@kbase@@@kbase@@QBEPAXXZ ?GetInstance@ReportHelper@business_publish@@SAPAV12@XZ ?Init@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAEXPAU?$_CallBack@VKSimpleDirectInfoc@@@12@K@Z ?Initialzie@ReportHelper@business_publish@@QAE_NW4ReportType@2@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?Insert@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAE_NABVKSimpleDirectInfoc@@@Z ?IsRunning@?$kxThreadBase@VLocker@kbase@@@kbase@@QAE_NXZ ?KCreateThread@?$kxThreadBase@VLocker@kbase@@@kbase@@SAPAXHP6GKPAX@Z0PAK0II@Z ?Kill@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@UAEHXZ ?Kill@?$kxThreadBase@VLocker@kbase@@@kbase@@UAEHXZ ?QueueThreadCallback@ReportHelper@business_publish@@MAEHKAAVKSimpleDirectInfoc@@@Z ?Report@ReportHelper@business_publish@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@@2@@4@PBV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@@Z ?ReportDirect@ReportHelper@business_publish@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$vector@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@@2@@4@PBV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@@Z ?SetPriority@?$kxThreadBase@VLocker@kbase@@@kbase@@QAEHH@Z ?SetTimeOut@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAEXK@Z ?Start@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAEHXZ ?StartThread@?$kxThreadBase@VLocker@kbase@@@kbase@@IAEHPAX@Z ?Thread@?$kxThreadBase@VLocker@kbase@@@kbase@@AAEIPAX@Z ?Uninitialize@ReportHelper@business_publish@@QAEXXZ ?WaitKill@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@UAEHK@Z ?WaitKill@?$kxThreadBase@VLocker@kbase@@@kbase@@UAEHK@Z ?size@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@QAEIXZ ?threadFun@?$kxThreadBase@VLocker@kbase@@@kbase@@CGIPAX@Z ?threadFunImpl@?$kxQueueThreadRun@VKSimpleDirectInfoc@@$03VLocker@kbase@@@kbase@@MAEHKPAX@Z

Sharing

General

Malware Config

Signatures

File Explorer

7b7555d38d153bd0c7599516f0615a9f63b41ba4e793f349583ec74ba6c78b9d

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

wtsapi32

psapi

generic