13289a1a991ea0b31e5122f5d9f751ba00261976a6d2706b8c379808c0dec6e9

Sharing

Copy URL Twitter E-mail

General

Target
13289a1a991ea0b31e5122f5d9f751ba00261976a6d2706b8c379808c0dec6e9
Size 1.5MB
Sample261102-jtsemsf19s
SHA256 13289a1a991ea0b31e5122f5d9f751ba00261976a6d2706b8c379808c0dec6e9
MD5 18260541a71a3dd09bb4d323fbf294d2
SHA1 d5ba3f4136e0bdf85a4a012c5d7edd0f7763da25
SHA512 9c8175dc37892a3ff509d3d183df1286782263f4e261fef937b8c06ca8bec5c0fc1fded8b7c4523718702ca2432b2262f123aa181b7f9850849e690b11c39dd7
SSDEEP 24576:fOs2h85LvbJDOYLfBExLJxBPeh5IwFieFT3u3kFskY/X65KFg0pzC8kK:2sJVjJKcfCJbPeciif3hf65K20hrX
TLSH
T1BF75AE20B693D03AD56204324D7AC5EE2564BF704F27448B7BC83B3E3B756E1AE72256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13289a1a991ea0b31e5122f5d9f751ba00261976a6d2706b8c379808c0dec6e9

File Explorer

13289a1a991ea0b31e5122f5d9f751ba00261976a6d2706b8c379808c0dec6e9

.exe 1.5MB

13289a1a991ea0b31e5122f5d9f751ba00261976a6d2706b8c379808c0dec6e9

IMPHASH dfda9dd782df139a140c1260644c11c3
SHA256 13289a1a991ea0b31e5122f5d9f751ba00261976a6d2706b8c379808c0dec6e9
MD5 18260541a71a3dd09bb4d323fbf294d2
SHA1 d5ba3f4136e0bdf85a4a012c5d7edd0f7763da25
SHA512 9c8175dc37892a3ff509d3d183df1286782263f4e261fef937b8c06ca8bec5c0fc1fded8b7c4523718702ca2432b2262f123aa181b7f9850849e690b11c39dd7
SSDEEP 24576:fOs2h85LvbJDOYLfBExLJxBPeh5IwFieFT3u3kFskY/X65KFg0pzC8kK:2sJVjJKcfCJbPeciif3hf65K20hrX
TLSH
T1BF75AE20B693D03AD56204324D7AC5EE2564BF704F27448B7BC83B3E3B756E1AE72256
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

399872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

P:\git_dir_2\TCLS\NTCLS\build\bin\Release\uishell.pdb

kernel32

GetTickCount WriteFile FindClose FindNextFileW FindFirstFileW SearchPathW GetLongPathNameW CreateMutexW Process32NextW OpenProcess Process32FirstW CreateToolhelp32Snapshot OpenFileMappingA QueryDosDeviceW GetLogicalDriveStringsW Module32NextW Module32FirstW GetModuleHandleW GetModuleFileNameW GetFileAttributesW GetCurrentThreadId DeleteFileW OpenMutexW FreeLibrary GetCommandLineW GetCurrentProcessId lstrlenW WideCharToMultiByte CreateFileW GetFileSize CloseHandle CopyFileW CreateFileMappingW MapViewOfFile SetEnvironmentVariableA CompareStringW WriteConsoleW FlushFileBuffers GetProcessHeap SetEndOfFile SetStdHandle HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetConsoleMode GetConsoleCP QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA HeapCreate SetFilePointer SetHandleCount UnmapViewOfFile SetFileAttributesW GetPrivateProfileIntW SetLastError WritePrivateProfileStringW GetLastError lstrlenA MultiByteToWideChar OutputDebugStringW LoadLibraryW GetProcAddress ReadFile GetCurrentDirectoryW GetFileType PeekNamedPipe GetFileInformationByHandle GetFullPathNameW InitializeCriticalSectionAndSpinCount GetStringTypeW ExitProcess GetModuleHandleA LoadLibraryA GetCurrentProcess FlushInstructionCache VirtualAlloc CreateFileMappingA CreateFileA VirtualFree lstrcmpiA VirtualProtect VirtualQuery GetCurrentDirectoryA GetUserDefaultLCID GetSystemDefaultLCID GetThreadLocale lstrcmpA MulDiv lstrcpyA lstrcpyW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection OutputDebugStringA RtlUnwind DecodePointer EncodePointer RaiseException GetLocalTime GetTimeZoneInformation GetSystemTimeAsFileTime CreateDirectoryW FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileExW HeapAlloc HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement GetStdHandle GetLocaleInfoW GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW Sleep HeapSize GetPrivateProfileStringW

user32

SetWindowPos IsWindow PostQuitMessage SetCursor ClipCursor EndDialog DialogBoxParamW BeginPaint GetClientRect DrawTextW EndPaint LoadIconW LoadCursorW RegisterClassExW LoadStringW LoadAcceleratorsW GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW UpdateWindow DefWindowProcW MessageBoxW KillTimer SendMessageA RegisterWindowMessageA RedrawWindow RegisterClassExA wsprintfA UnregisterClassA CreateIconFromResource LookupIconIdFromDirectory LoadMenuIndirectA DefWindowProcA GetParent InvalidateRect ReleaseCapture SetCapture GetWindowLongA ReleaseDC GetDC CreateAcceleratorTableA FillRect InvalidateRgn PostMessageA GetWindowDC GetUpdateRect GetWindow IsChild GetFocus SetFocus DestroyAcceleratorTable SetWindowLongA CallWindowProcA SetWindowsHookExA UnhookWindowsHookEx CallNextHookEx SetTimer PostMessageW DestroyWindow SendMessageW ShowWindow FindWindowExW GetDesktopWindow GetWindowRect CreateWindowExW SetWindowTextW MoveWindow GetWindowLongW SetWindowLongW SetForegroundWindow

shell32

ShellExecuteExW

bugrpt

BR_pfPreBugReport BR_pfPostBugReport BR_Init BR_SetUin BR_SetVersion BR_SetLogSession BR_SetLcid BR_SetSender BR_SetSenderExtCmd BR_SetLogFileMd5Dir

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

psapi

GetModuleFileNameExA GetProcessImageFileNameW

ws2_32

inet_addr ntohl inet_ntoa

gdi32

DeleteDC GetDeviceCaps CreateDCA DeleteObject SelectObject CreateCompatibleBitmap CreateCompatibleDC BitBlt GetRgnBox SelectClipRgn CreateRectRgnIndirect CreateDIBSection CreateSolidBrush

ole32

CreateStreamOnHGlobal OleLockRunning CoCreateGuid CoInitialize CoUninitialize

oleaut32

SysFreeString SysAllocString

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

Sharing

General

Malware Config

Signatures

File Explorer

13289a1a991ea0b31e5122f5d9f751ba00261976a6d2706b8c379808c0dec6e9

kernel32

user32

shell32

bugrpt

version

psapi

ws2_32

gdi32

ole32

oleaut32

advapi32

generic