83aee8e5546c1367d18ecd3199304a72d21dbc2ec82178a7bab19b7eb11823c6

Sharing

Copy URL Twitter E-mail

General

Target
83aee8e5546c1367d18ecd3199304a72d21dbc2ec82178a7bab19b7eb11823c6
Size 524KB
Sample261102-km26yaef22
SHA256 83aee8e5546c1367d18ecd3199304a72d21dbc2ec82178a7bab19b7eb11823c6
MD5 b352ce91959e94295948cada78ad74fb
SHA1 1e744706296cb77211f7e1aa962ae18835ce9def
SHA512 93e05c6c3a0f7e1daa3c07efe84242d52dd0da2d558fa36dc545cf7476d0a226d2434c88eade5719b24f306166ba0e54cf14b3ba8208fb49565652c0573642de
SSDEEP 12288:IVLOygITVNx3lqHWhK0+SbmUU6splXiy7BEp9:WOyg2Nx3cHWhK0xmt6snix7
TLSH
T10BB4B1C165D88C31E2F6D73074E296234536ADE21E3B898FF2F036591F386A0D72563A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83aee8e5546c1367d18ecd3199304a72d21dbc2ec82178a7bab19b7eb11823c6

File Explorer

83aee8e5546c1367d18ecd3199304a72d21dbc2ec82178a7bab19b7eb11823c6

.exe 524KB

83aee8e5546c1367d18ecd3199304a72d21dbc2ec82178a7bab19b7eb11823c6

IMPHASH 93cb72f2c9e2f9e6f4f09c68fff6d28b
SHA256 83aee8e5546c1367d18ecd3199304a72d21dbc2ec82178a7bab19b7eb11823c6
MD5 b352ce91959e94295948cada78ad74fb
SHA1 1e744706296cb77211f7e1aa962ae18835ce9def
SHA512 93e05c6c3a0f7e1daa3c07efe84242d52dd0da2d558fa36dc545cf7476d0a226d2434c88eade5719b24f306166ba0e54cf14b3ba8208fb49565652c0573642de
SSDEEP 12288:IVLOygITVNx3lqHWhK0+SbmUU6splXiy7BEp9:WOyg2Nx3cHWhK0xmt6snix7
TLSH
T10BB4B1C165D88C31E2F6D73074E296234536ADE21E3B898FF2F036591F386A0D72563A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13348

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\home\jenkins\agent\workspace\s_TANG_Software_TVSU_TVSU_master\tvsu\Output\tvsu.pdb

kernel32

GlobalFree LoadLibraryW LoadResource FindResourceW GlobalLock OpenMutexW GlobalUnlock MulDiv SetUnhandledExceptionFilter DecodePointer GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx Process32FirstW GetProcessHeap LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle GlobalAlloc Process32NextW GetLastError Sleep CreateToolhelp32Snapshot FreeResource GetVersionExW WaitForSingleObject CreateMutexW GetCurrentProcess SizeofResource GetCurrentProcessId CreateFileW WriteFile FreeLibrary GetProcAddress CloseHandle GetVersionExA LoadLibraryA OpenProcess TerminateProcess SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte WriteConsoleW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType HeapAlloc HeapFree GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle LoadLibraryExW TlsFree TlsSetValue TlsGetValue UnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc

user32

KillTimer GetClientRect SetWindowLongW FindWindowW GetDesktopWindow TranslateMessage SetTimer DispatchMessageW ShowWindow PostQuitMessage UpdateWindow BeginPaint EndPaint ReleaseDC CreateDialogParamW LoadStringW GetMessageW SendMessageW DestroyWindow GetDC SetWindowPos MessageBoxW

gdi32

GetDeviceCaps

advapi32

RegCloseKey EqualSid AllocateAndInitializeSid OpenProcessToken FreeSid RegOpenKeyExW RegGetValueW GetUserNameW LookupAccountSidW RegQueryValueExW GetTokenInformation

shell32

ShellExecuteExW

ole32

CreateStreamOnHGlobal

shlwapi

StrCmpW

gdiplus

GdipLoadImageFromStream GdipDeleteFont GdipDeleteGraphics GdipCreateFromHDC GdipDrawString GdipFree GdipCreateSolidFill GdipCreateFont GdipDisposeImage GdipDrawImageRectI GdipAlloc GdipDeleteBrush GdipCloneImage GdipCreateFontFamilyFromName GdipDeleteFontFamily GdiplusShutdown GdiplusStartup

Name

.text

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

328KB

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

73KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

83aee8e5546c1367d18ecd3199304a72d21dbc2ec82178a7bab19b7eb11823c6

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

gdiplus

generic