bce63c9bd533b9a96f16756399e565fe60d132d6e54bdf51c0d42599c1922271

Sharing

Copy URL Twitter E-mail

General

Target
bce63c9bd533b9a96f16756399e565fe60d132d6e54bdf51c0d42599c1922271
Size 3.4MB
Sample261102-mlzersvt6r
SHA256 bce63c9bd533b9a96f16756399e565fe60d132d6e54bdf51c0d42599c1922271
MD5 4a0d9dad8144711e3b7f7a7ca281f92f
SHA1 0f8815dc2052d14a97823009eaae53220b3782ef
SHA512 711d92ed0bb89b2651b017d999bfe3d853d92093b5b334aded16a44f3fd90d26f554cfaec4f5277a009ab3abbc071a788b3ebcb4982cc259855b63324f3c3e27
SSDEEP 98304:pNwTtx5aHvrku+ql3mC7evrXYMpLwLXz67K318m2If:UTtuvCu3mIevrXYMpLwLXz67K318m2If
TLSH
T119F5AE01F7428136F9B7047685FE563F593CAE10132499D3A3D83D2A4D75AE23A3736A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bce63c9bd533b9a96f16756399e565fe60d132d6e54bdf51c0d42599c1922271

File Explorer

bce63c9bd533b9a96f16756399e565fe60d132d6e54bdf51c0d42599c1922271

.exe 3.4MB

bce63c9bd533b9a96f16756399e565fe60d132d6e54bdf51c0d42599c1922271

IMPHASH 2f0e6d164995ba4a502c605b2f2f5d18
SHA256 bce63c9bd533b9a96f16756399e565fe60d132d6e54bdf51c0d42599c1922271
MD5 4a0d9dad8144711e3b7f7a7ca281f92f
SHA1 0f8815dc2052d14a97823009eaae53220b3782ef
SHA512 711d92ed0bb89b2651b017d999bfe3d853d92093b5b334aded16a44f3fd90d26f554cfaec4f5277a009ab3abbc071a788b3ebcb4982cc259855b63324f3c3e27
SSDEEP 98304:pNwTtx5aHvrku+ql3mC7evrXYMpLwLXz67K318m2If:UTtuvCu3mIevrXYMpLwLXz67K318m2If
TLSH
T119F5AE01F7428136F9B7047685FE563F593CAE10132499D3A3D83D2A4D75AE23A3736A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1626280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\sysoptasst\product\win32\dbginfo\uninstall.pdb

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateContext CertGetCertificateContextProperty

kernel32

FreeResource InterlockedDecrement InterlockedIncrement GetCurrentProcessId CreateProcessW lstrcmpW MapViewOfFileEx lstrcmpiW LoadLibraryExW GlobalFree GlobalUnlock GlobalLock GlobalAlloc WaitForMultipleObjects GetStdHandle GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW DeleteFiber QueryPerformanceCounter ConvertFiberToThread LoadLibraryA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW VirtualProtect ReadFile SetFilePointer CreateFileW CloseHandle WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW OutputDebugStringW GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP lstrcatW SetConsoleCtrlHandler ExitProcess FreeLibraryAndExitThread ExitThread GetCommandLineW GetCommandLineA SetStdHandle GetFullPathNameW RtlUnwind VerifyVersionInfoA GetSystemDirectoryA GetModuleHandleA VerSetConditionMask ExpandEnvironmentStringsA PeekNamedPipe FormatMessageA SleepEx LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW EncodePointer InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx lstrlenW GetFileSize HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap GetLastError MultiByteToWideChar GetLocalTime GetSystemDirectoryW SizeofResource LockResource LoadResource FindResourceW FindResourceExW WideCharToMultiByte FindFirstFileW FindClose WriteFile GetModuleFileNameW GetCurrentThreadId GetEnvironmentVariableW OutputDebugStringA InterlockedExchange WritePrivateProfileStringW GetSystemInfo InterlockedCompareExchange GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime Sleep SetFilePointerEx SetEndOfFile CreateFileMappingW CopyFileW MoveFileExW GetCurrentDirectoryW GetFileAttributesExW UnmapViewOfFile SetLastError FlushFileBuffers LocalFree DecodePointer RaiseException LocalAlloc MoveFileW SetFileAttributesW ResetEvent TerminateThread GetDriveTypeW WaitForSingleObject SetEvent CreateThread CreateEventW GetPrivateProfileStringW GetPrivateProfileIntW GetWindowsDirectoryW GetTickCount GetVersionExW InitializeCriticalSectionAndSpinCount TerminateProcess Process32NextW Module32FirstW Process32FirstW CreateToolhelp32Snapshot ReadProcessMemory ExpandEnvironmentStringsW GetCurrentProcess OpenProcess GetProcAddress LoadLibraryW GetModuleHandleW QueryDosDeviceW GetLogicalDriveStringsW RemoveDirectoryW DeleteFileW FindNextFileW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection FreeLibrary CreateDirectoryW GetFileAttributesW VirtualQuery

user32

LoadCursorW DefWindowProcW FindWindowW EnumDisplaySettingsW GetMonitorInfoW CharNextW SetWindowTextW LoadBitmapW GetWindowTextW GetWindowTextLengthW CreateWindowExW GetDesktopWindow RegisterWindowMessageW UnregisterClassW ScreenToClient SetFocus GetNextDlgTabItem ReleaseCapture GetCursorPos SetCapture RegisterClassExW MonitorFromWindow MapWindowPoints GetWindow IsDialogMessageW FillRect GetProcessWindowStation GetUserObjectInformationW ReleaseDC GetDC GetDlgItem ShowWindow SendMessageW GetDlgCtrlID DrawTextW InflateRect SetRect DrawIconEx PtInRect SetCursor DestroyIcon SetRectEmpty CopyRect IntersectRect IsWindow OffsetRect GetParent LoadImageW LoadIconW SetWindowPos InvalidateRect IsWindowVisible EqualRect SetWindowLongW GetWindowLongW CallWindowProcW KillTimer IsRectEmpty ClientToScreen DestroyWindow MoveWindow SetTimer PeekMessageW GetMessageW TranslateMessage DispatchMessageW PostThreadMessageW GetClientRect GetActiveWindow IsWindowEnabled EnableWindow GetWindowThreadProcessId GetForegroundWindow SystemParametersInfoW AttachThreadInput SetForegroundWindow PostMessageW SetActiveWindow UpdateLayeredWindow GetWindowRect EndPaint BeginPaint GetClassInfoExW IsIconic SetWindowRgn GetFocus MessageBoxW IsChild

gdi32

CreateCompatibleBitmap CreateBitmap StretchBlt GetStretchBltMode SetStretchBltMode CreateRoundRectRgn SetViewportOrgEx OffsetRgn ExtSelectClipRgn CombineRgn GetViewportOrgEx RoundRect CreateRectRgn GetClipRgn CreatePen MoveToEx LineTo CreateRectRgnIndirect SaveDC SelectClipRgn GetTextExtentPoint32W TextOutW RestoreDC BitBlt CreateDIBSection GdiFlush GetClipBox RectInRegion ExtTextOutW Rectangle GetCurrentObject GetTextColor SetTextColor SetBkMode SetBkColor DeleteDC CreateCompatibleDC GetObjectW GetStockObject CreateFontIndirectW DeleteObject SelectObject GetDeviceCaps CreateSolidBrush

advapi32

RegCreateKeyExW RegOpenKeyW RegSetValueExW RegQueryValueExW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW OpenProcessToken CryptEncrypt CryptImportKey CryptHashData CryptGetHashParam CryptAcquireContextA LookupPrivilegeValueW AdjustTokenPrivileges CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegDeleteValueW RegQueryInfoKeyW ControlService StartServiceW DeleteService ChangeServiceConfig2W ChangeServiceConfigW CreateServiceW CloseServiceHandle QueryServiceStatus OpenServiceW OpenSCManagerW RegCloseKey

shell32

SHCreateDirectoryExW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFolderPathW ShellExecuteW ord680 SHGetSpecialFolderPathW ShellExecuteExW

ole32

CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

SysStringLen SysAllocString VarUI4FromStr SysFreeString

shlwapi

PathAddBackslashW StrToIntA PathRemoveBackslashW PathStripPathW PathCanonicalizeW StrToIntW PathFindFileNameW PathAppendW PathRemoveFileSpecW PathFileExistsW PathIsDirectoryW

comctl32

_TrackMouseEvent InitCommonControlsEx DrawShadowText

msimg32

AlphaBlend

gdiplus

GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipImageRotateFlip GdipCreateHBITMAPFromBitmap GdipDrawLinesI GdipSetCompositingQuality GdipAddPathArcI GdipDrawRectangleI GdipDrawImagePointsRectI GdipSetCompositingMode GdipGetImagePixelFormat GdipDrawLine GdipSetPenMode GdipFillRectangle GdipCloneBitmapArea GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipGetFamily GdipAddPathStringI GdipGetFontSize GdipGraphicsClear GdipDrawImageRectI GdipDrawImageI GdipAddPathLineI GdipScaleWorldTransform GdipFillPath GdipSetPixelOffsetMode GdipCreateLineBrushFromRectWithAngleI ord1 GdipAddPathLine GdipDrawPath GdipSetPenDashStyle GdipSetPenStartCap GdipSetPenEndCap GdipDeletePen GdipCreatePen1 GdipCreatePath GdipDeletePath GdipAddPathPieI GdipAddPathRectangleI GdipClosePathFigure GdipSetSmoothingMode GdipSetClipPath GdipSetInterpolationMode GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipDrawImageRectRect GdipLoadImageFromFileICM GdipLoadImageFromFile GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipTranslateWorldTransform GdipRotateWorldTransform GdipDrawImageRectRectI GdipResetWorldTransform GdipFillRectangleI GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipSetTextRenderingHint GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipCreateFromHDC GdipDeleteGraphics GdiplusShutdown GdiplusStartup GdipNewPrivateFontCollection GdipDeletePrivateFontCollection GdipPrivateAddFontFile GdipGetFontCollectionFamilyCount GdipGetFontCollectionFamilyList GdipCloneFontFamily GdipDeleteFontFamily GdipCreateFont GdipAlloc GdipCreateFontFromLogfontW GdipCreateFontFromDC GdipDeleteFont GdipFree GdipSetStringFormatAlign GdipMeasureString GdipStartPathFigure

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

bcrypt

BCryptGenRandom

wldap32

ord33 ord32 ord27 ord26 ord22 ord35 ord50 ord60 ord211 ord46 ord143 ord79 ord30 ord200 ord301 ord41

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

573KB

Virtual Size

573KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

596B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

620KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=18, id=241, version=40116,

count=194, id=243, version=40116,

count=31, id=242, version=40116,

count=90, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=261, version=23013,

count=8, id=199, version=41118,

count=27, id=259, version=24123,

count=38, id=260, version=24123,

count=68, id=261, version=24123,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=22, productName=Unmarked objects (old),

count=489, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=591, id=1, productName=Unmarked objects,

count=93, id=264, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=2, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,