41faaaeddd74688be12d774f47c7501ec7329ce5a5d513b1927c9b5a4a32498f

Sharing

Copy URL Twitter E-mail

General

Target
41faaaeddd74688be12d774f47c7501ec7329ce5a5d513b1927c9b5a4a32498f
Size 4.5MB
Sample261104-3ftkbsd191
SHA256 41faaaeddd74688be12d774f47c7501ec7329ce5a5d513b1927c9b5a4a32498f
MD5 70e1318b61b91d058c2dfdb6199651a7
SHA1 af0c98c2bdb71bf01ce22fd7a2641bb2ae356089
SHA512 a62a1d2666d59a2c184ac00d21cabbb361892307944f8522e51a23cc3d9330102a17649b14f36ad19a7fe6342cb2545dc83817c8fdd78bc93477a60c58f698ea
SSDEEP 98304:NMsl4BlpU+XUUslcJ8yhD8XZevtxaUA5e3sAIRXC8qezZOpZbS:NV8pflBvpcAIRXC8VOpZbS
TLSH
T1E2265B713E5E4021C13A223087AEFAE6F56A5F247BEA41D70254B759DB303A1CF32676
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41faaaeddd74688be12d774f47c7501ec7329ce5a5d513b1927c9b5a4a32498f

File Explorer

41faaaeddd74688be12d774f47c7501ec7329ce5a5d513b1927c9b5a4a32498f

.exe 4.5MB

41faaaeddd74688be12d774f47c7501ec7329ce5a5d513b1927c9b5a4a32498f

IMPHASH 3827af88d6c6a1de34503e9881f100fc
SHA256 41faaaeddd74688be12d774f47c7501ec7329ce5a5d513b1927c9b5a4a32498f
MD5 70e1318b61b91d058c2dfdb6199651a7
SHA1 af0c98c2bdb71bf01ce22fd7a2641bb2ae356089
SHA512 a62a1d2666d59a2c184ac00d21cabbb361892307944f8522e51a23cc3d9330102a17649b14f36ad19a7fe6342cb2545dc83817c8fdd78bc93477a60c58f698ea
SSDEEP 98304:NMsl4BlpU+XUUslcJ8yhD8XZevtxaUA5e3sAIRXC8qezZOpZbS:NV8pflBvpcAIRXC8VOpZbS
TLSH
T1E2265B713E5E4021C13A223087AEFAE6F56A5F247BEA41D70254B759DB303A1CF32676
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2426883

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Sillage\Desktop\Source\DLoader\ResearchDownload_Release\ResearchDownload.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

processflow

WriteDataToFlow DisconnectDB ConnectDB ExitProcessFlow CheckProcessEnable InitProcessFlow

porthound

ReleaseDevHound CreateDevHound

sprdmesapp

MES_InitTest MES_CheckPreStation MES_GetLastError MES_WriteTestResult MES_GetBatchName MES_Release MES_Disconnect MES_EnableCheck MES_GetBatchInfo MES_Create

secbinpack9

CreateSecPacParse

liveupdatesdll

CheckToolVerUpdate

wininet

InternetGetConnectedState

kernel32

FindResourceExW GetFileAttributesExW LocalFileTimeToFileTime SetErrorMode GetWindowsDirectoryW VerSetConditionMask VerifyVersionInfoW GetProfileIntW SearchPathW LocalLock LocalUnlock UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent WaitForSingleObjectEx QueryPerformanceCounter LocalReAlloc InitializeSListHead IsDebuggerPresent GetStartupInfoW LocalAlloc GetUserDefaultUILanguage GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GlobalGetAtomNameW GetThreadLocale GetStringTypeExW MoveFileW lstrcmpiW GetCurrentProcess DuplicateHandle UnlockFile SetEndOfFile LockFile GetVolumeInformationW GetShortPathNameW GetUserDefaultLCID SystemTimeToFileTime GetOEMCP GetSystemDefaultUILanguage GetLocaleInfoW GlobalFlags GlobalHandle OutputDebugStringW FormatMessageA SwitchToThread LCMapStringW GetStringTypeW GetCPInfo RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetCommandLineA GetCommandLineW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW HeapQueryInformation GetSystemInfo VirtualAlloc VirtualQuery QueryPerformanceFrequency SetStdHandle GetFileType GetStdHandle ExitProcess GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetConsoleCP GetConsoleMode SetFilePointerEx ReplaceFileW SetFileTime GetTempFileNameW GetFullPathNameW GetDiskFreeSpaceW CompareStringA GetCurrentThread ResumeThread SuspendThread SetThreadPriority lstrcmpA GetVersionExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FileTimeToLocalFileTime VirtualProtect GetCurrentProcessId CompareStringW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryA LoadLibraryExW GetModuleHandleW GetModuleHandleA GetCurrentThreadId EncodePointer OutputDebugStringA ReadConsoleW GetDriveTypeW FindFirstFileExW IsValidCodePage GetACP CopyFileW FormatMessageW MulDiv GetAtomNameW LocalFree GlobalFree GlobalUnlock GlobalLock GlobalSize GlobalAlloc SetLastError GetComputerNameExW lstrcpynW lstrlenW lstrcatW lstrcpyW InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy RaiseException DecodePointer RemoveDirectoryW Process32NextW Process32FirstW CreateToolhelp32Snapshot OpenProcess TerminateProcess QueryDosDeviceW CreateNamedPipeW ConnectNamedPipe FlushFileBuffers IsBadWritePtr IsBadReadPtr GetPrivateProfileStringA GetPrivateProfileIntA lstrlenA GetModuleFileNameA GetFileTime UnmapViewOfFile GetSystemDirectoryW GetLocalTime Sleep CreateEventW WaitForSingleObject ResetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CloseHandle GetTempPathW WriteFile SetFilePointer ReadFile GetFileSizeEx GetFileSize FindNextFileW DeleteFileW CreateFileW CreateDirectoryW GetCurrentDirectoryW WritePrivateProfileSectionW GetPrivateProfileSectionW FindFirstFileW FindClose SetEvent LoadLibraryW GetProcAddress GetModuleFileNameW FreeLibrary GetLastError WritePrivateProfileStringW SetFileAttributesW GetFileAttributesW GetTickCount WideCharToMultiByte MultiByteToWideChar GetPrivateProfileStringW GetPrivateProfileIntW FindResourceW SizeofResource LockResource LoadResource GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetConsoleCtrlHandler SetCurrentDirectoryW GetSystemTimeAsFileTime WriteConsoleW

user32

GetMenuDefaultItem NotifyWinEvent InvertRect HideCaret EnableScrollBar GetIconInfo DrawIconEx UnionRect GetNextDlgGroupItem InvalidateRgn CopyAcceleratorTableW CharNextW SetParent DeleteMenu CopyImage TrackMouseEvent RealChildWindowFromPoint LoadCursorW GetSysColorBrush GetDialogBaseUnits ReuseDDElParam UnpackDDElParam GetMenuBarInfo DestroyIcon InsertMenuItemW CreatePopupMenu TranslateAcceleratorW LoadAcceleratorsW BringWindowToTop GetMenuItemInfoW DestroyMenu CharUpperW SetWindowContextHelpId SetCursor ShowOwnedPopups PostQuitMessage GetMessageW IntersectRect MapVirtualKeyW GetKeyNameTextW MapDialogRect GetAsyncKeyState WindowFromPoint GetCursorPos ClientToScreen GetWindowDC TabbedTextOutW GrayStringW DrawTextExW GetWindowThreadProcessId LoadMenuW GetActiveWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW IsDialogMessageW SetWindowTextW ScrollWindowEx IsWindowEnabled SendDlgItemMessageW IsDlgButtonChecked CheckRadioButton CheckDlgButton GetDlgItemTextW SetDlgItemTextW GetDlgItemInt SetDlgItemInt MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassLongW SetWindowLongW EqualRect MessageBoxW AdjustWindowRectEx RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange ScrollWindow RedrawWindow ValidateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow EnumDisplayMonitors TrackPopupMenuEx TrackPopupMenu SetMenu GetMenu GetDlgCtrlID GetDlgItem IsIconic IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement SetWindowPos DestroyWindow IsChild IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime RegisterWindowMessageW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW SetClassLongW SetWindowRgn DrawEdge SetCursorPos CopyIcon GetDCEx LockWindowUpdate RegisterClipboardFormatW UpdateLayeredWindow CheckMenuItem SetRectEmpty SendDlgItemMessageA GetWindowLongW GetWindowTextLengthW GetScrollPos SetScrollPos SetFocus RemoveMenu AppendMenuW InsertMenuW MonitorFromPoint GetComboBoxInfo PostThreadMessageW WaitMessage GetKeyboardLayout IsCharLowerW MapVirtualKeyExW ToUnicodeEx GetKeyboardState GetMenuItemCount GetMenuItemID GetSubMenu GetMenuState GetMenuStringW GetDesktopWindow DrawIcon PtInRect OffsetRect DrawFocusRect MapWindowPoints ScreenToClient GetSystemMetrics ReleaseCapture SetCapture GetCapture GetMessagePos DrawFrameControl UnregisterClassW GetWindow GetClassNameW ReleaseDC GetDC LoadImageW IsRectEmpty FrameRect EnumWindows GetWindowTextW EnableMenuItem GetSystemMenu PeekMessageW GetKeyState MessageBeep SetRect GetCaretPos keybd_event InflateRect KillTimer SetTimer IsWindow SubtractRect UpdateWindow PostMessageW GetFocus FillRect CopyRect IsZoomed LoadBitmapW GetClientRect GetSysColor DrawTextW GetParent DispatchMessageW TranslateMessage GetWindowRect LoadIconW InvalidateRect EnableWindow SendMessageW CreateAcceleratorTableW DestroyAcceleratorTable SetLayeredWindowAttributes SetMenuDefaultItem GetDoubleClickTime ModifyMenuW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect EnumChildWindows DrawMenuBar DefFrameProcW TranslateMDISysAccel SendNotifyMessageW MonitorFromRect InSendMessage DefMDIChildProcW GetTabbedTextExtentW DestroyCursor GetWindowRgn WindowFromDC SetActiveWindow CreateMenu SystemParametersInfoW

gdi32

SetStretchBltMode SetTextCharacterExtra SetTextAlign SetTextJustification PlayMetaFileRecord EnumMetaFile SetWorldTransform ModifyWorldTransform SetColorAdjustment StartDocW ArcTo PolyDraw SelectClipPath SetArcDirection SetGraphicsMode ExtCreatePen MoveToEx TextOutW PolyBezierTo PolylineTo SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateRectRgnIndirect PatBlt CombineRgn GetMapMode SetRectRgn DPtoLP GetBkColor GetCharWidthW StretchDIBits EnumFontFamiliesExW GetRgnBox CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries SetBkColor CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetDIBits SetPixel StretchBlt SetDIBColorTable CreateEllipticRgn Ellipse CreatePolygonRgn Polygon Polyline CreateRoundRectRgn LPtoDP OffsetRgn GetCurrentObject RoundRect FillRgn FrameRgn GetBoundsRect PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx CloseMetaFile CreateMetaFileW DeleteMetaFile EndDoc StartPage EndPage AbortDoc SetAbortProc GetROP2 GetBkMode GetNearestColor GetPolyFillMode GetStretchBltMode GetTextAlign GetTextFaceW SetMapperFlags SelectPalette ExtSelectClipRgn CreateBitmap GetDeviceCaps CreateDCW CopyMetaFileW CreateDIBSection CreateFontW ExtTextOutW Rectangle CreatePen GetTextMetricsW DeleteDC GetTextExtentPoint32W SetTextColor SetBkMode DeleteObject CreateSolidBrush GetTextColor CreateCompatibleBitmap GetObjectW CreateFontIndirectW CreateCompatibleDC BitBlt SelectObject GetStockObject SetROP2 SetPolyFillMode GetLayout RealizePalette SetMapMode SelectClipRgn SaveDC RestoreDC RectVisible PtVisible PlayMetaFile OffsetClipRgn LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetPixel GetObjectType GetCurrentPositionEx GetClipRgn GetClipBox ExcludeClipRect Escape CreateRectRgn CreatePatternBrush CreateHatchBrush CreateDIBPatternBrushPt SetLayout

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter GetJobW DocumentPropertiesW OpenPrinterW

advapi32

GetFileSecurityW CryptReleaseContext CryptGenRandom RegCloseKey RegSetValueW RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegSetValueExW RegEnumKeyExW RegEnumValueW SetFileSecurityW CryptAcquireContextW RegQueryValueW RegEnumKeyW

shell32

SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW SHGetFileInfoW DragQueryFileW DragFinish SHAddToRecentDocs ExtractIconW SHGetSpecialFolderLocation SHGetDesktopFolder SHAppBarMessage ShellExecuteExW SHGetMalloc

comctl32

ImageList_AddMasked ImageList_GetIconSize ImageList_Draw ImageList_DrawEx ImageList_BeginDrag ImageList_EndDrag ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock

shlwapi

PathRemoveFileSpecW StrFormatKBSizeW PathFindFileNameW PathFindExtensionW PathFileExistsW PathIsUNCW PathStripToRootW PathRemoveExtensionW

uxtheme

DrawThemeBackground OpenThemeData GetThemeSysColor GetWindowTheme GetThemePartSize CloseThemeData GetCurrentThemeName GetThemeColor DrawThemeText DrawThemeParentBackground IsAppThemed IsThemeBackgroundPartiallyTransparent

ole32

CreateOleAdviseHolder StgOpenStorageOnILockBytes CreateILockBytesOnHGlobal CreateStreamOnHGlobal OleRun CoFreeUnusedLibraries OleSetClipboard OleFlushClipboard OleIsCurrentClipboard DoDragDrop OleGetClipboard CoLockObjectExternal RegisterDragDrop RevokeDragDrop CoRegisterClassObject CoRevokeClassObject CoRegisterMessageFilter OleSetMenuDescriptor OleLockRunning StgCreateDocfile StgOpenStorage StgIsStorageFile CreateFileMoniker OleCreateMenuDescriptor OleDestroyMenuDescriptor OleRegGetUserType StgCreateDocfileOnILockBytes CoGetClassObject CoDisconnectObject StringFromGUID2 PropVariantCopy CLSIDFromProgID CLSIDFromString CoCreateGuid OleTranslateAccelerator IsAccelerator CoCreateInstance CoInitializeEx SetConvertStg CreateDataAdviseHolder ReleaseStgMedium OleDuplicateData ReadFmtUserTypeStg WriteFmtUserTypeStg CreateBindCtx CoTreatAsClass WriteClassStg ReadClassStg CoTaskMemFree CoTaskMemAlloc StringFromCLSID CoInitialize CoUninitialize OleUninitialize OleInitialize OleRegGetMiscStatus OleRegEnumVerbs WriteClassStm GetHGlobalFromILockBytes CreateGenericComposite CreateItemMoniker OleCreate OleCreateFromData OleCreateLinkFromData OleCreateStaticFromData OleCreateLinkToFile OleCreateFromFile OleLoad OleSave OleSaveToStream OleSetContainedObject OleGetIconOfClass GetRunningObjectTable OleQueryCreateFromData OleQueryLinkFromData CoGetMalloc OleIsRunning

oleaut32

VarBstrFromDate VarBstrFromCy VarCyFromStr VarDateFromStr VariantCopy SafeArrayPtrOfIndex SafeArrayCopy SafeArrayPutElement SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound VarBstrFromDec VarDecFromStr OleCreateFontIndirect SafeArrayGetElemsize SafeArrayGetDim SafeArrayRedim SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor SafeArrayCreate SafeArrayAllocData SafeArrayAllocDescriptor VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SysReAllocStringLen RegisterTypeLi LoadRegTypeLi LoadTypeLi SysAllocString VariantChangeType VariantClear VariantInit SysAllocStringLen SysAllocStringByteLen SysStringByteLen SysFreeString

oledlg

OleUIBusyW

gdiplus

GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdiplusShutdown

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

generic

count=30, id=259, version=26715,

count=2, id=199, version=41118,

count=38, id=260, version=26715,

count=211, id=261, version=26715,

count=3, id=262, version=26715,

count=2, id=19, version=8034,

count=20, id=260, version=29118,

count=26, id=259, version=29118,

count=402, id=261, version=29118,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=257, productName=VS2019 v16.8.3 build 29335, version=29335,

count=2, id=156, productName=VS2010 build 30319, version=30319,

count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=37, id=257, version=26715,

count=832, id=1, productName=Unmarked objects,

count=44, id=261, productName=VS2019 v16.8.3 build 29335, version=29335,

count=3, id=260, productName=VS2019 v16.8.3 build 29335, version=29335,

count=1, id=255, productName=VS2019 v16.8.3 build 29335, version=29335,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.8.3 build 29335, version=29335,