96b19dc3232604c2876a97aa8e8dc781d0225e61dc2980494489c485a6e9e655

Sharing

Copy URL Twitter E-mail

General

Target
96b19dc3232604c2876a97aa8e8dc781d0225e61dc2980494489c485a6e9e655
Size 1.9MB
Sample261110-j321fadh85
SHA256 96b19dc3232604c2876a97aa8e8dc781d0225e61dc2980494489c485a6e9e655
MD5 24d5308bf14a527530a3ea59aaa4ff3c
SHA1 e432deb9976e4c5245d620d877c06c5257a7a56e
SHA512 e0c1febcec70fd859f302f1aec085cf1c26e70e9e775255d18e12001740ace93005e650995a639764e61a6fd739364b24acf6753332429f64efbfe9b22fbb02e
SSDEEP 49152:61Ofq7gvMko3cuRo5qN+690m+9kimsStV0sOgXb4/QQ:YmSo5ThStV0sOOk/Q
TLSH
T16D95CF203602C036D5A091B04D2CEBAA445DAE344F3756DBB3D85F2E5A715D36F3AE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96b19dc3232604c2876a97aa8e8dc781d0225e61dc2980494489c485a6e9e655

File Explorer

96b19dc3232604c2876a97aa8e8dc781d0225e61dc2980494489c485a6e9e655

.exe 1.9MB

96b19dc3232604c2876a97aa8e8dc781d0225e61dc2980494489c485a6e9e655

IMPHASH 4c369c716db07459c7eaf251e1343bc5
SHA256 96b19dc3232604c2876a97aa8e8dc781d0225e61dc2980494489c485a6e9e655
MD5 24d5308bf14a527530a3ea59aaa4ff3c
SHA1 e432deb9976e4c5245d620d877c06c5257a7a56e
SHA512 e0c1febcec70fd859f302f1aec085cf1c26e70e9e775255d18e12001740ace93005e650995a639764e61a6fd739364b24acf6753332429f64efbfe9b22fbb02e
SSDEEP 49152:61Ofq7gvMko3cuRo5qN+690m+9kimsStV0sOgXb4/QQ:YmSo5ThStV0sOOk/Q
TLSH
T16D95CF203602C036D5A091B04D2CEBAA445DAE344F3756DBB3D85F2E5A715D36F3AE2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

314200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\.jenkins\workspace\pay_group\index_service\index_service\out\Release\index_service.pdb

kernel32

GetLongPathNameW QueryDosDeviceW DeviceIoControl lstrlenW CreateToolhelp32Snapshot Process32FirstW GetLogicalDriveStringsW K32GetModuleFileNameExW K32GetProcessImageFileNameW CreateFileW GetPrivateProfileIntW OpenProcess GetExitCodeProcess SetLastError IsBadReadPtr FindResourceW LoadLibraryW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary FindResourceExW VirtualProtect GetCurrentThreadId GetCurrentProcessId GetCurrentProcess CreateMutexW SetUnhandledExceptionFilter CloseHandle GetCommandLineW CreateEventW WaitForSingleObject ResetEvent SetEvent GetDriveTypeW MultiByteToWideChar DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError SetEnvironmentVariableA FreeEnvironmentStringsW RaiseException Process32NextW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW WriteConsoleW ReadConsoleW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleCP GetFileType WideCharToMultiByte GetStringTypeW FormatMessageW TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThread GetExitCodeThread GetNativeSystemInfo EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter QueryPerformanceFrequency CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA InterlockedExchangeAdd ReleaseMutex LocalFree ReleaseSemaphore GetPrivateProfileStringW DeleteFileW CopyFileW FindClose FindFirstFileW FindNextFileW GetFileSizeEx ReadFile WriteFile UnhandledExceptionFilter GetStartupInfoW TerminateProcess GetFileAttributesExW FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification GetFinalPathNameByHandleW SetThreadPriority WaitForMultipleObjects OpenFileById ReadDirectoryChangesW GetDiskFreeSpaceW GetDiskFreeSpaceExW GetVolumeInformationW InterlockedExchange InterlockedCompareExchange CreateThread CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus GetStdHandle FlushFileBuffers SetEndOfFile SetFilePointer SetFilePointerEx GetModuleHandleA GetModuleHandleExA GetModuleHandleExW OutputDebugStringA RegisterWaitForSingleObject UnregisterWaitEx GetVersionExW LoadLibraryExW CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile ConnectNamedPipe WaitNamedPipeW WaitForMultipleObjectsEx CreateSemaphoreW CreateNamedPipeW CreateTimerQueue SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask UnregisterWait GetThreadTimes FreeLibraryAndExitThread InterlockedFlushSList QueryDepthSList FreeResource GetSystemWindowsDirectoryW lstrcmpA lstrcmpiA GetSystemDirectoryW CreateFileA RtlUnwind ExitThread DecodePointer

user32

GetQueueStatus MsgWaitForMultipleObjectsEx WaitMessage KillTimer SetTimer CallMsgFilterW PostThreadMessageW SendMessageW wsprintfW RegisterWindowMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW UnregisterClassW PostMessageW DefWindowProcW LoadCursorW SetWindowLongW GetWindowLongW DestroyWindow PostQuitMessage CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW IsWindow

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW ShellExecuteExW

ole32

CoInitializeEx CoCreateGuid CoInitialize CoUninitialize

shlwapi

SHSetValueW SHGetValueW StrCmpNIW PathIsDirectoryW PathCombineW StrStrIA SHSetValueA SHGetValueA PathFileExistsW PathAppendW PathRemoveFileSpecW StrStrIW StrTrimA StrCmpIW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

crypt32

CertGetNameStringW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

vcomp140

_vcomp_fork _vcomp_for_static_simple_init _vcomp_for_static_end

winmm

timeGetTime timeEndPeriod timeBeginPeriod

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

advapi32

RegCloseKey RegOpenKeyExW RegGetValueW RegQueryValueExW RegSetValueExW OpenProcessToken GetTokenInformation RegCreateKeyExW RegEnumKeyExW InitializeSecurityDescriptor SetSecurityDescriptorDacl RegEnumKeyExA RegOpenKeyExA RegQueryValueExA

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

generic

count=1, id=208, version=65501,

count=2, id=257, version=26706,

count=3, id=261, version=27031,

count=26, id=241, version=40116,

count=179, id=243, version=40116,

count=34, id=242, version=40116,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=26, id=259, version=26706,

count=12, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=7, id=261, version=27032,

count=135, id=261, version=26706,

count=38, id=260, version=26706,

count=1, id=206, version=65501,

count=33, id=203, version=65501,

count=359, id=1, productName=Unmarked objects,

count=42, id=261, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,