4c1929365dba48e9947864e7aaf339a3601ffa06033614a0ed35d06a4cb487a4

Sharing

Copy URL Twitter E-mail

General

Target

4c1929365dba48e9947864e7aaf339a3601ffa06033614a0ed35d06a4cb487a4
Size

1.8MB
MD5

34569d7ee6ed77c26e642c8c3e55be0a
SHA1

7b64b06fce8ae180f023cc15d881dee1df468723
SHA256

4c1929365dba48e9947864e7aaf339a3601ffa06033614a0ed35d06a4cb487a4
SHA512

4db6e7683145cd46553f6e8cba82885992ca88da726e019eaa592f8033f5acc89afe4ed4d2c01068330df19fa8ff34b3d0f5b33e3ea36810cf583eec9c30ac28
SSDEEP

49152:hdGmyEpPsZ3HLfc+kw0qDybaP3n52JrpCDlj:hdyEp0ZXLfkw0qDKg

Score

1^/10

Malware Config

Signatures

Files

4c1929365dba48e9947864e7aaf339a3601ffa06033614a0ed35d06a4cb487a4
.exe windows:5 windows x86 arch:x86

76a3cbd6fd181b23d4a19b5b48f851b9

Code Sign

52:4b:ea:39:cb:1f:ea:67:b1:d8:55:5b:74:7f:59:7c
Certificate

Issuer

CN=GLL ZZCS

Not Before

26/09/2023, 09:44

Not After

31/12/2039, 23:59

Subject

CN=GLL ZZCS

d0:ce:27:a3:ef:07:34:60:5d:5a:71:c7:44:da:54:c5:30:3c:9d:7a
Signer

Actual PE Digest

d0:ce:27:a3:ef:07:34:60:5d:5a:71:c7:44:da:54:c5:30:3c:9d:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

socket
WSAIoctl
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
setsockopt
gethostname
shutdown
htonl
gethostbyname
getservbyname
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
WSAStartup
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
ioctlsocket

wldap32

ord27
ord211
ord60
ord50
ord41
ord22
ord26
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord143
ord46

shlwapi

PathRemoveFileSpecA
PathIsDirectoryA
PathFileExistsA
StrToIntA

shell32

CommandLineToArgvW
SHCreateDirectoryExA
SHFileOperationA

kernel32

FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleCP
ReadConsoleW
GetACP
HeapFree
HeapReAlloc
HeapAlloc
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
SetConsoleCtrlHandler
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
CreateFileW
GetDriveTypeW
GetCurrentDirectoryW
SetEnvironmentVariableA
GetFullPathNameA
GetFullPathNameW
EncodePointer
DecodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
MoveFileA
Process32First
FindFirstFileA
GetCurrentProcess
TerminateProcess
FindNextFileA
FindClose
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
Sleep
CopyFileA
GetLastError
MoveFileExA
SetEvent
DeleteFileA
Process32Next
CloseHandle
CreateThread
lstrcmpiA
CreateProcessA
GetDiskFreeSpaceExA
GetPrivateProfileStringA
GetTickCount
GetModuleFileNameA
lstrlenA
WritePrivateProfileStringA
GetCurrentProcessId
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
CreateMutexA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetFileAttributesA
RemoveDirectoryA
DeleteCriticalSection
lstrcpynA
WideCharToMultiByte
CreateDirectoryA
GetCurrentThreadId
CreateFileA
LoadLibraryA
GetProcAddress
SetUnhandledExceptionFilter
CreateEventW
SizeofResource
SetErrorMode
FindResourceA
FreeResource
GetVersionExA
GlobalAlloc
ResetEvent
LoadResource
GlobalLock
GlobalUnlock
TerminateThread
ExitProcess
CreateEventA
SetLastError
FormatMessageA
InitializeCriticalSection
SleepEx
FreeLibrary
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
ExpandEnvironmentStringsA
VerSetConditionMask
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
GetSystemTime
SystemTimeToFileTime
WriteFile
QueryPerformanceCounter
GlobalMemoryStatus
FlushConsoleInputBuffer
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
RaiseException
LoadLibraryExW
GetModuleHandleExW
FindFirstFileExW
FindNextFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
GetFileAttributesExW
SetStdHandle
SetEndOfFile
GetProcessHeap
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
MultiByteToWideChar
HeapSize

user32

TranslateAcceleratorA
MoveWindow
SetLayeredWindowAttributes
TranslateMessage
PostQuitMessage
GetDesktopWindow
UpdateWindow
SetForegroundWindow
LoadCursorA
DestroyWindow
ShowWindow
SetWindowLongA
GetUserObjectInformationW
GetSystemMetrics
CreateWindowExA
SystemParametersInfoA
RegisterClassExA
GetDlgCtrlID
TrackMouseEvent
DefWindowProcA
SetCapture
GetClientRect
GetParent
ReleaseCapture
InvalidateRect
BeginPaint
EndPaint
SendMessageA
wsprintfA
MessageBoxA
LoadStringA
SetWindowPos
GetWindowRect
DispatchMessageA
GetMessageA
GetWindowLongA
GetProcessWindowStation

advapi32

RegSetValueExA
ReportEventA
RegisterEventSourceA
DeregisterEventSource
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

ole32

CreateStreamOnHGlobal

psapi

GetModuleFileNameExA
EnumProcessModules

gdiplus

GdipCreateFont
GdiplusShutdown
GdipSetStringFormatAlign
GdipCreatePen1
GdipCreateBitmapFromScan0
GdipDeletePen
GdipDeleteFont
GdipDeleteStringFormat
GdipDeleteGraphics
GdipFillRectangleI
GdipGetImageGraphicsContext
GdipCloneBrush
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipDrawString
GdipFree
GdipCreateSolidFill
GdipSetStringFormatLineAlign
GdipSetSmoothingMode
GdipDisposeImage
GdipDrawImageRectI
GdipAlloc
GdipDeleteBrush
GdipCloneImage
GdipCreateFontFamilyFromName
GdipDrawRectangleI
GdipDeleteFontFamily
GdipCreateStringFormat
GdipLoadImageFromStream
GdiplusStartup

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 361KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

76a3cbd6fd181b23d4a19b5b48f851b9

Code Sign

52:4b:ea:39:cb:1f:ea:67:b1:d8:55:5b:74:7f:59:7cCertificate

d0:ce:27:a3:ef:07:34:60:5d:5a:71:c7:44:da:54:c5:30:3c:9d:7aSigner

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

shlwapi

shell32

kernel32

user32

advapi32

ole32

psapi

gdiplus

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 361KB - Virtual size: 361KB

.data Size: 40KB - Virtual size: 54KB

.gfids Size: 1024B - Virtual size: 660B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 11KB - Virtual size: 10KB

.reloc Size: 66KB - Virtual size: 65KB

52:4b:ea:39:cb:1f:ea:67:b1:d8:55:5b:74:7f:59:7c
Certificate

d0:ce:27:a3:ef:07:34:60:5d:5a:71:c7:44:da:54:c5:30:3c:9d:7a
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 361KB - Virtual size: 361KB

.data
Size: 40KB - Virtual size: 54KB

.gfids
Size: 1024B - Virtual size: 660B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 11KB - Virtual size: 10KB

.reloc
Size: 66KB - Virtual size: 65KB