94e0b64bd724d67358cde0f811f9c6172a3d2fad7a802969a635201e10bf8d2b

Sharing

Copy URL Twitter E-mail

General

Target

94e0b64bd724d67358cde0f811f9c6172a3d2fad7a802969a635201e10bf8d2b
Size

124KB
MD5

ad32ca95ae5f48d1ced8caad78e8e3a9
SHA1

9b5310f2f159659bfcf0448090a1b75b7fc12075
SHA256

94e0b64bd724d67358cde0f811f9c6172a3d2fad7a802969a635201e10bf8d2b
SHA512

54897e9a3e3e19727b3c588c8449c71d7f70aa664a9b6d14e231b3d529147a053dc2340300326fb0453549e9b0a2ed43c35046e689c98e45d771132fe149c00b
SSDEEP

3072:rDrltbbK7YcaWW1Maz2WZ90t4C7Ja+I6tCHIOu:nrlt0YcaWDE9R6a+Rtg0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/setup.sem_360.exe

Files

94e0b64bd724d67358cde0f811f9c6172a3d2fad7a802969a635201e10bf8d2b
.zip
setup.sem_360.exe
.exe windows:4 windows x86 arch:x86

110d51eb9d13a17bdea3cf10f77b6682

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx

kernel32

LocalAlloc
Sleep
GetLastError
MapViewOfFile
CreateFileMappingA
WriteFile
SetEndOfFile
GetFileAttributesExA
SetFileAttributesA
CopyFileA
FindNextFileA
FindClose
FindFirstFileA
RemoveDirectoryA
CreateDirectoryA
MoveFileA
GetTempPathA
GetWindowsDirectoryA
GetLogicalDrives
GetFileAttributesA
SetThreadPriority
SetPriorityClass
GetCurrentThread
GetCurrentProcess
GetVersionExA
GetTempFileNameA
HeapFree
HeapAlloc
GetProcessHeap
CreateFileW
FindFirstFileW
MultiByteToWideChar
lstrlenA
GetDiskFreeSpaceA
GetUserDefaultLangID
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
FreeResource
GlobalFree
GlobalHandle
LockResource
LoadResource
FindResourceA
LocalFree
lstrlenW
GlobalUnlock
GlobalLock
InterlockedIncrement
InterlockedDecrement
lstrcmpA
VirtualQueryEx
GetSystemInfo
RaiseException
GetFullPathNameA
GetCurrentDirectoryA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetConsoleCtrlHandler
FlushFileBuffers
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
LCMapStringW
LCMapStringA
WideCharToMultiByte
SetStdHandle
GetStdHandle
SetHandleCount
GetOEMCP
GetACP
GetCPInfo
ExitProcess
GetCommandLineA
GetStartupInfoA
GetFileType
FileTimeToLocalFileTime
FileTimeToSystemTime
RtlUnwind
HeapSize
GetEnvironmentVariableA
GetShortPathNameA
DeleteFileA
ReadFile
SetFilePointer
GetFileSize
UnmapViewOfFile
GetFileTime
SetFileTime
GetModuleHandleA
CreateThread
WaitForSingleObject
TerminateThread
VirtualProtectEx
WriteProcessMemory
TerminateProcess
DeviceIoControl
GetModuleFileNameA
SetCurrentDirectoryA
CreateFileA
FreeLibrary
GetVersion
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
CloseHandle
OpenProcess
ReadProcessMemory
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetLogicalDriveStringsA
GetDriveTypeA
GlobalAlloc

user32

SetWindowPos
IsWindow
BeginPaint
RedrawWindow
EndPaint
GetDC
GetDesktopWindow
IsChild
FillRect
GetClassNameA
SendMessageA
SetWindowTextA
GetParent
CreateAcceleratorTableA
DestroyWindow
CreateWindowExA
wsprintfA
ReleaseCapture
MessageBoxA
CharUpperA
GetActiveWindow
SetCapture
InvalidateRgn
ShowWindow
MapWindowPoints
SystemParametersInfoA
GetWindowRect
ReleaseDC
EndDialog
DialogBoxParamA
SendDlgItemMessageA
SetFocus
EnableWindow
GetDlgItem
GetFocus
EnableMenuItem
GetSystemMenu
GetWindowLongA
GetSysColor
GetWindowTextLengthA
GetWindowTextA
GetWindow
DefWindowProcA
RegisterWindowMessageA
GetClassInfoExA
RegisterClassExA
DialogBoxIndirectParamA
GetCursorPos
ScreenToClient
GetClientRect
PtInRect
SetTimer
InvalidateRect
WindowFromPoint
KillTimer
LoadCursorA
SetCursor
CallWindowProcA
GetDlgCtrlID
GetSysColorBrush
LoadIconA
SetWindowLongA
SetDlgItemTextA

gdi32

CreateCompatibleBitmap
DeleteObject
SetBkMode
GetStockObject
SetTextColor
CreateSolidBrush
CreateFontIndirectA
GetObjectA
GetDeviceCaps
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC

advapi32

OpenServiceA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegEnumValueA
RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegCloseKey
RegEnumKeyExA
RegDeleteKeyA
EnumServicesStatusA
QueryServiceStatus
ControlService
CloseServiceHandle
QueryServiceConfigA
OpenSCManagerA
DeleteService

shell32

ShellExecuteA

ole32

CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
OleLockRunning

oleaut32

VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysAllocStringLen
SysFreeString
GetErrorInfo
SetErrorInfo
VariantChangeType
CreateErrorInfo
VariantInit
OleCreateFontIndirect

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

ws2_32

inet_ntoa
WSACleanup
gethostname
WSAStartup
gethostbyname

Sections

.text
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 32KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
安装前，要退出360安全卫士.txt

Sharing

General

Malware Config

Signatures

Files

110d51eb9d13a17bdea3cf10f77b6682

Headers

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

version

ws2_32

Sections

.text Size: 160KB - Virtual size: 159KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 32KB - Virtual size: 1.2MB

.rsrc Size: 80KB - Virtual size: 77KB

.text
Size: 160KB - Virtual size: 159KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 32KB - Virtual size: 1.2MB

.rsrc
Size: 80KB - Virtual size: 77KB