24b5811b20bd7a47a3ed3430561fa923 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

24b5811b20bd7a47a3ed3430561fa923
Size

2.2MB
MD5

24b5811b20bd7a47a3ed3430561fa923
SHA1

958234f88f33dc99da974d8cd9325427583673e0
SHA256

df0fb396f3ea41f37041e491f085cc66d8dfe513cb960a68f4702cfeb3b564e6
SHA512

73b93110c2403a6ac175aa1e73d29ee0780561881ce71b8b348a4c3ed842dc6d42d2400e1420217aaac7e55ad74a49ffa8f864e1dbad70272673c4ea1dfaf3d1
SSDEEP

49152:ZOBzh+FaVnQltojQaiOuMtRSMaT9qZMmO53c4yZKeikL6/5w3SjsOCu:0xmeuIRSMfsGbi+SjD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/chtb0908/setup.exe

Files

24b5811b20bd7a47a3ed3430561fa923
.rar
chtb0908/readme.txt
chtb0908/setup.exe
.exe windows:4 windows x86 arch:x86

547c94826e733fab0c2f59262339e0b1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareStringA
VirtualFree
WriteFile
VirtualAlloc
DeleteFileA
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
lstrcpyA
CreateFileA
lstrlenA
ReadFile
SetFilePointer
GetWindowsDirectoryA
GetSystemDirectoryA
ExitProcess
GetCurrentDirectoryA
GetTempPathA
lstrcpynA
GetModuleFileNameA
InterlockedIncrement
GetModuleHandleA

user32

LoadCursorA
SendMessageA
GetDlgItem
SetCursor
MessageBoxA
wsprintfA
ShowWindow
FindWindowA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 842B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Shared
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
chtb0908/新云软件.url
.url