239459582846edb2f21ca151c6a2414e

General

Target
239459582846edb2f21ca151c6a2414e
Size 6.0MB
Sample231231-cdckxsachl
SHA256 ca4d192e2bca61c620cf05f196e9d5f61c49a3f03dcadb127e49e8ec870dfe60
MD5 239459582846edb2f21ca151c6a2414e
SHA1 91b3cd18957f2a2734b8f57ee4d451ad6d14b7b4
SHA512 7866753a31861421de5c4a84d85b63ae6fc44f36ce6a6822a73a8e17e77f88266fc6a75fe16d9094e29cb494f230c3545ce594df21f5cdf444e2c36065ec5f82
SSDEEP 98304:SpHHbEPz5qmxKIcWdrkMPo/gahZlmPPuQzOmCulqb6YcqvS2GNcv3AA:q7idKhMPo/tl+Purk4bOeS2G2AA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cxetks_setup.exe

File Explorer

239459582846edb2f21ca151c6a2414e

.rar 6.0MB
cxetks_setup.exe

.exe 6.3MB
新云软件.url

.url 133B

239459582846edb2f21ca151c6a2414e

SHA256 ca4d192e2bca61c620cf05f196e9d5f61c49a3f03dcadb127e49e8ec870dfe60
MD5 239459582846edb2f21ca151c6a2414e
SHA1 91b3cd18957f2a2734b8f57ee4d451ad6d14b7b4
SHA512 7866753a31861421de5c4a84d85b63ae6fc44f36ce6a6822a73a8e17e77f88266fc6a75fe16d9094e29cb494f230c3545ce594df21f5cdf444e2c36065ec5f82
SSDEEP 98304:SpHHbEPz5qmxKIcWdrkMPo/gahZlmPPuQzOmCulqb6YcqvS2GNcv3AA:q7idKhMPo/tl+Purk4bOeS2G2AA
MD5 SHA1 SHA512 SSDEEP

cxetks_setup.exe

IMPHASH a24e57cfb1e35030a9b4252bf1fa8b4b
SHA256 45d2a0c9b78bddc9601e130e2fc1911cf9bc4aa3363fd57666e6f254de1be964
MD5 7fb60e63e19084efd95cec7df2790cba
SHA1 94c849b8dfdccbd82265506d7dfeb01a3dc2773f
SHA512 3be6609c0f2bbc8f85b41de0e9d2fd4726dd951a0c74e4a22d153a8a638f6bbdbbe5f3dfc0f64d586ef865882ec2dbb7b5daf2bd2bd6621ce9a131c2383b8abf
SSDEEP 98304:wZZ+3dutXJCeMHMjWR7XrDuMSIwcrUC82XBoRPUC5Xg6EzKi:wq3wue8FXrDwJRPNwBzKi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7581

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcmpiA lstrcpyA lstrlenA _lclose RemoveDirectoryA DeleteFileA GetModuleFileNameA _lread _llseek _lopen GetDiskFreeSpaceA SetCurrentDirectoryA CreateDirectoryA GetFileAttributesA lstrcatA GetTempPathA GetCurrentDirectoryA _lwrite _lcreat CloseHandle GetExitCodeProcess CreateProcessA ExitProcess TerminateProcess GetCurrentProcess HeapFree HeapAlloc GetModuleHandleA GetStartupInfoA GetCommandLineA GetVersion InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc RtlUnwind UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetCurrentThreadId TlsSetValue TlsAlloc SetLastError TlsGetValue GetLastError WriteFile GetCPInfo GetACP GetOEMCP GetProcAddress LoadLibraryA InterlockedDecrement InterlockedIncrement MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

TranslateMessage DispatchMessageA PeekMessageA MsgWaitForMultipleObjects wsprintfA LoadCursorA SetCursor MessageBoxA

Sharing

General

Malware Config

Signatures

File Explorer

239459582846edb2f21ca151c6a2414e

cxetks_setup.exe

kernel32

user32

generic

新云软件.url