7bfe68a40c62f58fcae8311b15b09132

Sharing

Copy URL Twitter E-mail

General

Target

7bfe68a40c62f58fcae8311b15b09132
Size

360KB
MD5

7bfe68a40c62f58fcae8311b15b09132
SHA1

74dd158f66e5a8b6cabbfc6930dec37166e4212f
SHA256

49c324205d28bdce94ab1488cfb6bee5c7c2f65073d325c591856e81df09882f
SHA512

d15727511789ca03c6aa704eb091570815a21a9ccd226239b58017c0c9f780b72f15481e0038c2b086ce1c9f585f64d6cca242b07618f9d95d4d0ab38a412f9e
SSDEEP

6144:TOmi7G4dFMuEwUVmaujjVFtXINroWiW2BrTwPxHKzVS9HP/9Xq3OAdtZu:TcfEFVmaujjVFtXINroWiW2BrTwPxHK3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7bfe68a40c62f58fcae8311b15b09132

Files

7bfe68a40c62f58fcae8311b15b09132
.exe windows:4 windows x86 arch:x86

243e9fd0f9f88f1faa9ca4f171ad21b1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\Administrator\桌面\33\Server\Release\Server.pdb

Imports

kernel32

GlobalAlloc
LoadResource
SizeofResource
FindResourceA
DeviceIoControl
CopyFileW
DeleteFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SetFileAttributesW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
LockResource
TerminateProcess
Thread32Next
GetCurrentThreadId
SuspendThread
Thread32First
DuplicateHandle
GetModuleFileNameW
CreateThread
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetSystemInfo
VirtualProtect
GetCPInfo
GetOEMCP
GetACP
WriteFile
GlobalFree
GetProcAddress
LoadLibraryW
GetCurrentProcessId
OpenProcess
ExitProcess
GetSystemDirectoryW
MoveFileExW
lstrcpyW
GetTickCount
GetProcessHeap
HeapAlloc
HeapFree
Sleep
CreateFileW
GetFileTime
SetFileTime
lstrcatW
GetCurrentProcess
GetLastError
CloseHandle
GetModuleHandleW
LoadLibraryA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetFileType
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleFileNameA
InterlockedExchange
VirtualQuery
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapSize

user32

ShowWindow
SetWindowPos
UpdateWindow
wsprintfW
DefWindowProcW
CreateWindowExW
RegisterClassExW

advapi32

OpenProcessToken
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RegEnumKeyW
RegDeleteKeyW
SetServiceStatus
CreateServiceW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
ChangeServiceConfigW
RegCreateKeyW
StartServiceW
EnumDependentServicesW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
ControlService
DeleteService
LookupPrivilegeValueW
AdjustTokenPrivileges

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 272KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

243e9fd0f9f88f1faa9ca4f171ad21b1

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Sections

.text Size: 36KB - Virtual size: 33KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 36KB - Virtual size: 40KB

.rsrc Size: 272KB - Virtual size: 270KB

.text
Size: 36KB - Virtual size: 33KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 36KB - Virtual size: 40KB

.rsrc
Size: 272KB - Virtual size: 270KB