3cef8664fe5970bccc0ca6e033d58b8cd903e7d92c13ffd9fb82c281953401ac

Sharing

Copy URL Twitter E-mail

General

Target

3cef8664fe5970bccc0ca6e033d58b8cd903e7d92c13ffd9fb82c281953401ac
Size

10.0MB
MD5

f5e2cb0cd9257c55541e59aa9f7c7efb
SHA1

eabd57deae44ef9f90f11b57c980cfe70c6f2423
SHA256

3cef8664fe5970bccc0ca6e033d58b8cd903e7d92c13ffd9fb82c281953401ac
SHA512

caa956565d406a4ad836ee53165b5005af5865effce04814a7205bfd61004d24d88563d2f2f0e076109bb8eed28f88af641ecc2e7fe6f48f4b0424cd0ca78984
SSDEEP

196608:cJnGzeFkuAYK3uCb9cwA0uhSzdhjeb1K3s3vufKdxfeZEqT+HIK95A3528D:8nueFkP3F96Gde83Kue0KDoK9+JD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3cef8664fe5970bccc0ca6e033d58b8cd903e7d92c13ffd9fb82c281953401ac

Files

3cef8664fe5970bccc0ca6e033d58b8cd903e7d92c13ffd9fb82c281953401ac
.exe windows:6 windows x86 arch:x86

5b595b82916b88ec94e8d65886f422aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\sgs10year-cefclient\MicroTerminalGuanWang101\install\Release\Sgsc10thinstall.pdb

Imports

comctl32

_TrackMouseEvent
ord17

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

kernel32

CreateToolhelp32Snapshot
Sleep
OpenMutexA
GetSystemDirectoryA
Process32Next
GetLogicalDriveStringsA
GetDiskFreeSpaceExA
GetExitCodeProcess
FindResourceA
GetModuleHandleA
FreeResource
MultiByteToWideChar
GetExitCodeThread
GetProcAddress
CreateProcessA
CreateDirectoryA
GetTempFileNameA
GetCurrentDirectoryA
LoadLibraryA
ReadFile
GetACP
GetFileType
SetFilePointer
SetFileTime
WriteFile
DuplicateHandle
DosDateTimeToFileTime
SystemTimeToFileTime
MulDiv
GetLocalTime
InitializeCriticalSectionAndSpinCount
SetEndOfFile
SetFilePointerEx
FlushFileBuffers
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetConsoleCP
GetTimeZoneInformation
CreateDirectoryW
SetStdHandle
OpenProcess
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
ExitProcess
CreateFileW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
FreeLibrary
RtlUnwind
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
SetLastError
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
GetCommandLineA
SizeofResource
HeapFree
GetDriveTypeA
DeviceIoControl
GetCurrentProcess
Process32First
GetFileSize
CreateFileA
GetFileAttributesA
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetModuleFileNameA
GetTickCount
CreateEventA
ResetEvent
CloseHandle
SetEvent
WideCharToMultiByte
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
GetEnvironmentVariableA
HeapReAlloc
LockResource
GetLastError
HeapSize
InitializeCriticalSectionEx
WriteConsoleW

user32

GetParent
PostQuitMessage
GetClientRect
FindWindowA
DispatchMessageA
TranslateMessage
CreateAcceleratorTableA
MoveWindow
InvalidateRgn
IsIconic
SendMessageA
EnumWindows
GetMonitorInfoA
GetWindowLongA
SetWindowLongA
ShowWindow
ScreenToClient
PostMessageA
SetWindowRgn
MonitorFromWindow
GetWindowRect
GetWindowThreadProcessId
CharNextA
GetMessageA
CreateWindowExA
IsWindow
DestroyWindow
SetWindowPos
SetFocus
GetFocus
GetKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetSysColor
ClientToScreen
SetCaretPos
ShowCaret
HideCaret
CreateCaret
SetRect
FillRect
CharPrevA
GetPropA
SetPropA
EnableWindow
GetClassInfoExA
RegisterClassExA
RegisterClassA
CallWindowProcA
DefWindowProcA
OffsetRect
InflateRect
wvsprintfA
LoadCursorA
IntersectRect
SetCursor
GetWindow
PtInRect
IsRectEmpty
MapWindowPoints
GetCursorPos
InvalidateRect

gdi32

GetDeviceCaps
ExtTextOutA
TextOutA
MoveToEx
CreateDIBSection
SetTextColor
SetStretchBltMode
StretchBlt
SetBkMode
SetBkColor
ExtSelectClipRgn
SelectClipRgn
RoundRect
LineTo
GetTextExtentPoint32A
GetClipBox
GetCharABCWidthsA
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
SetWindowOrgEx
GetObjectA
GetTextMetricsA
SelectObject
SaveDC
RestoreDC
Rectangle
GetStockObject
DeleteDC
CreatePen
CreateFontIndirectA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CreateRoundRectRgn
DeleteObject

advapi32

RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteA
SHGetMalloc
SHGetSpecialFolderPathA

ole32

CoInitialize
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CoUninitialize
CoCreateInstance

oleaut32

SysAllocStringLen
SysFreeString
VariantClear
VariantInit
SysAllocString

shlwapi

PathFileExistsA

gdiplus

GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteGraphics
GdipCreateFromHDC
GdipDrawString
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdipDeleteFont
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdiplusShutdown
GdiplusStartup
GdipCreateLineBrushI
GdipSetTextRenderingHint
GdipCreateSolidFill

Sections

.text
Size: 374KB - Virtual size: 373KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 97.0MB - Virtual size: 97.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b595b82916b88ec94e8d65886f422aa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

Sections

.text Size: 374KB - Virtual size: 373KB

.rdata Size: 112KB - Virtual size: 111KB

.data Size: 7KB - Virtual size: 11KB

.rsrc Size: 97.0MB - Virtual size: 97.0MB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 374KB - Virtual size: 373KB

.rdata
Size: 112KB - Virtual size: 111KB

.data
Size: 7KB - Virtual size: 11KB

.rsrc
Size: 97.0MB - Virtual size: 97.0MB

.reloc
Size: 24KB - Virtual size: 23KB