8dbb300029d139a6da994f9969dd3fc3

Sharing

Copy URL Twitter E-mail

General

Target

8dbb300029d139a6da994f9969dd3fc3
Size

1.1MB
MD5

8dbb300029d139a6da994f9969dd3fc3
SHA1

eefe7839b0f88efc3fb1ae087bf0b49e9a95f7e7
SHA256

c33f9405fc11b96c4524991b2b03dada6eab3d39fdc12ced766a59e3701aa05f
SHA512

cea77ebec9fe9ad90b5244b3e0a2e8ffd6ab5dc93cc22d3fa8d246159f735db97863b6ee2be1c343b6394a0f329a2491a83cd9fd26c8c97115d145246e70888e
SSDEEP

12288:3z0CaO/9Y62RSED+J9MXEGtzrNSr/difmKtz+QZuKA9gVQzUYX8VFDuGTfD:3VaO/2Rjo9MU2zQ/aVuKAqywYIgGTfD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8dbb300029d139a6da994f9969dd3fc3

Files

8dbb300029d139a6da994f9969dd3fc3
.exe windows:5 windows x86 arch:x86

3f54e8ca633d75310e9b6bb228847b93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Haibo\COMODOCloudAntivirus\PortableSandbox\guard\Release\x32\cwsLauncher.pdb

Imports

ntdll

wcsrchr
memcmp
NtCreateKey
toupper
isdigit
NtOpenSymbolicLinkObject
memset
ZwCreatePort
ZwAcceptConnectPort
ZwCompleteConnectPort
ZwReplyWaitReceivePortEx
memcpy
_stricmp
memmove
strncpy
wcsstr
RtlUnwind
RtlAppendUnicodeToString
_alldiv
_chkstk
_wcsicmp
_itow
sprintf
strchr
strncmp
tolower
_snprintf
strrchr
NtCreateFile
atoi
_wtoi
_wcsnicmp
wcstoul
isspace
wcschr
wcsncpy
wcspbrk
_vsnprintf
NtQueryObject
NtClose
RtlCopyUnicodeString
_itoa
wcsncmp
_aullrem

kernel32

GetModuleFileNameW
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateThread
TerminateThread
CreateFileMappingW
GetModuleHandleA
SetEvent
ResetEvent
ReleaseMutex
CreateMutexW
CreateEventW
GetCurrentThreadId
WaitForMultipleObjects
DecodePointer
InitializeCriticalSectionAndSpinCount
FindResourceExW
FreeResource
LoadResource
LockResource
SizeofResource
LocalAlloc
LocalFree
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
LocalFileTimeToFileTime
OutputDebugStringA
lstrlenW
GetComputerNameA
CreateFileW
WriteFile
GetTickCount
GetSystemDirectoryW
GetFileSize
ReadFile
SetFilePointer
HeapCreate
LoadLibraryW
DeleteFileW
GetTempPathW
OpenMutexW
OpenEventW
SuspendThread
VirtualAlloc
VirtualFree
GetModuleFileNameA
MoveFileExW
SetEndOfFile
SetFileAttributesW
GetCurrentProcessId
OpenProcess
GetVersionExW
MoveFileW
GetEnvironmentVariableW
GetDriveTypeW
GetVolumeInformationW
DuplicateHandle
ExitProcess
FlushInstructionCache
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateDirectoryW
ExitThread
OpenFileMappingW
MapViewOfFile
CopyFileW
FreeLibrary
LoadLibraryExW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetLocalTime
FormatMessageA
LoadLibraryA
ReleaseSemaphore
CreateSemaphoreW
WriteProcessMemory
SetWaitableTimer
CreateWaitableTimerW
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
lstrcpyW
GetFileInformationByHandle
ExpandEnvironmentStringsW
SearchPathW
SetCriticalSectionSpinCount
FileTimeToSystemTime
MapViewOfFileEx
UnmapViewOfFile
CreateMutexA
CreateEventA
FindClose
FindFirstFileW
FindNextFileW
GetCurrentDirectoryW
RemoveDirectoryW
VerSetConditionMask
VerifyVersionInfoW
QueryDosDeviceW
GetSystemWindowsDirectoryW
GetCurrentThread
SetLastError
CreateProcessA
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
CreateFileMappingA
GetVersion
GetWindowsDirectoryW
lstrcpyA
lstrcatA
lstrlenA
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
VirtualQuery
VirtualProtect
VirtualFreeEx
DeviceIoControl
GetThreadContext
IsDebuggerPresent
GetConsoleCP
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetFileType
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetStartupInfoW
UnhandledExceptionFilter
GetStdHandle
GetFileAttributesExW
GetCommandLineW
AreFileApisANSI
GetModuleHandleExW
IsProcessorFeaturePresent
EncodePointer
VirtualAllocEx
GetSystemInfo
CreateProcessW
ResumeThread
GetExitCodeThread
CreateRemoteThread
TerminateProcess
GetCurrentProcess
Sleep
WaitForSingleObject
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
FreeEnvironmentStringsW
GetStringTypeW
HeapAlloc
HeapDestroy
GetLastError
RaiseException
CloseHandle
OutputDebugStringW
GetFileAttributesW
GetEnvironmentStringsW
LCMapStringW
SetStdHandle
FlushFileBuffers
WriteConsoleW
QueryPerformanceCounter

user32

GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
MessageBoxW
SystemParametersInfoW
LoadCursorW
GetSysColor
GetWindowRect
EndPaint
BeginPaint
GetDC
SetForegroundWindow
UpdateWindow
MoveWindow
ShowWindow
IsWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
PostMessageW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
wsprintfW
GetSystemMetrics
CloseDesktop

advapi32

OpenSCManagerW
DeleteService
CreateServiceW
ControlService
RegEnumKeyW
GetKernelObjectSecurity
DuplicateTokenEx
RevertToSelf
ImpersonateLoggedOnUser
AdjustTokenPrivileges
LookupPrivilegeValueW
GetLengthSid
GetTokenInformation
RegEnumValueW
RegQueryInfoKeyW
RegDeleteKeyW
OpenProcessToken
RegSetValueExW
RegOpenKeyW
RegDeleteValueW
RegCreateKeyExW
CheckTokenMembership
StartServiceW
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
CloseServiceHandle
ChangeServiceConfigW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid

ole32

CLSIDFromProgID
CoTaskMemAlloc
CoInitializeEx
CoFreeUnusedLibrariesEx
CreateStreamOnHGlobal
CoTaskMemFree
CoInitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize

shell32

ShellExecuteW
ord165
SHGetFolderPathW
SHGetSpecialFolderPathW
SHFileOperationW

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
VariantChangeType

shlwapi

UrlUnescapeW
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
SHDeleteKeyW
PathAppendW
PathStripToRootW
PathRemoveFileSpecW
PathRemoveBackslashW
PathIsNetworkPathW
PathStripPathW

gdiplus

GdipGetImageThumbnail
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipDeleteFont
GdipLoadImageFromStream
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawImageRect
GdipFillRectangleI
GdipFillRectangle
GdipDrawLines
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipCreateFont
GdipSetStringFormatLineAlign

wininet

InternetOpenW
InternetCrackUrlW
InternetReadFile
InternetCloseHandle
InternetConnectW
InternetQueryOptionW
InternetOpenA
InternetSetOptionW
HttpOpenRequestW
InternetCanonicalizeUrlW
HttpSendRequestA

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationA
WTSOpenServerW
WTSEnumerateSessionsW
WTSCloseServer

iphlpapi

GetNetworkParams

imagehlp

ImageGetCertificateHeader
ImageGetCertificateData

crypt32

CryptVerifyMessageSignature
CertFreeCertificateContext
CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

ws2_32

ioctlsocket
ntohl
inet_addr
htons
connect
send
setsockopt
socket
gethostbyname
closesocket
inet_ntoa
gethostname
getservbyname
WSAStartup
WSAGetLastError
WSACleanup
getprotobynumber
htonl
__WSAFDIsSet
WSAEventSelect
WSAEnumNetworkEvents
select
getsockopt
recvfrom
sendto
recv

gdi32

DeleteObject

winmm

timeGetTime

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

mpr

WNetGetUniversalNameW

comdlg32

GetOpenFileNameW

psapi

GetMappedFileNameW

Exports

Exports

CCAV2F5E2BD35B7A
fvParseFullPathName
g_SandboxId

Sections

.text
Size: 556KB - Virtual size: 556KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f54e8ca633d75310e9b6bb228847b93

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdiplus

wininet

wtsapi32

iphlpapi

imagehlp

crypt32

wintrust

userenv

ws2_32

gdi32

winmm

version

mpr

comdlg32

psapi

Exports

Exports

Sections

.text Size: 556KB - Virtual size: 556KB

.rdata Size: 264KB - Virtual size: 263KB

.data Size: 38KB - Virtual size: 72KB

.rsrc Size: 265KB - Virtual size: 265KB

.reloc Size: 42KB - Virtual size: 42KB

.text
Size: 556KB - Virtual size: 556KB

.rdata
Size: 264KB - Virtual size: 263KB

.data
Size: 38KB - Virtual size: 72KB

.rsrc
Size: 265KB - Virtual size: 265KB

.reloc
Size: 42KB - Virtual size: 42KB