cb69b916aa32cd7c986dbdb9ca4e03d359d47bb76a934df8b998d1b96d6402f9

Sharing

Copy URL Twitter E-mail

General

Target
cb69b916aa32cd7c986dbdb9ca4e03d359d47bb76a934df8b998d1b96d6402f9
Size 974KB
Sample240219-1shbqaeb3t
SHA256 cb69b916aa32cd7c986dbdb9ca4e03d359d47bb76a934df8b998d1b96d6402f9
MD5 7b1e5d5a18e9c7765fa8a2e8050080a8
SHA1 50e4af51cb352ab1f8b4aff569546ac62602fb5a
SHA512 1a0a9537361ac5211920aa36d15a8602063ba52f39b48b10d0d7a2b27dcd3b70d74de000c8c125a4aafba21631659b2ce35e33c5b409fe6ab147e31f6e80f0c6
SSDEEP 24576:noIxgSJvg14Z6vqsdd0Nk7jflrT9wxZW0:LCkwvLLFT9CT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb69b916aa32cd7c986dbdb9ca4e03d359d47bb76a934df8b998d1b96d6402f9

File Explorer

cb69b916aa32cd7c986dbdb9ca4e03d359d47bb76a934df8b998d1b96d6402f9

.exe 974KB

cb69b916aa32cd7c986dbdb9ca4e03d359d47bb76a934df8b998d1b96d6402f9

IMPHASH fdd7b31a30bf4bfcabd1b0709ff9bf21
SHA256 cb69b916aa32cd7c986dbdb9ca4e03d359d47bb76a934df8b998d1b96d6402f9
MD5 7b1e5d5a18e9c7765fa8a2e8050080a8
SHA1 50e4af51cb352ab1f8b4aff569546ac62602fb5a
SHA512 1a0a9537361ac5211920aa36d15a8602063ba52f39b48b10d0d7a2b27dcd3b70d74de000c8c125a4aafba21631659b2ce35e33c5b409fe6ab147e31f6e80f0c6
SSDEEP 24576:noIxgSJvg14Z6vqsdd0Nk7jflrT9wxZW0:LCkwvLLFT9CT
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

287248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\wubi_agent\workspace\p-3417ba0c0c0d46dfae3a04bc6431244c\src\bin\SogouPdb\SogouWubi\WbSkinReg.pdb

kernel32

HeapDestroy SizeofResource InitializeCriticalSectionEx LockResource FindResourceExW LoadResource FindResourceW GetSystemInfo VirtualAlloc VirtualProtect SetLastError EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte GetCommandLineW GetCurrentProcess GetModuleFileNameW GetTempPathW CloseHandle HeapAlloc GetProcAddress GetCurrentProcessId GetModuleHandleW ReadFile WriteFile SetFilePointer CreateFileW GetCurrentThreadId ExitThread CreateEventW FormatMessageW GlobalAlloc GlobalFree CreateThread LocalFree GetFileSize CreateProcessW FindFirstFileW FindNextFileW RemoveDirectoryW FindClose GetFileAttributesW GetVersionExW GetSystemDirectoryW SetFileAttributesW DeleteFileW LoadLibraryW GetCurrentDirectoryW CreateDirectoryW WaitForSingleObject FileTimeToSystemTime CopyFileW GetFileTime GetExitCodeProcess OpenFileMappingW UnmapViewOfFile CreateFileMappingW MapViewOfFile LocalAlloc CreateMutexW ReleaseMutex OpenMutexW Sleep FlushFileBuffers SetEvent QueryPerformanceCounter IsBadWritePtr lstrlenW TerminateProcess lstrcatW GetLocalTime lstrcpyW VirtualQuery IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent ResetEvent WaitForSingleObjectEx GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead GetStringTypeW EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount RtlUnwind RaiseException FreeLibrary LoadLibraryExW FindFirstFileExW ResumeThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetACP GetFileType HeapReAlloc OutputDebugStringW GetDateFormatW GetTimeFormatW GetTimeZoneInformation IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle GetConsoleCP GetConsoleMode HeapSize SetFilePointerEx SetEndOfFile ReadConsoleW WriteConsoleW GlobalLock GlobalUnlock GetFileSizeEx GetFullPathNameW GetProcessHeap GetLastError MoveFileExW HeapFree

user32

GetClassNameW SystemParametersInfoW GetSystemMetrics SetRectEmpty EndPaint BeginPaint ReleaseDC InvalidateRect SetForegroundWindow wvsprintfW DialogBoxParamW GetParent GetClientRect SetWindowLongW GetWindowLongW DefWindowProcW CallWindowProcW GetWindowRect DestroyWindow GetDC SetWindowPos GetWindowThreadProcessId IsWindowVisible CheckDlgButton GetWindowDC SetPropW IsDlgButtonChecked GetForegroundWindow TrackMouseEvent RemovePropW EndDialog SendMessageW CreateWindowExW GetPropW MessageBoxW GetWindowTextW

gdi32

CreateCompatibleDC SetDIBColorTable CreateDIBSection BitBlt CreateFontIndirectW CreateSolidBrush DeleteDC SetBkMode SetTextColor GetTextExtentPoint32W GetStockObject SelectObject GetObjectW CreateCompatibleBitmap DeleteObject

shell32

SHFileOperationW SHGetFolderPathW SHChangeNotify ShellExecuteW ShellExecuteExW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

imm32

ImmDisableIME

psapi

GetProcessMemoryInfo

wininet

InternetCloseHandle InternetSetOptionW InternetOpenW HttpQueryInfoW InternetOpenUrlW

advapi32

RegQueryValueExW SetSecurityDescriptorSacl RegOpenKeyExW RegSetValueExW RegCreateKeyExW InitializeAcl GetNamedSecurityInfoW SetNamedSecurityInfoW SetEntriesInAclW BuildExplicitAccessWithNameW SetSecurityDescriptorDacl RegQueryInfoKeyW RegEnumKeyW RegCloseKey GetTokenInformation LookupAccountSidW OpenProcessToken GetLengthSid AddAccessAllowedAceEx ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo GetSecurityDescriptorSacl RegOpenKeyW InitializeSecurityDescriptor

gdiplus

GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImagePalette GdipBitmapLockBits GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipDrawImageI GdiplusShutdown GdipFree GdipGetImagePixelFormat GdiplusStartup GdipGetImageHeight GdipGetImagePaletteSize GdipCloneImage GdipBitmapUnlockBits GdipAlloc GdipGetImageWidth GdipDisposeImage

ole32

StgOpenStorage StgCreateDocfile StgOpenStorageOnILockBytes CoTaskMemFree CreateILockBytesOnHGlobal

Sharing

General

Malware Config

Signatures

File Explorer

cb69b916aa32cd7c986dbdb9ca4e03d359d47bb76a934df8b998d1b96d6402f9

kernel32

user32

gdi32

shell32

version

imm32

psapi

wininet

advapi32

gdiplus

ole32

generic