56175e22075258b982f672be3995bbd82d25e113e3ff6010a65a6f8b15a2bf67

Sharing

Copy URL Twitter E-mail

General

Target

56175e22075258b982f672be3995bbd82d25e113e3ff6010a65a6f8b15a2bf67
Size

1.6MB
MD5

a02665bf94be77f8f02342bbc7c75cfe
SHA1

2e92d0eacc2af292e9706813b3903953e99977df
SHA256

56175e22075258b982f672be3995bbd82d25e113e3ff6010a65a6f8b15a2bf67
SHA512

2c909ad85d27563fda2e76427de22e95ae65c13330fcaa21c7da35267a089e8108d92b8c41f5fb5918475ffb86170b58ca0d95d5b57958d42da79cae5807aace
SSDEEP

24576:C+4n1GKUPlCHJxfJjimneqr9SvghH5d1PzcOZA:+ilCpPjCcugzPbr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56175e22075258b982f672be3995bbd82d25e113e3ff6010a65a6f8b15a2bf67

Files

56175e22075258b982f672be3995bbd82d25e113e3ff6010a65a6f8b15a2bf67
.exe windows:6 windows x86 arch:x86

4ac2cadde820e18807ba03e47954d588

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\landun\wubi_agent\workspace\p-3417ba0c0c0d46dfae3a04bc6431244c\src\bin\SogouPdb\SogouWubi\ConfigIE.pdb

Imports

comctl32

InitCommonControlsEx

kernel32

CompareStringW
GetSystemTime
FindFirstFileW
FindNextFileW
FindClose
CreateFileW
GetModuleHandleW
DeleteFileW
GetFileAttributesW
QueryPerformanceFrequency
GetDiskFreeSpaceExW
CloseHandle
WriteConsoleW
SetEndOfFile
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetStdHandle
SetLastError
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
HeapFree
GetCommandLineW
GetCurrentProcess
GetModuleFileNameW
GetTempPathW
GetLastError
HeapAlloc
GetProcAddress
GetCurrentProcessId
TlsAlloc
TlsFree
ReadFile
WriteFile
SetFilePointer
GetCurrentThreadId
ExitThread
CreateEventW
FormatMessageW
GlobalAlloc
GlobalFree
CreateThread
LocalFree
GetFileSize
CreateProcessW
CreateDirectoryW
WaitForSingleObject
SetFileAttributesW
GetFileAttributesExW
FileTimeToSystemTime
MoveFileExW
CopyFileW
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
LocalAlloc
GetSystemDirectoryW
LoadLibraryW
FreeLibrary
RemoveDirectoryW
Sleep
FlushFileBuffers
CreateMutexW
ReleaseMutex
OpenMutexW
GetProcessHeap
SetEvent
QueryPerformanceCounter
IsBadWritePtr
lstrlenW
TerminateProcess
lstrcatW
GetLocalTime
lstrcpyW
VirtualQuery
IsDebuggerPresent
SetUnhandledExceptionFilter
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
RaiseException
DecodePointer
HeapDestroy
SizeofResource
LockResource
FindResourceExW
LoadResource
FindResourceW
HeapCreate
LCMapStringW
GetStringTypeW
EncodePointer
GetCPInfo
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
RtlUnwind
LoadLibraryExW
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
SetEnvironmentVariableA
GetCurrentDirectoryW
GetDriveTypeW
GetFullPathNameW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
ExitProcess
GetStdHandle
GetACP
GetDateFormatW
GetTimeFormatW
IsValidCodePage
GetOEMCP
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP

user32

GetClassNameW
SetRectEmpty
IsWindowVisible
GetWindowThreadProcessId
GetWindowLongW
wvsprintfW
EndPaint
BeginPaint
DialogBoxParamW
SetWindowLongW
DestroyWindow
CreateDialogParamW
IsIconic
SetForegroundWindow
FindWindowW
GetSystemMetrics
ShowWindow
CheckDlgButton
GetSystemMenu
PostMessageW
GetWindowRect
GetFocus
MessageBoxW
ScreenToClient
EndDialog
SetWindowTextW
SetDlgItemTextW
GetDlgItemTextW
MoveWindow
LoadBitmapW
LoadIconW
GetClientRect
GetDlgItem
EnableMenuItem
EnableWindow
SendMessageW

gdi32

StretchBlt
CreateFontIndirectW
CreateCompatibleDC
GetObjectW
SelectObject
DeleteObject

comdlg32

GetOpenFileNameW
GetSaveFileNameW

shell32

SHGetFolderPathW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderPathW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

imm32

ImmDisableIME

psapi

GetProcessMemoryInfo

wininet

InternetOpenUrlW
InternetOpenW
HttpQueryInfoW
InternetCloseHandle
InternetSetOptionW

advapi32

AddAccessAllowedAceEx
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
GetTokenInformation
LookupAccountSidW
OpenProcessToken
GetLengthSid
RegOpenKeyW
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
InitializeAcl
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW

Sections

.text
Size: 688KB - Virtual size: 687KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 454KB - Virtual size: 453KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 87KB - Virtual size: 939KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 409KB - Virtual size: 412KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4ac2cadde820e18807ba03e47954d588

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

gdi32

comdlg32

shell32

version

imm32

psapi

wininet

advapi32

Sections

.text Size: 688KB - Virtual size: 687KB

.rdata Size: 454KB - Virtual size: 453KB

.data Size: 87KB - Virtual size: 939KB

.rsrc Size: 409KB - Virtual size: 412KB

.text
Size: 688KB - Virtual size: 687KB

.rdata
Size: 454KB - Virtual size: 453KB

.data
Size: 87KB - Virtual size: 939KB

.rsrc
Size: 409KB - Virtual size: 412KB