E:\zhanlue\2345input\bin\Win32\Release\pdb\2345PinyinSkinUtil.pdb
Static task
static1
Behavioral task
behavioral1
Sample
201c7cd646f4cb7b8d0a630e9dc4b0658eaece7e9809b78f2e6228b3ef77e1bb.exe
Resource
win7-20240221-en
General
-
Target
201c7cd646f4cb7b8d0a630e9dc4b0658eaece7e9809b78f2e6228b3ef77e1bb
-
Size
2.5MB
-
MD5
5ebb44afe6be5a33527651a6a2f4b0cb
-
SHA1
26b5c8e47febbda0b8125936a02ac9969ac97d17
-
SHA256
201c7cd646f4cb7b8d0a630e9dc4b0658eaece7e9809b78f2e6228b3ef77e1bb
-
SHA512
3d2ed40857c5bbb97a53c1ed9b2ca68bbe6e2149af34af479f02c74702f967f4e86e744f2db6d06e96d73eb9c7906a3c96b1088441a3c6a56693e7d72ebd8009
-
SSDEEP
49152:DkOcXn1B22gcQSYTTDELCdxF7LlAoM7VIipJGUMXQTPJGwPO2VDI:AOcXe2dCdxF7L+F7qij1MXc1W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 201c7cd646f4cb7b8d0a630e9dc4b0658eaece7e9809b78f2e6228b3ef77e1bb
Files
-
201c7cd646f4cb7b8d0a630e9dc4b0658eaece7e9809b78f2e6228b3ef77e1bb.exe windows:5 windows x86 arch:x86
f513623b20a54950d0ca472928b29bcc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
SHDeleteKeyW
imm32
ImmDisableIME
kernel32
HeapFree
EnterCriticalSection
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
SetFileTime
LockFile
LeaveCriticalSection
InitializeCriticalSection
GetFullPathNameA
UnlockFileEx
GetTempPathW
CreateMutexW
GetEnvironmentVariableA
FindClose
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
DeleteFileW
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
DeleteCriticalSection
GetProcessHeap
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
FlushFileBuffers
GetDriveTypeW
OpenEventW
ReleaseMutex
LockResource
LoadResource
FindResourceW
lstrcmpiW
CreateProcessW
GetACP
GetFileTime
FileTimeToSystemTime
FileTimeToDosDateTime
FindNextFileW
CreateDirectoryW
lstrlenW
SetFileAttributesW
GetCurrentDirectoryW
CopyFileW
SetEndOfFile
SetLastError
InitializeCriticalSectionAndSpinCount
SetFilePointer
FreeLibrary
HeapCreate
LoadLibraryW
GetCurrentProcess
TryEnterCriticalSection
VirtualQuery
OpenMutexW
GetLastError
OpenFileMappingW
AreFileApisANSI
CreateFileW
GetTickCount
ResetEvent
SetEvent
Sleep
GetStringTypeW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
GetFileType
PeekNamedPipe
GetStdHandle
ExitProcess
GetTimeZoneInformation
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleCP
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
DeviceIoControl
GetFileInformationByHandle
GetEnvironmentVariableW
GetFileSizeEx
GetProcAddress
FindFirstFileW
CreateEventW
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
OpenProcess
WaitForSingleObject
WriteFile
ReadFile
InterlockedExchangeAdd
LCMapStringW
GetLocalTime
WideCharToMultiByte
MultiByteToWideChar
GetPrivateProfileStringW
WritePrivateProfileStringW
GetModuleFileNameW
GetCommandLineW
GetModuleHandleW
GetFileSize
user32
MessageBoxW
advapi32
RegEnumKeyExW
GetFileSecurityW
LookupAccountNameW
SetNamedSecurityInfoW
SetEntriesInAclW
EqualSid
GetAce
GetAclInformation
GetSecurityDescriptorDacl
SystemFunction036
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyW
RegSetValueW
GetNamedSecurityInfoW
shell32
SHGetFolderPathW
SHChangeNotify
CommandLineToArgvW
iphlpapi
GetAdaptersAddresses
Exports
Exports
sqlite3_carray_init
sqlite3_csv_init
sqlite3_fileio_init
sqlite3_series_init
sqlite3_shathree_init
sqlite3_uuid_init
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 548KB - Virtual size: 548KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 110KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 85KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE