ab52adc3a0a5a314dfc6fe47e4714800

Sharing

Copy URL Twitter E-mail

General

Target

ab52adc3a0a5a314dfc6fe47e4714800
Size

424KB
MD5

ab52adc3a0a5a314dfc6fe47e4714800
SHA1

64360216db9284810a7404c6a85a166aea55b6a8
SHA256

cd9f8b0a36908274ef620d818a66aad25363fd4ad0cd37e75a4f29ffbfe25a0a
SHA512

2e7849951719a74bbbef0216deb5b4a5dbac9d58370db21d9a4dd9ad720cfbd5ffe790e10e06efce2d874e4a4d2dd9c3824b8b29b9b3b43c8b0833574cb705a8
SSDEEP

6144:wrj9qHC0x0PUd7GYs+OAcs92/VkgOoHYZPOArQk6:mQrxMUoF/doJ6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab52adc3a0a5a314dfc6fe47e4714800

Files

ab52adc3a0a5a314dfc6fe47e4714800
.exe windows:4 windows x64 arch:x64

7ab57301e150993f7feefd588f0eef86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\Users\Administrator\Documents\Visual Studio 2005\Projects\ceshibianhao\x64\release\ceshibianhao.pdb

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
GetProcAddress
LoadLibraryA
Sleep
GetModuleHandleA
ExitProcess
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
FlsGetValue
FlsSetValue
GetCurrentThreadId
FlsAlloc
TlsFree
FlsFree
SetLastError
GetLastError
GetModuleFileNameA
GetStdHandle
GetACP
GetOEMCP
GetCPInfo
HeapSize
HeapValidate
IsBadReadPtr
RtlUnwindEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
InitializeCriticalSection
GetModuleFileNameW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapSetInformation
HeapCreate
RtlLookupFunctionEntry
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapReAlloc
GetLocaleInfoA
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
RaiseException
RtlPcToFileHeader
RtlVirtualUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 187KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ab57301e150993f7feefd588f0eef86

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Sections

.text Size: 130KB - Virtual size: 130KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 187KB - Virtual size: 195KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 68KB - Virtual size: 72KB

.text
Size: 130KB - Virtual size: 130KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 187KB - Virtual size: 195KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 68KB - Virtual size: 72KB