ab5bd9502e1d2d0c5b874f22199b5782

Sharing

Copy URL

Twitter E-mail

General

Target

ab5bd9502e1d2d0c5b874f22199b5782
Size

65KB
MD5

ab5bd9502e1d2d0c5b874f22199b5782
SHA1

4c04ab800bf7251ee7ccd083a97c662ff6c4ee95
SHA256

d6b68092b1910c10500076dc3fbcd45372e80cec6de85e9ce27f319c58613295
SHA512

6340c86149022be668b37443459a68ff7838bcf044089568cf581e67c9021f5e959a19f6ecb6dd609763662f5ff22a492dc5e630d036dc24f65669ba29e91792
SSDEEP

1536:62tUhxgdkbBffLoneIZ+YBO/W2eWbfJs:67fgdqHMnnZ+YBSqWds

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab5bd9502e1d2d0c5b874f22199b5782

Files

ab5bd9502e1d2d0c5b874f22199b5782
.exe windows:6 windows x64 arch:x64

092cea3a757a652c27b0727e87efe0d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\admin\Desktop\开机自动运行2\x64\Release\开机自动运行2.pdb

Imports

kernel32

SizeofResource
HeapFree
ExpandEnvironmentStringsW
GetModuleFileNameW
GetTempPathW
GetSystemDirectoryW
LockResource
LoadResource
FindResourceW
HeapAlloc
GetProcAddress
GetProcessHeap
CreateProcessW
GetTickCount
LoadLibraryExW
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind

ntdll

NtMapViewOfSection
NtTerminateProcess
NtOpenFile
NtQueryValueKey
NtWaitForSingleObject
NtSetValueKey
NtQueryDirectoryFile
NtCreateFile
NtUnmapViewOfSection
NtCreateKey
NtQueryInformationFile
NtClose
NtDeleteValueKey
NtDelayExecution
NtAllocateVirtualMemory
NtSetInformationFile
NtQueryInformationProcess
NtOpenKey
NtWriteFile
NtCreateSection
NtFreeVirtualMemory

vcruntime140

memcmp
memcpy
memset
__current_exception_context
__current_exception
__C_specific_handler

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vswprintf_s
__p__commode

api-ms-win-crt-string-l1-1-0

_wcsicmp
towupper

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_set_app_type
_crt_atexit
terminate
_initialize_narrow_environment
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_register_onexit_function
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_onexit_table

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

092cea3a757a652c27b0727e87efe0d1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ntdll

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 13KB

.pdata Size: 1024B - Virtual size: 732B

.rsrc Size: 45KB - Virtual size: 44KB

.reloc Size: 512B - Virtual size: 44B

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 13KB

.pdata
Size: 1024B - Virtual size: 732B

.rsrc
Size: 45KB - Virtual size: 44KB

.reloc
Size: 512B - Virtual size: 44B