a61f36ef224da9586a4035ace7133ff8bf7fd222b81769c2d08a6112b023d89f

Sharing

Copy URL Twitter E-mail

General

Target

a61f36ef224da9586a4035ace7133ff8bf7fd222b81769c2d08a6112b023d89f
Size

1.2MB
MD5

59874fd88cbfdc3961acc66ece0b2dbc
SHA1

a7534393ae82729e4f8723188e6d834738a755e7
SHA256

a61f36ef224da9586a4035ace7133ff8bf7fd222b81769c2d08a6112b023d89f
SHA512

7b4bd42cfd0090b370ac249ddd1e4e28054e23c5588b551dd24f0e4a39f40a199f0ab601864efab7e5ca68a9c55bcf2787b9651f69c3437f8ebac159623a4f0b
SSDEEP

24576:0Qs3AqicDepFZXLPA1auOBciEv3EBhMEwRl75DMH82oK:0JbexPA1au3iEv3oMdRlVDMLz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a61f36ef224da9586a4035ace7133ff8bf7fd222b81769c2d08a6112b023d89f

Files

a61f36ef224da9586a4035ace7133ff8bf7fd222b81769c2d08a6112b023d89f
.exe windows:6 windows x86 arch:x86

36dbbcd26fc562ecb8d80d18243ad0e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\project\wubi\WB_5_4\bin\SogouPdb\SogouWubi\ScdReg.pdb

Imports

imm32

ImmDisableIME

kernel32

GetStartupInfoW
FindFirstFileW
HeapFree
FindNextFileW
GetTempPathW
InitializeCriticalSectionEx
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
GetDriveTypeW
GetCurrentDirectoryW
FindResourceW
LoadResource
FindResourceExW
LockResource
SizeofResource
FindClose
HeapSize
GetLastError
QueryPerformanceFrequency
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
ReadFile
SetLastError
WriteFile
SetFilePointer
CreateFileW
SetFileAttributesW
Sleep
CloseHandle
GetFileSize
FlushFileBuffers
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
GetCurrentProcess
GetModuleFileNameW
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
LoadLibraryW
FreeLibrary
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetCurrentThreadId
ExitThread
CreateEventW
FormatMessageW
GlobalAlloc
GlobalFree
CreateThread
LocalFree
CreateProcessW
RemoveDirectoryW
GetFileAttributesW
GetVersionExW
GetSystemDirectoryW
DeleteFileW
MoveFileExW
CreateDirectoryW
WaitForSingleObject
GetFileAttributesExW
FileTimeToSystemTime
CopyFileW
LocalAlloc
OpenEventW
CreateMutexW
ReleaseMutex
OpenMutexW
QueryPerformanceCounter
SetEvent
IsBadWritePtr
lstrlenW
TerminateProcess
GetProcessHeap
GetLocalTime
lstrcpyW
VirtualQuery
IsDebuggerPresent
SetUnhandledExceptionFilter
HeapCreate
GetStringTypeW
EncodePointer
GetCPInfo
CompareStringW
LCMapStringW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
lstrcatW
InitializeSListHead
RtlUnwind
LoadLibraryExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
GetACP
GetFileType
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetEndOfFile
ReadConsoleW
WriteConsoleW

user32

IsWindowVisible
GetWindowThreadProcessId
CreateWindowExW
wvsprintfW
SetWindowTextW
SetTimer
TrackMouseEvent
IsDlgButtonChecked
SetPropW
GetClientRect
GetDlgItem
DrawTextW
CheckDlgButton
GetParent
DialogBoxParamW
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
GetWindowTextW
RemovePropW
GetWindowLongW
CallWindowProcW
GetWindowRect
GetDC
SetWindowPos
MessageBoxW
GetPropW
ScreenToClient
SendMessageW
EndDialog
GetClassNameW
SetWindowLongW
GetSystemMetrics
GetWindowDC
SetRectEmpty
DefWindowProcW

gdi32

GetObjectW
CreateSolidBrush
DeleteObject
SelectObject
GetStockObject
GetTextExtentPoint32W
SetTextColor
SetBkMode
CreateFontIndirectW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetProcessMemoryInfo

wininet

InternetCloseHandle
HttpQueryInfoW
InternetSetOptionW
InternetOpenUrlW
InternetWriteFile
InternetCrackUrlA
HttpEndRequestW
HttpSendRequestExW
InternetConnectA
HttpAddRequestHeadersW
HttpOpenRequestA
InternetOpenW

advapi32

CryptAcquireContextW
CryptSetKeyParam
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
RegQueryValueExW
RegOpenKeyW
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
InitializeAcl
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
AddAccessAllowedAceEx
GetLengthSid
OpenProcessToken
LookupAccountSidW
GetTokenInformation
RegCloseKey
RegEnumKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW

shell32

SHFileOperationW
ShellExecuteW
SHGetFolderPathW

Sections

.text
Size: 699KB - Virtual size: 698KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 376KB - Virtual size: 375KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 76KB - Virtual size: 425KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

36dbbcd26fc562ecb8d80d18243ad0e6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

imm32

kernel32

user32

gdi32

version

psapi

wininet

advapi32

shell32

Sections

.text Size: 699KB - Virtual size: 698KB

.rdata Size: 376KB - Virtual size: 375KB

.data Size: 76KB - Virtual size: 425KB

.rsrc Size: 96KB - Virtual size: 100KB

.text
Size: 699KB - Virtual size: 698KB

.rdata
Size: 376KB - Virtual size: 375KB

.data
Size: 76KB - Virtual size: 425KB

.rsrc
Size: 96KB - Virtual size: 100KB