dcfa56c7ca8e480be2f6453cfe605e027e9e8524256496c944a6f2d944ab7d16

Sharing

Copy URL Twitter E-mail

General

Target

dcfa56c7ca8e480be2f6453cfe605e027e9e8524256496c944a6f2d944ab7d16
Size

9.1MB
MD5

c4d7553660f4007e90254c7842a4bf80
SHA1

256b7e6de578792a1037dad6f7aa48ce17e4ffa3
SHA256

dcfa56c7ca8e480be2f6453cfe605e027e9e8524256496c944a6f2d944ab7d16
SHA512

df1cbc6722bfcf16c4d5b5353b45d947a9e0cb1db448906df9cc54948ded7030b711df0ae77ce5b6adc4280d0e6b86f848f0245398461e29c9afa173b23f3e32
SSDEEP

196608:FPy/iTuSLlf3u+8KCoMpR75hbESkszJo76:2iRLNOKCoMpRYSkszJp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dcfa56c7ca8e480be2f6453cfe605e027e9e8524256496c944a6f2d944ab7d16

Files

dcfa56c7ca8e480be2f6453cfe605e027e9e8524256496c944a6f2d944ab7d16
.exe windows:6 windows x86 arch:x86

a1f0b4c3ed0975d0028e278b4be62290

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\landun\wubi_agent\workspace\p-3417ba0c0c0d46dfae3a04bc6431244c\src\bin\SogouPdb\SogouWubi\ImeUtil.pdb

Imports

kernel32

GetTempPathW
DeleteFileW
GetCurrentProcessId
WideCharToMultiByte
GetTempFileNameW
GetLogicalDrives
DeviceIoControl
CreateFileW
GetDiskFreeSpaceExW
GetDriveTypeW
SizeofResource
InitializeCriticalSectionEx
HeapSize
LockResource
HeapReAlloc
RaiseException
FindResourceExW
LoadResource
FindResourceW
FindNextFileW
FindFirstFileW
GetCurrentThread
GetSystemInfo
GetLastError
CopyFileW
GetCurrentThreadId
HeapDestroy
CreateProcessW
GetExitCodeProcess
GetSystemDirectoryW
LoadLibraryW
DecodePointer
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WriteConsoleW
GetNumberOfConsoleInputEvents
InitializeCriticalSection
FormatMessageA
GetFileType
SetFilePointerEx
CreateFileA
GetStdHandle
GetStartupInfoW
GetSystemTimeAsFileTime
OpenEventW
CreateDirectoryW
GetFileSize
WaitForSingleObjectEx
GetExitCodeThread
GlobalUnlock
GlobalLock
HeapAlloc
SetFileAttributesW
SetEndOfFile
SetFilePointer
GetFileSizeEx
ReadFile
GlobalFree
GlobalAlloc
GetProcAddress
GetCurrentProcess
OutputDebugStringW
GetFileTime
HeapCreate
GetLocalTime
FreeLibrary
QueryPerformanceFrequency
TlsSetValue
CloseHandle
SetEvent
WaitForSingleObject
GetVersionExW
GetModuleFileNameW
GetTickCount
GetModuleHandleW
GetProcessHeap
GetCommandLineA
GetOEMCP
SystemTimeToFileTime
GetConsoleCP
ReadConsoleW
GetUserDefaultLCID
IsValidLocale
SetStdHandle
GetFullPathNameA
SetEnvironmentVariableA
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetModuleHandleExW
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
FreeLibraryAndExitThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
VirtualProtect
VirtualFree
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
InterlockedCompareExchange
GetThreadTimes
ExpandEnvironmentStringsA
SleepEx
GetFullPathNameW
lstrcpyW
lstrcatW
IsBadWritePtr
EnumResourceNamesW
EnumSystemLocalesW
OpenFileMappingA
GetWindowsDirectoryA
GlobalReAlloc
GetDriveTypeA
ReadDirectoryChangesW
GetLongPathNameW
Module32First
Module32Next
GetSystemDirectoryA
CreateFileMappingA
GetDateFormatW
TlsGetValue
GetTimeFormatW
GetTimeZoneInformation
WaitForMultipleObjectsEx
DebugBreak
GetVolumePathNameW
GetVolumeInformationW
ReadConsoleInputA
PeekConsoleInputA
PeekNamedPipe
GetVersion
GetLocaleInfoA
GetThreadLocale
GetShortPathNameW
GetVersionExA
VirtualQuery
GetWindowsDirectoryW
CreateEventA
GetModuleHandleA
GetProcessAffinityMask
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
LoadLibraryA
IsValidCodePage
GetACP
IsDBCSLeadByteEx
GetCurrentDirectoryW
GetConsoleMode
SetConsoleMode
LoadLibraryExW
VerifyVersionInfoW
WriteFile
VerSetConditionMask
CreateMutexA
lstrlenA
lstrlenW
ExitProcess
GlobalHandle
FlushFileBuffers
ReleaseMutex
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
OpenFileMappingW
GetCommandLineW
LocalAlloc
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
RemoveDirectoryW
LocalFree
ExitThread
WaitForMultipleObjects
MoveFileExW
FileTimeToSystemTime
GetFileAttributesExW
GetFileAttributesW
SetFileTime
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
GetCPInfo
GetStringTypeW
HeapFree
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
TlsFree
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
QueryPerformanceCounter
FormatMessageW
SwitchToThread
DuplicateHandle
TryEnterCriticalSection
FindClose
OpenMutexW
CreateThread
CreateMutexW
MultiByteToWideChar
Sleep

user32

GetMessageW
ReleaseDC
IsIconic
GetDesktopWindow
FindWindowW
GetMonitorInfoW
EnableWindow
ShowWindow
MonitorFromPoint
LoadIconW
PostMessageW
GetWindowDC
RemovePropW
LoadCursorW
NotifyWinEvent
GetPropW
GetCursorPos
ReleaseCapture
DispatchMessageW
ClientToScreen
IsWindowEnabled
TranslateMessage
PostQuitMessage
UnloadKeyboardLayout
RedrawWindow
GetSysColorBrush
InflateRect
CreateDialogParamW
CheckDlgButton
FillRect
DestroyCursor
PeekMessageA
SystemParametersInfoA
MessageBoxA
SetWindowRgn
InvalidateRect
wvsprintfW
CharNextW
WindowFromPoint
LoadBitmapW
DrawTextW
IsDlgButtonChecked
SetClassLongW
mouse_event
GetClassLongW
GetFocus
PtInRect
GetParent
UpdateLayeredWindow
SetCapture
IntersectRect
GetForegroundWindow
GetSystemMetrics
MonitorFromRect
GetWindowRect
SubtractRect
SetCursor
SetRect
GetWindowTextW
SetForegroundWindow
SetWindowLongW
SetPropW
SetFocus
GetAsyncKeyState
SetWindowTextW
SendMessageW
CreateWindowExW
SetWindowPos
IsWindowVisible
DestroyWindow
CallWindowProcW
DefWindowProcW
GetWindowTextLengthW
GetWindowLongW
GetKeyState
LoadImageW
DestroyIcon
KillTimer
SetTimer
BringWindowToTop
EndPaint
BeginPaint
RegisterWindowMessageW
PeekMessageW
RegisterClassExW
IsWindow
GetClientRect
EnumThreadWindows
GetClassNameW
DialogBoxIndirectParamW
EndDialog
EnumChildWindows
MessageBoxW
DialogBoxParamW
UnregisterClassW
TrackMouseEvent
IsDialogMessageW
MoveWindow
GetDC
GetMenuItemID
EndDeferWindowPos
BeginDeferWindowPos
DeferWindowPos
ExitWindowsEx
SetCursorPos
SetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
RegisterClipboardFormatW
SendInput
SystemParametersInfoW
wsprintfW
GetDlgItem
GetCursor
SetScrollInfo
OffsetRect
LoadKeyboardLayoutW
GetKeyboardLayoutList
MsgWaitForMultipleObjectsEx
LoadStringW
EnumWindows
AttachThreadInput
MonitorFromWindow
GetWindow
GetWindowThreadProcessId
SetRectEmpty
ScreenToClient

gdi32

BitBlt
GetTextExtentPointW
SetPixel
StretchBlt
LineTo
CreatePen
MoveToEx
SetStretchBltMode
CreateCompatibleBitmap
GetPixel
GetObjectW
GetFontUnicodeRanges
CreateCompatibleDC
DeleteDC
CreateFontIndirectW
SetBkMode
DeleteObject
CreateSolidBrush
GetDeviceCaps
SelectObject
GetTextExtentExPointW
GetStockObject
SetTextColor
CreateDIBSection
SetTextCharacterExtra
StretchDIBits
GetFontData
SetWorldTransform
ExtTextOutW
SetTextAlign
SetMapMode
GetTextMetricsA
GetGlyphOutlineW
RestoreDC
GetGlyphIndicesW
GetCharWidth32A
SetGraphicsMode
GetOutlineTextMetricsA
ModifyWorldTransform
SaveDC
GdiFlush
IntersectClipRect
ExtSelectClipRgn
SelectClipRgn
GetGraphicsMode
CreateRectRgn
ExtCreateRegion
GetClipBox
GetClipRgn
GetWorldTransform
CreateDCA
Rectangle
GetGlyphOutlineA
EnumFontFamiliesExW
SetDIBColorTable
CombineRgn
OffsetRgn
GetCharABCWidthsFloatW
GetTextExtentPoint32W
GetTextMetricsW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

CryptAcquireContextW
CryptSetKeyParam
CryptDestroyKey
CryptEncrypt
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptImportKey
RegDeleteValueW
LookupAccountSidW
RegQueryValueW
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorSacl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegFlushKey
RegQueryInfoKeyW
RegEnumKeyW
GetSecurityInfo
GetUserNameW
GetFileSecurityW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
RegOpenKeyExA
RegQueryValueExA
RegNotifyChangeKeyValue
RegOpenKeyW
CryptReleaseContext
CryptDecrypt

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHFileOperationW
ShellExecuteExW
SHGetFileInfoW
ShellExecuteW
Shell_NotifyIconW
CommandLineToArgvW

ole32

StgOpenStorage
CreateILockBytesOnHGlobal
StgCreateDocfile
StgOpenStorageOnILockBytes
StringFromCLSID
CoInitializeEx
CoCreateInstance
CreateStreamOnHGlobal
CoInitialize
OleInitialize
OleUninitialize
OleCreate
OleSetContainedObject
CoTaskMemFree
CoUninitialize

oleaut32

SysStringByteLen
VariantClear
VariantInit
SysAllocString
SysAllocStringByteLen
SysFreeString

gdiplus

GdipCreateHBITMAPFromBitmap
GdipGetImageRawFormat
GdipLoadImageFromFile
GdiplusShutdown
GdiplusStartup
GdipFillPolygonI
GdipGetImageEncodersSize
GdipCreateBitmapFromStream
GdipGetImageEncoders
GdipDrawImageRectRectI
GdipCreateBitmapFromFile
GdipGetImageGraphicsContext
GdipBitmapLockBits
GdipSetInterpolationMode
GdipBitmapUnlockBits
GdipGetImageHeight
GdipCloneImage
GdipRotateMatrix
GdipDrawImageRectI
GdipCreateMatrix2
GdipDisposeImage
GdipSetWorldTransform
GdipResetWorldTransform
GdipTranslateMatrix
GdipGetImageWidth
GdipDeleteMatrix
GdipDrawPieI
GdipDeleteBrush
GdipAlloc
GdipSetSmoothingMode
GdipCreateSolidFill
GdipFillPieI
GdipDrawLineI
GdipDrawImageI
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipFree
GdipSetPenLineJoin
GdipCreateFromHDC
GdipCloneBrush
GdipDeleteGraphics
GdipDeletePen
GdipCreatePen1
GdipCreateBitmapFromScan0
GdipSaveImageToFile

imm32

ImmGetHotKey
ImmDisableIME
ImmGetIMCCSize
ImmLockIMCC
ImmLockIMC
ImmUnlockIMC
ImmUnlockIMCC
ImmGetContext
ImmNotifyIME
ImmSetHotKey

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetProcessMemoryInfo

oleacc

LresultFromObject
AccessibleObjectFromWindow

wininet

InternetOpenUrlW
InternetOpenW
HttpQueryInfoW
InternetCloseHandle
InternetReadFile
HttpOpenRequestA
InternetSetOptionW
InternetCrackUrlA
HttpEndRequestW
HttpSendRequestExW
InternetConnectA
InternetCanonicalizeUrlW
HttpOpenRequestW
InternetErrorDlg
HttpSendRequestW
InternetConnectW
InternetQueryOptionW
InternetGetConnectedState
HttpAddRequestHeadersW
InternetWriteFile
InternetSetCookieW

comctl32

ImageList_Create
InitCommonControlsEx
ImageList_ReplaceIcon

msimg32

AlphaBlend
TransparentBlt
GradientFill

shlwapi

SHDeleteKeyW
PathFileExistsW
PathIsDirectoryEmptyW
StrToIntW
StrCmpIW

ws2_32

getpeername
sendto
recvfrom
accept
gethostname
getservbyport
setsockopt
WSAStringToAddressA
WSAAddressToStringA
bind
listen
getsockname
WSACleanup
socket
ntohs
connect
inet_ntoa
getservbyname
htons
closesocket
inet_addr
WSASetLastError
select
gethostbyname
WSASetEvent
WSAEventSelect
send
recv
getsockopt
WSAEnumNetworkEvents
ioctlsocket
WSAGetLastError
WSAStartup
ntohl
htonl
__WSAFDIsSet
gethostbyaddr

wldap32

ord41
ord22
ord26
ord27
ord32
ord33
ord50
ord79
ord30
ord200
ord301
ord211
ord46
ord143
ord35
ord60

usp10

ScriptIsComplex
ScriptItemize
ScriptPlace
ScriptShape

dnsapi

DnsFree
DnsQuery_A

Sections

.text
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 181KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a1f0b4c3ed0975d0028e278b4be62290

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

gdiplus

imm32

version

psapi

oleacc

wininet

comctl32

msimg32

shlwapi

ws2_32

wldap32

usp10

dnsapi

Sections

.text Size: 5.6MB - Virtual size: 5.6MB

.rdata Size: 2.2MB - Virtual size: 2.2MB

.data Size: 181KB - Virtual size: 1.7MB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.text
Size: 5.6MB - Virtual size: 5.6MB

.rdata
Size: 2.2MB - Virtual size: 2.2MB

.data
Size: 181KB - Virtual size: 1.7MB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB