bfa26b76847d9fb52046353412768eab809ccef00dc2ac4c62abc70c03a92a41

Sharing

Copy URL Twitter E-mail

General

Target

bfa26b76847d9fb52046353412768eab809ccef00dc2ac4c62abc70c03a92a41
Size

10.0MB
MD5

4bb9ecbf4a5660de807f1f3bfb6cdfe5
SHA1

64ff565934b4ef3e26532e5e8eada0dd6b47e955
SHA256

bfa26b76847d9fb52046353412768eab809ccef00dc2ac4c62abc70c03a92a41
SHA512

9be63f19c1da03bf156a7a7812f736134fa845b28bd7f12c1f517d00daa0aa23ee28ba0d50e348d4f682efd8603f2f3026f059fb9821e9d5f7a0ba66450edae0
SSDEEP

196608:V6CqNWzHxSXRTBFLiB++2+hZ9xWjwJQxKMaRVoDO2A8bnh:85CxyRtF+NqUJQIMaRiiwbh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bfa26b76847d9fb52046353412768eab809ccef00dc2ac4c62abc70c03a92a41

Files

bfa26b76847d9fb52046353412768eab809ccef00dc2ac4c62abc70c03a92a41
.exe windows:5 windows x86 arch:x86

005e990545d9f8a0ef5292feec2d8dd4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\pdf_package\dev_pdf\LanshanPdf\bin\pdb\Install_Win32_release_static.pdb

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetFileAttributesW
FormatMessageW
FindClose
GetFullPathNameW
FindFirstFileW
FlushInstructionCache
HeapCreate
InterlockedCompareExchange
HeapAlloc
HeapFree
InitializeCriticalSection
FreeLibrary
LoadLibraryW
GetVersionExW
GetLocalTime
GetVersionExA
IsBadReadPtr
LoadLibraryA
GetModuleHandleA
AreFileApisANSI
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
DeleteFileW
FindNextFileW
MoveFileExW
GetFileSize
GetFileSizeEx
ReadFile
GetFileAttributesExW
CopyFileW
GetShortPathNameW
GlobalFree
LocalAlloc
LocalFree
OpenProcess
GetExitCodeProcess
ReadProcessMemory
WaitForSingleObject
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
FreeResource
GetDriveTypeW
GetACP
GetSystemInfo
ResumeThread
SetEndOfFile
SetFilePointer
GetFileTime
SetFileTime
GetLongPathNameW
lstrlenW
GetSystemDirectoryW
GetTempFileNameW
GetWindowsDirectoryW
GetCurrentDirectoryW
SearchPathW
MoveFileW
InterlockedExchangeAdd
TryEnterCriticalSection
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
GetStdHandle
GetFileType
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
RtlUnwind
RaiseException
LoadLibraryExW
WriteConsoleW
ExitProcess
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetStdHandle
GetConsoleCP
FlushFileBuffers
HeapSize
GetFileInformationByHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
lstrlenA
GetSystemTime
SystemTimeToFileTime
GlobalMemoryStatus
DeviceIoControl
CreatePipe
InitializeCriticalSectionEx
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
Process32NextW
VerifyVersionInfoW
MoveFileExA
CompareFileTime
GetEnvironmentVariableA
WaitForMultipleObjects
FormatMessageA
InterlockedIncrement
WideCharToMultiByte
OutputDebugStringA
CreateThread
CreateFileW
GetTempPathW
FindResourceW
OutputDebugStringW
CloseHandle
WriteFile
SizeofResource
LoadResource
Sleep
LockResource
CreateMutexW
ReleaseMutex
GetLastError
SetCurrentDirectoryW
GetModuleHandleW
GetModuleFileNameW
GetTickCount
InterlockedDecrement
HeapDestroy

user32

SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
IsMenu
CreatePopupMenu
DestroyMenu
CheckMenuItem
GetMenuItemCount
InsertMenuW
AppendMenuW
DeleteMenu
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetForegroundWindow
SetMenuContextHelpId
UpdateLayeredWindow
MsgWaitForMultipleObjects
GetForegroundWindow
GetProcessWindowStation
GetUserObjectInformationW
BeginPaint
UpdateWindow
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetCapture
SetFocus
IsZoomed
IsIconic
SetLayeredWindowAttributes
AnimateWindow
PostQuitMessage
TrackMouseEvent
IsWindowVisible
MonitorFromWindow
GetWindow
GetParent
SetWindowLongW
GetWindowLongW
MapWindowPoints
GetWindowRect
GetActiveWindow
GetDlgItem
CreateWindowExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
LoadImageW
CreateIconFromResource
LoadBitmapW
DestroyWindow
IsWindow
DestroyCursor
LoadCursorW
IntersectRect
GetIconInfo
DrawIconEx
OffsetRect
InflateRect
ReleaseDC
GetDC
GetWindowPlacement
SendMessageW
LoadIconW
GetSystemMetrics
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetSysColor
ClientToScreen
EnableMenuItem
CharNextW
GetDesktopWindow
SetActiveWindow
ShowWindow
MessageBoxW
PostMessageW
SetWindowPos
SetWindowTextW
IsWindowEnabled
EnableWindow
GetKeyState
GetFocus
PtInRect
EqualRect
wsprintfW
SystemParametersInfoW
DrawTextW
SetRect
SetCursor
DestroyIcon
EndPaint
GetClassNameW
IsRectEmpty
UnionRect
CopyRect
ScreenToClient
SetCaretPos
HideCaret
GetCaretBlinkTime
CreateCaret
GetCursorPos
InvalidateRect
GetMonitorInfoW
GetClientRect

advapi32

OpenSCManagerW
DeleteService
CreateServiceW
CloseServiceHandle
StartServiceW
RegCreateKeyExW
RegEnumKeyW
RegEnumValueW
RegQueryValueExW
RegSetKeySecurity
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
ChangeServiceConfig2W
ChangeServiceConfigW
DuplicateTokenEx
RegOpenKeyExW
RegSetValueExW
CreateProcessAsUserW
LookupPrivilegeValueW
LookupAccountSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
SetTokenInformation
GetTokenInformation
OpenProcessToken
RegEnumKeyExW
RegCloseKey
OpenServiceW

shell32

SHBrowseForFolderW
SHGetSpecialFolderLocation
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHChangeNotify

ole32

CoInitializeEx
CoSetProxyBlanket
CoCreateGuid
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
CLSIDFromProgID
CLSIDFromString
OleLockRunning
CreateStreamOnHGlobal
CoCreateInstance
CreateBindCtx

shlwapi

StrToIntExW
SHDeleteValueW
SHDeleteKeyW
StrStrIW
PathFileExistsW
PathRemoveFileSpecW

ws2_32

sendto
recvfrom
__WSAFDIsSet
WSAIoctl
getpeername
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
select
htonl
ioctlsocket
gethostname
shutdown
htons
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
socket
setsockopt
listen
connect
closesocket
bind
accept
WSASetLastError
send
recv
getnameinfo
freeaddrinfo
getaddrinfo
WSAGetLastError

gdiplus

GdipSaveImageToFile
GdipAlloc
GdipGetImageHeight
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDisposeImage
GdipCloneImage
GdipGetImageGraphicsContext
GdiplusStartup
GdipGetImageWidth
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdipFree
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipGraphicsClear
GdiplusShutdown
GdipDrawImageI
GdipImageGetFrameDimensionsList
GdipDrawImageRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipImageGetFrameDimensionsCount

imm32

ImmReleaseContext
ImmGetContext
ImmAssociateContext

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

gdi32

GetGlyphIndicesW
GetTextExtentPointI
AddFontMemResourceEx
RemoveFontMemResourceEx
SetTextColor
GetOutlineTextMetricsW
SetTextAlign
CreateCompatibleDC
GetTextMetricsW
SetWorldTransform
GetFontUnicodeRanges
GetGlyphOutlineW
GetFontData
GetCharABCWidthsW
EnumFontFamiliesExW
GetStockObject
CreateCompatibleBitmap
StretchBlt
ExtTextOutW
GetTextFaceW
GdiFlush
GetDCOrgEx
SetBkMode
GetClipBox
CreateSolidBrush
CreateFontIndirectW
CreateBitmap
CreateRoundRectRgn
EnumFontsW
SetGraphicsMode
GetDeviceCaps
BitBlt
GetViewportOrgEx
GetCurrentObject
SetViewportOrgEx
GetObjectW
CreateDIBSection
SelectObject
SelectClipRgn
IntersectClipRect
GetRegionData
ExtCreateRegion
DeleteObject
DeleteDC
Rectangle

oleaut32

SysFreeString
SysAllocString
VariantClear
SysAllocStringByteLen
SysStringLen

crypt32

CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertOpenStore
CertOpenSystemStoreA
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertCloseStore

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord219
ord216
ord14
ord46
ord145

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList

iphlpapi

GetAdaptersAddresses

usp10

ScriptFreeCache
ScriptItemize
ScriptShape

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 927KB - Virtual size: 927KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 61.3MB - Virtual size: 61.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

005e990545d9f8a0ef5292feec2d8dd4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

ws2_32

gdiplus

imm32

wtsapi32

userenv

gdi32

oleaut32

crypt32

wldap32

setupapi

iphlpapi

usp10

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 927KB - Virtual size: 927KB

.data Size: 73KB - Virtual size: 191KB

.rsrc Size: 61.3MB - Virtual size: 61.3MB

.reloc Size: 181KB - Virtual size: 181KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 927KB - Virtual size: 927KB

.data
Size: 73KB - Virtual size: 191KB

.rsrc
Size: 61.3MB - Virtual size: 61.3MB

.reloc
Size: 181KB - Virtual size: 181KB