6b99acfd878e0fdfc56db661cc53b6fefcf0e0d70c865272c3bb67d9fa9203bc

Sharing

Copy URL

Twitter E-mail

General

Target

6b99acfd878e0fdfc56db661cc53b6fefcf0e0d70c865272c3bb67d9fa9203bc
Size

1.4MB
MD5

f2cccd03241bca865d9960ebf32e7784
SHA1

0ca4749eec2979250a9f7eff3d07f9677c137180
SHA256

6b99acfd878e0fdfc56db661cc53b6fefcf0e0d70c865272c3bb67d9fa9203bc
SHA512

f789e4c4098b514d924c429ef4ded9fb3e09d34fad64064ec275a68f4c9dc5bebdeff2d0b9d2efa9fdfbbb35274ba863400c8f56571aafe4ff41fa759bb45977
SSDEEP

12288:4JP43OEedMGYbDIg+970AxJLgAqdAK5g/59FzkYRC8y2ymsRX4fRjYtYKLbMB2i:mP4AYbDIg++guxdAKq31/yajyw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b99acfd878e0fdfc56db661cc53b6fefcf0e0d70c865272c3bb67d9fa9203bc

Files

6b99acfd878e0fdfc56db661cc53b6fefcf0e0d70c865272c3bb67d9fa9203bc
.exe windows:6 windows x86 arch:x86

82097b0c583391c9234c67eca565334c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\WorkPlace\AndroidEmulator\AowRootfs_71_Release_Git_NEW_X64\Basic\Client\Output\Binfinal\Aow_Rootfs_Tools\RootFsInstall.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathIsDirectoryW

kernel32

FindResourceExW
GetModuleHandleW
GetProcAddress
DecodePointer
DeleteFileW
GetModuleFileNameW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetCommandLineW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileSectionW
GetFileAttributesW
Sleep
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
CreateFileW
FindFirstFileW
ReadFile
DeviceIoControl
GetTickCount
WriteFile
SetFilePointer
GetCurrentProcess
RemoveDirectoryW
FindNextFileW
FindResourceW
GetLogicalDrives
GetDriveTypeW
GetDiskFreeSpaceExW
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
ExpandEnvironmentStringsW
GetLongPathNameW
GetLocalTime
CreateDirectoryW
LoadLibraryW
WaitForSingleObject
FreeLibrary
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
MoveFileExW
VirtualAlloc
VirtualFree
OpenMutexW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SizeofResource
LockResource
LoadResource
WriteConsoleW
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
RaiseException
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FindClose
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
EncodePointer
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetACP
GetStringTypeW
GetFileType
CompareStringW
LCMapStringW

advapi32

RegQueryValueExW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupPrivilegeNameW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW

shell32

SHCreateDirectoryExW
CommandLineToArgvW

Sections

.text
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

82097b0c583391c9234c67eca565334c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

psapi

shlwapi

kernel32

advapi32

shell32

Sections

.text Size: 189KB - Virtual size: 189KB

.rdata Size: 58KB - Virtual size: 57KB

.data Size: 3KB - Virtual size: 7KB

.gfids Size: 512B - Virtual size: 372B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 189KB - Virtual size: 189KB

.rdata
Size: 58KB - Virtual size: 57KB

.data
Size: 3KB - Virtual size: 7KB

.gfids
Size: 512B - Virtual size: 372B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB