c227571ebcbd3b12e795b0293e2db39c

Sharing

Copy URL Twitter E-mail

General

Target

c227571ebcbd3b12e795b0293e2db39c
Size

268KB
MD5

c227571ebcbd3b12e795b0293e2db39c
SHA1

29f7809e2eb2a47e0d670dded72087b6ccc1c3db
SHA256

6c8e884820e67677bf4cc6214334ff5f8dab1f21904203ccdea593841aba80b4
SHA512

c13edb8c18925c5b9df87d320e8a6f4d2b2df5de9e7ef2e36ae8f2ec4ea1abc0d8160cfd8aaa162cad7988cf3d74081a0267f805fbf1d5b3b3920590ee45b80b
SSDEEP

6144:aZdOaKyYn39T2E18/3txH0IBBsiKPRTxfVZ8:aZdOaKyYn39T28gdToZTJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c227571ebcbd3b12e795b0293e2db39c

Files

c227571ebcbd3b12e795b0293e2db39c
.exe windows:4 windows x86 arch:x86

a5ba925f8005625a98ffa513bb3523bd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\iCafe8\网维6.0\SourceCode\BarClient\HardwareInfo\Release\HardwareInfo.pdb

Imports

iocptcp

TcpInit
TcpCreate
TcpGetLinkAddr
TcpConnect
TcpSend

kernel32

GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GlobalFlags
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetFullPathNameA
CreateFileA
ExitProcess
RtlUnwind
HeapFree
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetCurrentProcessId
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
GlobalDeleteAtom
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
GetDriveTypeA
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
SetEnvironmentVariableA
InterlockedExchange
GetACP
CreateDirectoryA
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
GetComputerNameA
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
TerminateProcess
GetCurrentProcess
InterlockedDecrement
MultiByteToWideChar
GetLastError
GetVersion
lstrcmpiA
lstrlenA
CompareStringA
CompareStringW
FreeEnvironmentStringsW
Sleep
SetConsoleCtrlHandler
GetModuleHandleA
GetCommandLineA
GetModuleFileNameA
DeleteFileA
GetTimeZoneInformation
LoadLibraryA
FreeLibrary
lstrcmpW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
LocalAlloc
InterlockedIncrement
FileTimeToLocalFileTime
FileTimeToSystemTime
SetErrorMode
GetProcAddress
lstrcpyA
lstrcatA
lstrcmpA
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
lstrcpynA
LocalFree
CreateThread
TerminateThread
WaitForSingleObject
GetTickCount
GetLocalTime
GetCurrentThreadId
OutputDebugStringA
SetEvent
OpenFileMappingA
OpenEventA
CreateFileMappingA
CreateEventA
MapViewOfFile
UnmapViewOfFile
CloseHandle
FindFirstFileA
FindNextFileA
FindClose

user32

CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowTextA
ValidateRect
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
EnableMenuItem
GetMessagePos
LoadIconA
MapWindowPoints
GetKeyState
SetForegroundWindow
GetClientRect
GetMenu
PostMessageA
AdjustWindowRectEx
GetClassInfoA
UnregisterClassA
ModifyMenuA
SetMenuItemBitmaps
RegisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
CopyRect
DestroyMenu
PostQuitMessage
PtInRect
GetWindow
GetMessageTime
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
GetSysColorBrush
GetSysColor
ReleaseDC
GetDC
GetSystemMetrics
LoadCursorA
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetWindowTextA
SendMessageA
MessageBoxA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
UnhookWindowsHookEx

gdi32

SetMapMode
GetClipBox
DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetTextColor
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
CreateBitmap
GetStockObject
SetBkColor
RestoreDC
SaveDC
SetViewportExtEx
GetDeviceCaps

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

comctl32

ord17

shlwapi

PathFindExtensionA
PathFindFileNameA

ole32

CoInitializeEx
CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket

oleaut32

SysFreeString
SafeArrayDestroy
SafeArrayGetElement
VariantInit
SafeArrayGetUBound
SafeArrayGetLBound
VariantClear
VariantChangeType
SysAllocString

ws2_32

htonl
ntohl
htons
ntohs

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5ba925f8005625a98ffa513bb3523bd

Headers

File Characteristics

PDB Paths

Imports

iocptcp

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

shlwapi

ole32

oleaut32

ws2_32

iphlpapi

Sections

.text Size: 216KB - Virtual size: 215KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 8KB - Virtual size: 24KB

.rsrc Size: 4KB - Virtual size: 1024B

.text
Size: 216KB - Virtual size: 215KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 8KB - Virtual size: 24KB

.rsrc
Size: 4KB - Virtual size: 1024B