9177d5e7e78c6f2c5815b8db340bd26f66401f14f8c15fab68d4bda012598ff4

Sharing

Copy URL Twitter E-mail

General

Target

9177d5e7e78c6f2c5815b8db340bd26f66401f14f8c15fab68d4bda012598ff4
Size

1.3MB
MD5

2a3abb2ddcaf7a6ef5b043c728f575f7
SHA1

7ee228bc67c98c989ef60d30c33c43169056ef3b
SHA256

9177d5e7e78c6f2c5815b8db340bd26f66401f14f8c15fab68d4bda012598ff4
SHA512

a0fcd4817f6a0a6f9ca4aab92e5df6324f9da0c4a3286a1650d2330348d9e9ba44f83d7cdcc406cb286a62ae48ec4fc4b92e89753d40450cecb6eca4ed585373
SSDEEP

24576:X/CxhQi+gdzHd4E7yqPlEM5rvCau8l/b06/WWBSm7xZEQc2hBjoIqsI:vodPyUlEIrqau8l/b06ulm7xZxrkIXI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9177d5e7e78c6f2c5815b8db340bd26f66401f14f8c15fab68d4bda012598ff4

Files

9177d5e7e78c6f2c5815b8db340bd26f66401f14f8c15fab68d4bda012598ff4
.exe windows:6 windows x86 arch:x86

5e197e9ecd69c3f8c3d7e72c27e18fdc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\project\sogouime\dev_11.1_pc_modify\Bin\SogouPdb\SogouInput\crashrpt.pdb

Imports

version

GetFileVersionInfoA
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
VerQueryValueA
GetFileVersionInfoSizeA

kernel32

FreeLibrary
MultiByteToWideChar
GetSystemDirectoryA
OutputDebugStringA
CreateMutexA
OpenMutexA
Sleep
ReadFile
GetFileSize
CreateFileA
GlobalMemoryStatusEx
Process32Next
Process32First
CreateToolhelp32Snapshot
WideCharToMultiByte
CopyFileA
LoadLibraryA
GetProcAddress
IsBadWritePtr
GetCurrentProcess
lstrlenW
WriteFile
TerminateProcess
GetModuleFileNameW
SetFilePointer
CreateFileW
GetCurrentThreadId
FormatMessageW
lstrcatW
LoadLibraryW
GetLocalTime
GetCurrentProcessId
CreateProcessW
GetModuleHandleW
lstrcpyW
GetTickCount
VirtualQuery
IsDebuggerPresent
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetCurrentThread
HeapSize
GetFileType
GetConsoleCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
SetStdHandle
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
WriteConsoleW
GetProcessHeap
SetConsoleCtrlHandler
GetTimeZoneInformation
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
TerminateThread
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
CreateThread
SetEndOfFile
GetModuleFileNameA
ReadProcessMemory
OpenProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
RaiseException
CloseHandle
DecodePointer
CreateDirectoryA
EncodePointer
GetTempPathW
GetSystemDirectoryW
Process32NextW
Process32FirstW
OpenMutexW
CreateDirectoryW
SetFileTime
GetProcessId
WaitForSingleObject
GetFileAttributesW
SetFileAttributesW
GetFileAttributesExW
FileTimeToSystemTime
GlobalAlloc
DeleteFileW
GlobalFree
MoveFileExW
SystemTimeToFileTime
CopyFileW
GetTempFileNameW
GetFileTime
GetExitCodeProcess
DuplicateHandle
ExitThread
LocalFree
QueryDosDeviceW
FindFirstFileW
RemoveDirectoryW
GetLogicalDriveStringsW
LocalAlloc
CreateMutexW
ReleaseMutex
GetVersionExW
GetWindowsDirectoryW
VirtualAlloc
QueryPerformanceFrequency
InitializeCriticalSection
OpenFileMappingW
UnmapViewOfFile
FlushViewOfFile
CreateFileMappingW
MapViewOfFile
ResumeThread
FreeLibraryAndExitThread
GetOEMCP

user32

MonitorFromRect
SetWindowPos
IsWindowVisible
GetDC
SendMessageTimeoutW
GetWindowRect
FindWindowExW
MonitorFromPoint
GetWindowLongW
GetMonitorInfoW
WindowFromPoint
TranslateMessage
MsgWaitForMultipleObjectsEx
PeekMessageW
DispatchMessageW
wsprintfW
MessageBoxW
AttachThreadInput
EnumWindows
GetClassNameW
UnregisterClassA
GetDesktopWindow
SystemParametersInfoW
GetParent
wvsprintfW
SetForegroundWindow
IsIconic
ReleaseDC
GetWindowThreadProcessId
GetFocus
ShowWindow
GetForegroundWindow
GetSystemMetrics
UnregisterClassW
SetRectEmpty

advapi32

RegFlushKey
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
BuildExplicitAccessWithNameW
GetTokenInformation
LookupAccountSidW
OpenProcessToken
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegEnumValueW
SetNamedSecurityInfoW
RegDeleteValueW
RegCreateKeyExW
SetEntriesInAclW
RegQueryInfoKeyW
RegEnumKeyW
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorSacl
GetNamedSecurityInfoW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

imm32

ImmDisableIME

wininet

InternetCloseHandle
InternetConnectA
InternetOpenUrlA
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpEndRequestA
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpQueryInfoA

psapi

GetModuleInformation
GetProcessMemoryInfo
GetModuleFileNameExW

gdi32

GetDeviceCaps

shell32

SHGetFolderPathW
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
SHFileOperationW

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 14KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5e197e9ecd69c3f8c3d7e72c27e18fdc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

kernel32

user32

advapi32

imm32

wininet

psapi

gdi32

shell32

ole32

oleaut32

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 180KB - Virtual size: 180KB

.data Size: 14KB - Virtual size: 150KB

.rsrc Size: 84KB - Virtual size: 84KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 180KB - Virtual size: 180KB

.data
Size: 14KB - Virtual size: 150KB

.rsrc
Size: 84KB - Virtual size: 84KB