d8a357bc4ce156452750eda113aaeb428c681fcff8a57390984fbb0efa1fd3db

Sharing

Copy URL Twitter E-mail

General

Target

d8a357bc4ce156452750eda113aaeb428c681fcff8a57390984fbb0efa1fd3db
Size

435KB
MD5

d4d81c42c39c040bc73d64af4ac71dde
SHA1

7a2f90eb73c22469b7a307dd7579860b21969eb4
SHA256

d8a357bc4ce156452750eda113aaeb428c681fcff8a57390984fbb0efa1fd3db
SHA512

f5e3484936ebc426c3854d92bcca2f806f4d0f91e696eee8731673a945e0205abd805b00c7e1318b224f97bc93b2bdc5ca03154314366c14374f6a3d34bfebe9
SSDEEP

12288:4ZH7+DAiF9XnAbAAi98+bAwTrq4EBaG/Fe+afHGZoHUglK1j:znHAiDbAwT24EB1HaG+Ud

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d8a357bc4ce156452750eda113aaeb428c681fcff8a57390984fbb0efa1fd3db

Files

d8a357bc4ce156452750eda113aaeb428c681fcff8a57390984fbb0efa1fd3db
.exe windows:5 windows x86 arch:x86

d92df582718e52058bea23574414009f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\wangshuai06\yunxiazi-sso-client-sec\LocalAgent\Release\YABLocalAgent.pdb

Imports

ws2_32

WSAStartup
gethostname
sendto
recvfrom
WSAIoctl
freeaddrinfo
getaddrinfo
getprotobynumber
getservbyname
ntohs
ntohl
htonl
getsockopt
connect
accept
select
WSASend
WSARecv
ioctlsocket
WSAGetOverlappedResult
socket
setsockopt
listen
getsockname
closesocket
bind
WSAGetLastError
WSASetLastError
getpeername
send
recv
WSACleanup
htons

kernel32

SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetEndOfFile
MultiByteToWideChar
GetCurrentDirectoryW
HeapReAlloc
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
GetTimeZoneInformation
LCMapStringW
CompareStringW
GetModuleFileNameA
GetProcessHeap
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CloseHandle
GetSystemInfo
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
Sleep
GetSystemDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
LocalAlloc
LocalFree
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetTickCount
GetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
GetVersion
GetStringTypeW
HeapSize
WriteConsoleW
EnterCriticalSection
HeapFree
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
GetCurrentThreadId
DecodePointer
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
RaiseException
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetStdHandle
GetFileType
SetFilePointerEx
CreateFileW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetConsoleMode
ReadConsoleW
ExitProcess
SetConsoleCtrlHandler
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapAlloc

advapi32

RegOpenKeyExA
RegCloseKey
CryptGenRandom
CryptAcquireContextA
RegQueryValueExA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 302KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d92df582718e52058bea23574414009f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

advapi32

shell32

Sections

.text Size: 302KB - Virtual size: 301KB

.rdata Size: 41KB - Virtual size: 40KB

.data Size: 74KB - Virtual size: 79KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 302KB - Virtual size: 301KB

.rdata
Size: 41KB - Virtual size: 40KB

.data
Size: 74KB - Virtual size: 79KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB