b3ad909faa8070b83f8c048e008ebb3e5ccdd8955e253493e8621b498c5eadc6

Sharing

Copy URL Twitter E-mail

General

Target

b3ad909faa8070b83f8c048e008ebb3e5ccdd8955e253493e8621b498c5eadc6
Size

1.7MB
MD5

83960d16f6d054fafd4bad12bec37efb
SHA1

52c021055a26105c0180314e2ae06bd34656107e
SHA256

b3ad909faa8070b83f8c048e008ebb3e5ccdd8955e253493e8621b498c5eadc6
SHA512

1605939f139dfd333ab0c0546051d69b9e8c2601bda51d97868715180ea7c16f89b48521f390ada9856a0e4ef54b877f666531f6842b8ebb96864fbafc8d6017
SSDEEP

24576:5SNSZcRxP9RyCDIEsz5v4cicmsuyZYzAxQ1eRUWSBu7JSWbZ4:E0qxPSCcv5v4ca5yxuWF7JSWbZ4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b3ad909faa8070b83f8c048e008ebb3e5ccdd8955e253493e8621b498c5eadc6

Files

b3ad909faa8070b83f8c048e008ebb3e5ccdd8955e253493e8621b498c5eadc6
.exe windows:5 windows x86 arch:x86

ebb35909367952232ee0a79f923cdf96

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\布谷鸟\网关\Src\Release\SmartPal.pdb

Imports

kernel32

SuspendThread
ResumeThread
GetThreadLocale
FindClose
FindFirstFileW
GetVolumeInformationW
DuplicateHandle
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GlobalFlags
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
VirtualProtect
FileTimeToLocalFileTime
GetFileSizeEx
GetFileTime
FindNextFileW
SetErrorMode
GetUserDefaultLCID
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
FileTimeToSystemTime
LocalAlloc
GetStartupInfoW
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
ExitProcess
GetStdHandle
HeapQueryInformation
GetFileType
SetStdHandle
GetCommandLineW
GetCommandLineA
VirtualQuery
VirtualAlloc
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
InterlockedPushEntrySList
RtlUnwind
GetCPInfo
GetStringTypeW
LCMapStringW
SetThreadPriority
InitializeSListHead
ReleaseMutex
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetSystemDirectoryW
EncodePointer
lstrcmpA
MulDiv
GetModuleHandleW
GetModuleHandleA
GetACP
QueryPerformanceFrequency
GetCurrentThread
SystemTimeToTzSpecificLocalTime
SetLastError
CreateDirectoryW
GetModuleFileNameW
RaiseException
DecodePointer
TryEnterCriticalSection
GetCurrentThreadId
AreFileApisANSI
ReadFile
HeapCreate
GetFullPathNameW
WriteFile
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
GetTempPathW
CreateMutexW
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
GetCurrentProcessId
SystemTimeToFileTime
FreeLibrary
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
lstrcpyW
SetFilePointer
SetEndOfFile
WaitForMultipleObjects
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
CreateEventW
CloseHandle
WaitForSingleObject
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSection
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
GetProcessHeap
HeapFree
HeapAlloc
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
WritePrivateProfileStringW
GetPrivateProfileStringW
LockResource
GetPrivateProfileIntW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
SizeofResource
LoadResource
IsDebuggerPresent

user32

GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongW
PtInRect
EqualRect
MapWindowPoints
ScreenToClient
MessageBoxW
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
GetScrollPos
RedrawWindow
ValidateRect
EndPaint
BeginPaint
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetKeyState
SetFocus
GetDlgCtrlID
GetDlgItem
ShowWindow
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPos
DestroyWindow
IsChild
IsMenu
GrayStringW
TabbedTextOutW
GetWindowDC
ClientToScreen
SendMessageW
BringWindowToTop
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
RegisterWindowMessageW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
GetFocus
SetRectEmpty
SendDlgItemMessageA
SetWindowTextW
IsDialogMessageW
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
GetActiveWindow
GetDesktopWindow
MoveWindow
MsgWaitForMultipleObjects
PeekMessageW
DispatchMessageW
SetDlgItemTextW
IsDlgButtonChecked
IsWindowVisible
IsWindowEnabled
EnableWindow
SetParent
ReleaseDC
InvalidateRect
GetClientRect
GetWindowRect
CopyRect
GetParent
PostMessageW
OffsetRect
LoadBitmapW
GetMessagePos
SetTimer
KillTimer
LoadMenuW
EnableMenuItem
GetSubMenu
GetWindowLongW
SetWindowLongW
GetMenuItemID
GetMenuItemCount
GetDC
GetSysColor
DrawTextW
FillRect
IsWindow
GetSystemMetrics
GetScrollBarInfo
wsprintfW
IsIconic
DrawIcon
SetForegroundWindow
LoadIconW
IntersectRect
GetWindowThreadProcessId
DestroyMenu
UnregisterClassW
TranslateMessage
GetMessageW
GetCursorPos
CharUpperW
PostQuitMessage
SetCursor
SetWindowContextHelpId
MapDialogRect
GetSysColorBrush
LoadCursorW
RealChildWindowFromPoint
PostThreadMessageW
RegisterClipboardFormatW
MessageBeep
GetNextDlgGroupItem
IsRectEmpty
SetRect
InvalidateRgn
CopyAcceleratorTableW
CharNextW
ReleaseCapture
SetCapture
DrawTextExW

gdi32

SetTextColor
CreateRectRgnIndirect
Escape
GetClipBox
GetViewportExtEx
GetWindowExtEx
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
ExtSelectClipRgn
SetBkMode
SetMapMode
SetBkColor
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
CreateBitmap
GetDeviceCaps
GetObjectW
SetDIBColorTable
GetDIBColorTable
CreateDIBSection
DeleteDC
CreatePen
GetTextMetricsW
StretchBlt
DeleteObject
CreateFontW
CreateCompatibleDC
BitBlt
GetStockObject
GetTextExtentPoint32W
SelectObject
CreateSolidBrush

msimg32

TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegCloseKey
RegSetValueExW
RegQueryValueExW

shell32

ShellExecuteW
Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathFindFileNameW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
UrlUnescapeW
PathIsDirectoryW
PathFileExistsW

ole32

CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CLSIDFromProgID
CoInitialize
CoCreateGuid
CoFreeUnusedLibraries
CLSIDFromString
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
OleFlushClipboard
CoRevokeClassObject
OleIsCurrentClipboard
CoRegisterMessageFilter
CoUninitialize
CoGetClassObject

oleaut32

VariantCopy
SafeArrayDestroy
VariantInit
SysAllocStringLen
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocString
VarUdateFromDate
VarDateFromStr
VariantChangeType
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect

oledlg

OleUIBusyW

gdiplus

GdiplusShutdown
GdipAlloc
GdipFree
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdiplusStartup
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipCreateBitmapFromStream

ws2_32

WSAStartup
WSASetLastError
bind
closesocket
WSAWaitForMultipleEvents
getsockopt
WSASocketW
WSASend
WSARecv
WSAIoctl
WSAGetOverlappedResult
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
WSACleanup
setsockopt
ntohs
listen

iphlpapi

GetAdaptersAddresses

oleacc

LresultFromObject
CreateStdAccessibleObject

wininet

HttpQueryInfoW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetSetOptionW
InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetConnectW
InternetCloseHandle
InternetOpenW
InternetCanonicalizeUrlW
InternetCrackUrlW

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 250KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ebb35909367952232ee0a79f923cdf96

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

ws2_32

iphlpapi

oleacc

wininet

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 250KB - Virtual size: 249KB

.data Size: 24KB - Virtual size: 42KB

.rsrc Size: 168KB - Virtual size: 167KB

.reloc Size: 67KB - Virtual size: 67KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 250KB - Virtual size: 249KB

.data
Size: 24KB - Virtual size: 42KB

.rsrc
Size: 168KB - Virtual size: 167KB

.reloc
Size: 67KB - Virtual size: 67KB