23e10685c755122345149ddaa8baf45d16dca0df130eff3a5742217e33a08df4

Sharing

Copy URL Twitter E-mail

General

Target

23e10685c755122345149ddaa8baf45d16dca0df130eff3a5742217e33a08df4
Size

2.4MB
MD5

4788bd06fed09a53563ed90be03b914a
SHA1

998619b8232ae5c031b6f75f6acd74a2b91a801d
SHA256

23e10685c755122345149ddaa8baf45d16dca0df130eff3a5742217e33a08df4
SHA512

b54ee3fb43726dbe7613613b6291a0ce84ea046516e4805f740b1a2684bfcb1700b5a70aa000ee6a3871fcb2f5c19fec220090c26ac28b69e3c6a503754a4176
SSDEEP

49152:m/pystzGk5NtnEalyF8wkqBrN4TGaP3Z4Q:0Istzj5zTyF8wkqBrPLQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23e10685c755122345149ddaa8baf45d16dca0df130eff3a5742217e33a08df4

Files

23e10685c755122345149ddaa8baf45d16dca0df130eff3a5742217e33a08df4
.exe windows:5 windows x86 arch:x86

11b8d141a8877c7752032fa89e7a8c67

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\liebao_src_pool\release.b115_stable_8003\src_import\build\Release\ManualUpgrade.pdb

Imports

gdiplus

GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetImagePixelFormat
GdipDrawImage
GdipGetFamily
GdipSetSolidFillColor
GdipDrawImageI
GdipDeleteGraphics
GdipCreateFromHDC
GdipGraphicsClear
GdipSetClipRectI
GdipGetImageHeight
GdiplusShutdown
GdipGetImageWidth
GdipDrawImageRectRectI
GdiplusStartup
GdipDrawImagePointRectI
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipCreateStringFormat
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipDrawString
GdipSetTextRenderingHint
GdipMeasureString
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDrawImageRectI
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipRestoreGraphics
GdipTranslateWorldTransform
GdipSaveGraphics
GdipLoadImageFromStream
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipCreateFont

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

ws2_32

shutdown
htonl
gethostbyname
ioctlsocket
inet_addr
WSAStartup
WSACleanup
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
recv
send
bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
getaddrinfo
freeaddrinfo
listen
recvfrom
sendto
gethostname
accept
getservbyname

wldap32

ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord79
ord30
ord200
ord301
ord35

kernel32

OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsProcessorFeaturePresent
LoadLibraryExA
UnhandledExceptionFilter
GetStartupInfoW
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlUnwind
ExitThread
FreeLibraryAndExitThread
GetConsoleCP
GetConsoleMode
SetStdHandle
ExitProcess
ReadConsoleW
GetDriveTypeW
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
WriteConsoleW
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GlobalMemoryStatus
CreateDirectoryW
ReadFile
SizeofResource
HeapFree
WriteFile
InitializeCriticalSectionAndSpinCount
SetEndOfFile
CreateFileW
GetFileAttributesW
HeapSize
MultiByteToWideChar
GetLastError
LockResource
HeapReAlloc
CloseHandle
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
lstrlenW
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
SetLastError
GetCurrentProcess
GetVersionExW
LocalFree
GetModuleHandleW
FlushInstructionCache
FindFirstFileW
FindNextFileW
RemoveDirectoryW
GetModuleFileNameW
FindClose
DeleteFileW
CopyFileW
GetPrivateProfileStringW
GetLocalTime
SystemTimeToFileTime
EnterCriticalSection
InterlockedDecrement
LeaveCriticalSection
GetCurrentThreadId
GlobalAlloc
GlobalLock
InterlockedIncrement
GlobalUnlock
lstrcmpW
MulDiv
CreateEventW
SetEvent
ResetEvent
Sleep
CreateMutexW
lstrcmpiW
LoadLibraryExW
GetPrivateProfileIntW
SetErrorMode
WaitForSingleObject
GetPrivateProfileSectionNamesW
WaitForMultipleObjects
CreateProcessW
GetTickCount
GetFullPathNameW
GetLongPathNameW
SetFileAttributesW
GetNativeSystemInfo
OutputDebugStringA
GetCurrentDirectoryW
GetCurrentProcessId
FormatMessageA
GetVolumeInformationW
UnmapViewOfFile
MoveFileExW
ReplaceFileW
GetTempFileNameW
MapViewOfFile
MoveFileW
SetThreadPriority
DuplicateHandle
GetCurrentThread
GetThreadPriority
CreateThread
IsDebuggerPresent
GetModuleHandleA
GetCommandLineW
TerminateProcess
OpenProcess
SetFilePointerEx
FlushFileBuffers
SetHandleInformation
GetStdHandle
AssignProcessToJobObject
ResumeThread
FindFirstFileExW
FileTimeToSystemTime
QueryPerformanceFrequency
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetUserDefaultLangID
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetModuleHandleExW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
VirtualFree
VirtualAlloc
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
GetDiskFreeSpaceExW
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
InitializeCriticalSection
DeleteFileA
ReleaseMutex
CreateMutexA
GetModuleFileNameA
CreateFileMappingA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetTempPathA
GetComputerNameA
SleepEx
GetFileType
PeekNamedPipe
ExpandEnvironmentStringsA
VerSetConditionMask
LoadLibraryA
GetSystemDirectoryA
VerifyVersionInfoA
FlushConsoleInputBuffer
GetSystemTime

user32

GetMessageW
ExitWindowsEx
PostQuitMessage
KillTimer
GetQueueStatus
CallMsgFilterW
MsgWaitForMultipleObjectsEx
SetTimer
PostMessageW
MapWindowPoints
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
LoadImageW
GetSystemMetrics
GetWindowDC
IsIconic
GetWindowPlacement
OffsetRect
UpdateLayeredWindow
GetCursorPos
CreateDialogParamW
DispatchMessageW
MessageBoxW
SetCursor
EnableWindow
BringWindowToTop
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
PeekMessageW
TranslateMessage
UnregisterClassW
ShowWindow
GetWindowLongW
GetWindowTextLengthW
DefWindowProcW
CallWindowProcW
GetWindow
GetFocus
DestroyWindow
GetWindowTextW
EndPaint
BeginPaint
ReleaseDC
InvalidateRect
wsprintfW
ReleaseCapture
GetDC
RegisterWindowMessageW
GetParent
GetClassInfoExW
GetDesktopWindow
GetDlgItem
SetWindowPos
SetActiveWindow
FillRect
CreateWindowExW
ScreenToClient
SendMessageW
SetWindowTextW
RegisterClassExW
IsWindow
InvalidateRgn
RedrawWindow
ClientToScreen
DestroyAcceleratorTable
IsChild
GetSysColor
MoveWindow
CreateAcceleratorTableW
SetFocus
CharNextW
LoadCursorW
GetClassNameW
SetCapture
SetWindowLongW
GetClientRect

gdi32

GetObjectA
CreateDIBSection
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject
CreateSolidBrush

advapi32

RegCreateKeyExW
RegQueryValueExW
ReportEventA
RegisterEventSourceA
DeregisterEventSource
CreateProcessAsUserW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyExW
OpenProcessToken
RegSetValueExW
RegEnumKeyExW
LookupPrivilegeValueW
RegDeleteKeyW
RegCloseKey
AdjustTokenPrivileges

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

ole32

CoCreateGuid
CoInitializeEx
CoGetMalloc
CoTaskMemRealloc
CoUninitialize
CoInitialize
OleLockRunning
CLSIDFromString
OleInitialize
CreateStreamOnHGlobal
CoTaskMemFree
CLSIDFromProgID
StringFromGUID2
OleUninitialize
CoGetClassObject
CoCreateInstance
CoTaskMemAlloc

oleaut32

VarUI4FromStr
VariantInit
LoadTypeLi
OleCreateFontIndirect
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysStringLen
SysAllocStringLen
VariantClear
SysFreeString
LoadRegTypeLi

shlwapi

ord12
PathFindFileNameA
PathRemoveFileSpecA
SHGetValueA
SHSetValueA
PathRemoveFileSpecW
SHSetValueW
PathAppendW
PathFileExistsW
SHGetValueW
PathRemoveBackslashW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

comctl32

InitCommonControlsEx
_TrackMouseEvent

iphlpapi

GetAdaptersInfo

winhttp

WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpReadData
WinHttpQueryHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpOpenRequest

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeW

Exports

Exports

GetHandleVerifier

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 593KB - Virtual size: 592KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

11b8d141a8877c7752032fa89e7a8c67

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

winmm

ws2_32

wldap32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

userenv

comctl32

iphlpapi

winhttp

version

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 593KB - Virtual size: 592KB

.data Size: 48KB - Virtual size: 68KB

.gfids Size: 1KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 196KB - Virtual size: 196KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 593KB - Virtual size: 592KB

.data
Size: 48KB - Virtual size: 68KB

.gfids
Size: 1KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 196KB - Virtual size: 196KB