G:\Work\new\2345Pinyin\bin\Win32\Release\pdb\2345PinyinSkinUtil.pdb
Static task
static1
Behavioral task
behavioral1
Sample
04551a12ef2d29515814444b6d057de72721c49f48e0e88d70f767b24bf7d936.exe
Resource
win7-20240221-en
General
-
Target
04551a12ef2d29515814444b6d057de72721c49f48e0e88d70f767b24bf7d936
-
Size
2.5MB
-
MD5
473833a9286ac387960cfdde20d996c3
-
SHA1
10a05942c05f6650c8c9ea0a39d0bbc445be92be
-
SHA256
04551a12ef2d29515814444b6d057de72721c49f48e0e88d70f767b24bf7d936
-
SHA512
1d6a387b2ded513f6aec4d7357ce09cabc3e773cec8cbe931b3e8a900a46d2c12a5f52b7e5860614abbbe9a9d4666e04c8d1947880223c52c257ec41b961cb41
-
SSDEEP
49152:JreCWbYLlfeh+30Xl2f80HA5dxF7LlYMCSRkki7fscIUm0TkylXiljkLeS:5FCYIk25dxF7LzCQi7fscIUmG08eS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04551a12ef2d29515814444b6d057de72721c49f48e0e88d70f767b24bf7d936
Files
-
04551a12ef2d29515814444b6d057de72721c49f48e0e88d70f767b24bf7d936.exe windows:5 windows x86 arch:x86
fcf1b636d5619a11f9bf3e8f8f7ae715
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
SHDeleteKeyW
imm32
ImmDisableIME
kernel32
FindFirstFileW
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
SetFileTime
LockFile
LeaveCriticalSection
InitializeCriticalSection
GetFullPathNameA
UnlockFileEx
GetTempPathW
CreateMutexW
GetEnvironmentVariableA
FindClose
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
DeleteFileW
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
DeleteCriticalSection
GetProcessHeap
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
FlushFileBuffers
GetDriveTypeW
AreFileApisANSI
OpenEventW
ReleaseMutex
LockResource
LoadResource
FindResourceW
lstrcmpiW
CreateProcessW
GetACP
GetFileTime
FileTimeToSystemTime
FileTimeToDosDateTime
FindNextFileW
CreateDirectoryW
lstrlenW
SetFileAttributesW
GetCurrentDirectoryW
CopyFileW
SetLastError
FreeLibrary
RaiseException
DecodePointer
GetEnvironmentVariableW
LoadLibraryExW
GetFileSizeEx
DeviceIoControl
GetProcAddress
LoadLibraryW
GetCurrentProcess
GetModuleHandleW
VirtualQuery
GetCommandLineW
OpenMutexW
ReadFile
TryEnterCriticalSection
GetModuleFileNameW
WaitForSingleObject
WriteFile
GetStringTypeW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
CompareStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
GetFileType
PeekNamedPipe
GetStdHandle
ExitProcess
GetTimeZoneInformation
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleCP
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
GetFileInformationByHandle
OpenProcess
CloseHandle
GetCurrentProcessId
GetCurrentThreadId
GetLastError
OpenFileMappingW
CreateFileW
GetTickCount
ResetEvent
InterlockedExchangeAdd
LCMapStringW
GetLocalTime
WideCharToMultiByte
MultiByteToWideChar
GetPrivateProfileStringW
WritePrivateProfileStringW
GetFileSize
SetEndOfFile
SetFilePointer
SetEvent
Sleep
CreateEventW
InitializeCriticalSectionAndSpinCount
user32
MessageBoxW
advapi32
RegEnumKeyExW
GetSecurityDescriptorDacl
GetAclInformation
GetAce
EqualSid
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetFileSecurityW
LookupAccountNameW
SystemFunction036
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyW
RegSetValueW
shell32
SHGetFolderPathW
SHChangeNotify
CommandLineToArgvW
iphlpapi
GetAdaptersAddresses
Exports
Exports
sqlite3_carray_init
sqlite3_csv_init
sqlite3_fileio_init
sqlite3_series_init
sqlite3_shathree_init
sqlite3_uuid_init
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 547KB - Virtual size: 547KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 110KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 85KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE