7198afd4549acbdbf408a6cfd5060908a17dc2bb52a9991f38097c7cb6ba2847

Sharing

Copy URL

Twitter E-mail

General

Target

7198afd4549acbdbf408a6cfd5060908a17dc2bb52a9991f38097c7cb6ba2847
Size

10.0MB
MD5

072a5c881a0fb7e162f7f074b32dd5f7
SHA1

b79dc5a54a4513663e99b3a214e0747cd1e7225c
SHA256

7198afd4549acbdbf408a6cfd5060908a17dc2bb52a9991f38097c7cb6ba2847
SHA512

1ad179ae50dacfd97c853e0454df8704b71e9416360569c2f890d27335d497f718416e43eb4f9376a91980c8317aa605670d3924a1bb2f162626206f555bcb8a
SSDEEP

196608:ymoxJYkZFK26w71pGgrZNiJDwFugsyj+9AhSj2T43jD+CJo2+hnD:lox6kP6iZrTiJsugsy+ChSj2M3jD+q6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7198afd4549acbdbf408a6cfd5060908a17dc2bb52a9991f38097c7cb6ba2847

Files

7198afd4549acbdbf408a6cfd5060908a17dc2bb52a9991f38097c7cb6ba2847
.exe windows:5 windows x86 arch:x86

8639933561718b69dd7f05c606f4d347

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Jenkins\workspace\FE12.1_CPage_git\foxitpersonalsetup\Release\FoxitInst.pdb

Imports

kernel32

RtlCaptureStackBackTrace
LocalFree
IsBadReadPtr
GetModuleHandleA
LoadLibraryA
GetVersionExA
GetModuleHandleW
GetVersionExW
GetTickCount
MulDiv
GetFullPathNameW
SetLastError
LockResource
HeapFree
HeapAlloc
HeapDestroy
HeapCreate
FlushInstructionCache
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalLock
SetEndOfFile
HeapSize
WriteConsoleW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
GetProcessHeap
SetConsoleCtrlHandler
GetTimeZoneInformation
SetStdHandle
ReadConsoleW
MoveFileExW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
WTSGetActiveConsoleSessionId
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
GetACP
ExitProcess
HeapReAlloc
GetModuleHandleExW
ResumeThread
ExitThread
ReadFile
GetFileAttributesExW
RtlUnwind
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
SetProcessAffinityMask
VirtualFree
VirtualProtect
VirtualAlloc
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
ResetEvent
SetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
CreateDirectoryA
GetModuleHandleExA
GetModuleFileNameA
CreateSemaphoreW
ProcessIdToSessionId
GetSystemDirectoryW
CreateMutexW
GetTempPathW
GetCurrentThreadId
GetFileAttributesW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleFileNameW
MultiByteToWideChar
FindNextFileW
FindFirstFileW
DeleteFileW
SetFileAttributesW
CreateFileW
RemoveDirectoryW
CreateDirectoryW
GetDiskFreeSpaceExW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetDriveTypeW
WritePrivateProfileStringW
GetPrivateProfileStringW
FindResourceW
OutputDebugStringW
CreateProcessW
GetLogicalDriveStringsW
lstrcpyW
FormatMessageW
GetLocalTime
CloseHandle
FindClose
WriteFile
SizeofResource
LoadResource
WaitForSingleObject
GetLastError
GetExitCodeProcess
TerminateProcess
GetCurrentProcess
OpenProcess
GlobalFree
GlobalAlloc
FreeResource
LoadLibraryW
Sleep
GetProcAddress
GetStdHandle
ReleaseSemaphore
GetCurrentProcessId
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
QueryPerformanceFrequency
lstrlenA
QueryPerformanceCounter
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
GetStringTypeW
TryEnterCriticalSection
GetNativeSystemInfo
GetExitCodeThread
GetCurrentThread
WaitForSingleObjectEx
DuplicateHandle
RaiseException
DecodePointer
EncodePointer
FreeLibrary
WideCharToMultiByte
OutputDebugStringA
InterlockedDecrement
GetUserDefaultLCID
InterlockedIncrement

user32

CreateIconFromResource
SendMessageW
SetWindowPos
GetDC
ReleaseDC
GetWindowRect
MonitorFromRect
FindWindowW
GetWindowThreadProcessId
PostMessageW
AttachThreadInput
DestroyWindow
ShowWindow
GetForegroundWindow
SetForegroundWindow
MessageBoxW
MessageBeep
GetActiveWindow
GetDesktopWindow
EnumDisplaySettingsW
MonitorFromWindow
GetMonitorInfoW
CopyRect
InflateRect
IntersectRect
OffsetRect
IsRectEmpty
PtInRect
IsWindow
LoadCursorW
DestroyCursor
SetTimer
KillTimer
DrawIconEx
InvertRect
FillRect
SetCursor
SetRect
UnionRect
EqualRect
SetFocus
GetFocus
GetKeyState
GetWindowLongW
DefWindowProcW
CallWindowProcW
UnregisterClassW
RegisterClassExW
CreateWindowExW
GetDlgItem
GetClientRect
MapWindowPoints
SetWindowLongW
GetParent
GetWindow
TrackMouseEvent
PostQuitMessage
AnimateWindow
SetLayeredWindowAttributes
IsIconic
wsprintfW
MsgWaitForMultipleObjects
SetMenuContextHelpId
GetMenuItemInfoW
SetMenuInfo
GetMenuInfo
TrackPopupMenu
DeleteMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
CheckMenuItem
DestroyMenu
IsZoomed
IsMenu
UpdateLayeredWindow
MapVirtualKeyA
CharLowerBuffW
SystemParametersInfoA
DrawTextW
IsWindowVisible
GetWindowPlacement
GetSystemMetrics
GetSysColor
EnableMenuItem
ClientToScreen
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadIconW
LoadImageW
CreatePopupMenu
LoadBitmapW
GetIconInfo
CharNextW
SetActiveWindow
IsWindowEnabled
EnableWindow
DestroyIcon
GetClassNameW
ScreenToClient
SetCaretPos
HideCaret
GetCaretBlinkTime
CreateCaret
GetCursorPos
SetWindowTextW
InvalidateRect
EndPaint
BeginPaint
UpdateWindow
ReleaseCapture
SetCapture
GetCapture

gdi32

CreateDIBSection
SetWorldTransform
GetWorldTransform
SetGraphicsMode
ExtCreatePen
Polyline
SetViewportOrgEx
CreateCompatibleBitmap
StretchBlt
GetDCOrgEx
GetObjectW
SetBkMode
Rectangle
GetStockObject
GetClipBox
CreateSolidBrush
CreateFontIndirectW
SetTextColor
SelectObject
DeleteDC
CreateCompatibleDC
CreateBitmap
EnumFontsW
CreateRoundRectRgn
DeleteObject
BitBlt
GetDeviceCaps
GetCurrentObject
Arc
CombineRgn
CreateEllipticRgnIndirect
CreatePen
CreatePatternBrush
CreateRectRgn
CreateRectRgnIndirect
Ellipse
ExcludeClipRect
GetClipRgn
GetRgnBox
GetTextColor
GetTextExtentPoint32W
IntersectClipRect
OffsetRgn
Pie
PtInRegion
RectInRegion
RestoreDC
RoundRect
SaveDC
ExtSelectClipRgn
SetRectRgn
SetROP2
GetViewportOrgEx

advapi32

RegGetValueW
RegCloseKey
RegDeleteKeyExW
RegOpenKeyW
RegOpenKeyExA
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW
RegEnumValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
GetUserNameW
DuplicateTokenEx
CreateProcessAsUserW
GetLengthSid
AllocateAndInitializeSid
SetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegQueryValueExA

shell32

SHGetSpecialFolderLocation
SHFileOperationW
ShellExecuteW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteExW
ord165
SHChangeNotify
SHGetSpecialFolderPathW
SHBrowseForFolderW

ole32

CLSIDFromProgID
CreateBindCtx
CoInitialize
OleLockRunning
CreateStreamOnHGlobal
OleUninitialize
OleInitialize
CoCreateGuid
CoCreateInstance
CoUninitialize
CLSIDFromString

oleaut32

GetErrorInfo
SetErrorInfo
VariantInit
CreateErrorInfo
VariantClear
VariantChangeType
SysAllocString
SysFreeString

shlwapi

StrToIntExW
PathIsRootW
PathIsDirectoryA
UrlUnescapeW
PathRemoveFileSpecW
PathFileExistsW
PathIsDirectoryW
PathRemoveBackslashW

wininet

InternetReadFile
HttpQueryInfoW
InternetSetOptionW
HttpOpenRequestW
InternetCrackUrlW
InternetCanonicalizeUrlW
InternetOpenW
InternetCloseHandle
InternetConnectW
HttpSendRequestW

psapi

GetProcessMemoryInfo

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

netapi32

NetApiBufferFree
NetUserGetInfo

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

msi

ord88
ord137
ord141
ord292
ord205

gdiplus

GdipGetImageWidth
GdipGetImageHeight
GdipGetImageGraphicsContext
GdipDisposeImage
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromStream
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipSaveImageToFile
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCloneImage

imm32

ImmReleaseContext
ImmAssociateContext
ImmGetContext

msimg32

GradientFill
AlphaBlend

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 412KB - Virtual size: 412KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 184.6MB - Virtual size: 184.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8639933561718b69dd7f05c606f4d347

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

psapi

version

iphlpapi

netapi32

wtsapi32

userenv

msi

gdiplus

imm32

msimg32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 412KB - Virtual size: 412KB

.data Size: 38KB - Virtual size: 110KB

.rsrc Size: 184.6MB - Virtual size: 184.6MB

.reloc Size: 106KB - Virtual size: 105KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 412KB - Virtual size: 412KB

.data
Size: 38KB - Virtual size: 110KB

.rsrc
Size: 184.6MB - Virtual size: 184.6MB

.reloc
Size: 106KB - Virtual size: 105KB