b1d0780d8d9010288bb2449efcb1b4399347c553a0b24c6dfff6d68328ef0844

General

Target
b1d0780d8d9010288bb2449efcb1b4399347c553a0b24c6dfff6d68328ef0844
Size 532KB
Sample240417-n1ppjsfd41
SHA256 b1d0780d8d9010288bb2449efcb1b4399347c553a0b24c6dfff6d68328ef0844
MD5 713253d8d93c15e72240120280c7c66f
SHA1 39a19698b378784978c4ea7ef286f18081d4a469
SHA512 01638251af93858d863668effb9d6927bf9ae8ba1c4dd620ce5645fdb91c4fb393cd3209471101f8c7af0eeee155f6a9518797860c2c4a0b5ddf568cfed0cd1f
SSDEEP 6144:El27E9UpTw/pZTCsrYdZW+Y7PSNC3zpA9h4Pn2FdFKF5DUlMAAOzliqlgAxVuznn:EkCagvz7GazpAfcn2UF5DUTdeAzuRp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1d0780d8d9010288bb2449efcb1b4399347c553a0b24c6dfff6d68328ef0844

File Explorer

b1d0780d8d9010288bb2449efcb1b4399347c553a0b24c6dfff6d68328ef0844

.dll 532KB

b1d0780d8d9010288bb2449efcb1b4399347c553a0b24c6dfff6d68328ef0844

IMPHASH 8572d96e7a248b58954e29900890feb9
SHA256 b1d0780d8d9010288bb2449efcb1b4399347c553a0b24c6dfff6d68328ef0844
MD5 713253d8d93c15e72240120280c7c66f
SHA1 39a19698b378784978c4ea7ef286f18081d4a469
SHA512 01638251af93858d863668effb9d6927bf9ae8ba1c4dd620ce5645fdb91c4fb393cd3209471101f8c7af0eeee155f6a9518797860c2c4a0b5ddf568cfed0cd1f
SSDEEP 6144:El27E9UpTw/pZTCsrYdZW+Y7PSNC3zpA9h4Pn2FdFKF5DUlMAAOzliqlgAxVuznn:EkCagvz7GazpAfcn2UF5DUTdeAzuRp
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

512000

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\CodeTecsun\SVN\小终端\甘肃\全省\通用_通用_跨省异地就医接口库\trunk\code\项目开发\SSCardExt_V1.0.0.9\Release\SSCardDriver_TS.pdb

kernel32

SetEndOfFile HeapSize ReadConsoleW WriteConsoleW CreateFileW SetStdHandle GetCommandLineW GetCommandLineA MultiByteToWideChar GetLastError LoadLibraryA GetProcAddress FreeLibrary GetPrivateProfileStringA WideCharToMultiByte SetConsoleCtrlHandler EnterCriticalSection WaitForMultipleObjects LeaveCriticalSection InitializeCriticalSection GetCurrentThreadId GetModuleHandleA Sleep SetEvent TerminateThread CreateThread DeleteCriticalSection CreateEventA GetModuleFileNameA GetPrivateProfileIntA SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage SetFilePointerEx ReadFile GetProcessHeap CreateDirectoryW GetConsoleMode GetConsoleCP WriteFile FlushFileBuffers GetACP EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo CloseHandle ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwind RaiseException LoadLibraryExW GetModuleFileNameW InterlockedFlushSList ExitProcess GetModuleHandleExW ExitThread ResumeThread FreeLibraryAndExitThread GetTimeZoneInformation HeapAlloc HeapReAlloc HeapFree GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType

user32

GetMessageA DispatchMessageA CallNextHookEx PostThreadMessageA SetWindowsHookExA UnhookWindowsHookEx TranslateMessage SendInput EndDialog MessageBoxA FindWindowA

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetClassDevsA

advapi32

SystemFunction036

Name

.text

Size

321KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rmnet

Size

56KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

b1d0780d8d9010288bb2449efcb1b4399347c553a0b24c6dfff6d68328ef0844

kernel32

user32

setupapi

advapi32

generic