01be9ce097272c150c0bf34b65cd6b21f7214ed2dd4332e81a56f977fb0b3d87

Sharing

Copy URL Twitter E-mail

General

Target

01be9ce097272c150c0bf34b65cd6b21f7214ed2dd4332e81a56f977fb0b3d87
Size

1.8MB
MD5

ef0ff20e4c8c9df919d34b6fc027bcc0
SHA1

fd02fd2d41e3637ccc557097465d95827db279f5
SHA256

01be9ce097272c150c0bf34b65cd6b21f7214ed2dd4332e81a56f977fb0b3d87
SHA512

b1f4f4c0ddeb9ad196255dd4317b82655eae02696fc12a060486860776b23ecf626d6de18b893bf3504252147011680c6ffde43ff4f2088adecdc3ce07b6d585
SSDEEP

24576:ktpEeiGkEXDk6vNbLbJA6mggvJWWmeYT+QkPnklyNUWuKVi7KL8JECXuoIsp5jl:kbkKVLLcvQF/+QkniAEECXuoppxl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01be9ce097272c150c0bf34b65cd6b21f7214ed2dd4332e81a56f977fb0b3d87

Files

01be9ce097272c150c0bf34b65cd6b21f7214ed2dd4332e81a56f977fb0b3d87
.exe windows:6 windows x86 arch:x86

9724d90255150b06ba9531e0c0a996bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\data\landun\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SogouComMgr.pdb

Imports

kernel32

DeleteCriticalSection
Sleep
WaitForSingleObject
InitializeCriticalSectionEx
GetCurrentProcessId
FindFirstFileW
GetLastError
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
DebugBreak
GetTickCount
GetExitCodeProcess
EnterCriticalSection
GlobalFree
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSection
TerminateThread
CreateSemaphoreW
DecodePointer
FindClose
GetTempPathW
DeleteFileW
UnmapViewOfFile
GetTempFileNameW
FindNextFileW
MoveFileW
GlobalHandle
GetEnvironmentVariableW
WriteConsoleW
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
SetStdHandle
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
LCMapStringW
CompareStringW
HeapReAlloc
GetStdHandle
ExitProcess
GetFileType
GetTimeZoneInformation
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
RtlUnwind
RaiseException
GetCPInfo
GetStringTypeW
GetFileAttributesW
OutputDebugStringW
QueryPerformanceFrequency
GlobalLock
QueryPerformanceCounter
GlobalUnlock
GetVersionExW
GetCommandLineW
InitializeCriticalSectionAndSpinCount
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
GetProcAddress
FreeLibrary
ReadFile
SetLastError
GetCurrentProcess
WriteFile
SetFilePointer
CreateFileW
GetCurrentThreadId
DuplicateHandle
ExitThread
CreateEventW
FormatMessageW
CreateThread
LocalFree
GetFileSize
GetSystemDirectoryW
LoadLibraryW
GetModuleHandleW
OpenMutexW
LoadLibraryExW
RemoveDirectoryW
SetFileAttributesW
FileTimeToSystemTime
MoveFileExW
CreateDirectoryW
GetProcessId
CreateProcessW
CopyFileW
GetFileTime
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
OpenEventW
lstrlenW
HeapFree
GetFullPathNameW
lstrlenA
LocalAlloc
HeapAlloc
GetProcessHeap
CreateMutexW
ReleaseMutex
FlushFileBuffers
VirtualFree
VirtualAlloc
SetEvent
TerminateProcess
lstrcatW
GetLocalTime
lstrcpyW
VirtualQuery
IsDebuggerPresent
SetUnhandledExceptionFilter
SetEndOfFile
WaitForSingleObjectEx
GetQueuedCompletionStatus
TransactNamedPipe
CreateIoCompletionPort
SetNamedPipeHandleState
WaitNamedPipeW
ResetEvent
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
EncodePointer
GetModuleFileNameW

user32

GetClientRect
SetWindowLongW
PostMessageW
GetWindowLongW
GetWindowTextW
SetForegroundWindow
RegisterWindowMessageW
FindWindowW
LoadIconW
TranslateMessage
DispatchMessageW
IsWindow
ShowWindow
SendMessageW
MessageBoxW
IsWindowVisible
GetMessageW
DestroyWindow
MoveWindow
GetWindowRect
LoadCursorW
RegisterClassExW
EndPaint
BeginPaint
ReleaseDC
IsIconic
ReleaseCapture
GetParent
KillTimer
AppendMenuW
SetCursor
SetCapture
SetPropW
DestroyMenu
IsWindowEnabled
TrackMouseEvent
SetMenuItemInfoW
ClientToScreen
SetTimer
TrackPopupMenu
GetWindowPlacement
NotifyWinEvent
CreatePopupMenu
GetSystemMetrics
GetPropW
GetDC
InsertMenuItemW
CallWindowProcW
GetKeyState
PtInRect
GetDesktopWindow
DrawTextW
UpdateLayeredWindow
GetFocus
IntersectRect
GetMonitorInfoW
MonitorFromPoint
SubtractRect
SetRectEmpty
CreateWindowExW
CharNextW
LoadStringW
wsprintfW
wvsprintfW
DefWindowProcW
EnableWindow
GetCursorPos
SystemParametersInfoW
PostQuitMessage
ScreenToClient
SetWindowPos

advapi32

CryptAcquireContextW
GetTokenInformation
LookupAccountSidW
OpenProcessToken
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
LookupAccountNameW
AddAccessAllowedAce
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
GetFileSecurityW
AddAce
SetSecurityDescriptorSacl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
CryptDecrypt
CryptSetKeyParam
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
SetFileSecurityW
GetAclInformation
GetAce
EqualSid
BuildExplicitAccessWithNameW
SetEntriesInAclW

ole32

CoInitialize
OleCreate
OleSetContainedObject
CoUninitialize
CoCreateInstance

oleaut32

VariantInit
SysFreeString
VariantClear
SysAllocString

imm32

ImmDisableIME

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetProcessMemoryInfo

msimg32

AlphaBlend

oleacc

LresultFromObject
AccessibleObjectFromWindow

wininet

InternetReadFile
InternetSetOptionW
InternetCloseHandle
HttpQueryInfoW
InternetOpenW
HttpAddRequestHeadersW
InternetConnectA
HttpSendRequestExW
HttpEndRequestW
InternetCrackUrlA
InternetWriteFile
InternetOpenUrlW
HttpOpenRequestA
InternetQueryOptionW

shell32

SHFileOperationW
SHChangeNotify
SHGetFolderPathW
ShellExecuteW
ShellExecuteExW

gdi32

DeleteObject
GetObjectW
CreateDIBSection
SetTextCharacterExtra
SetBkMode
SetTextColor
CreateCompatibleDC
SelectObject
BitBlt
CreateFontIndirectW
GetFontData
DeleteDC

winhttp

WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpWriteData
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpQueryOption
WinHttpSetOption
WinHttpReadData
WinHttpCrackUrl
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 297KB - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 43KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 158KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9724d90255150b06ba9531e0c0a996bc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

imm32

version

psapi

msimg32

oleacc

wininet

shell32

gdi32

winhttp

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 297KB - Virtual size: 297KB

.data Size: 43KB - Virtual size: 101KB

.rsrc Size: 164KB - Virtual size: 164KB

.reloc Size: 158KB - Virtual size: 160KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 297KB - Virtual size: 297KB

.data
Size: 43KB - Virtual size: 101KB

.rsrc
Size: 164KB - Virtual size: 164KB

.reloc
Size: 158KB - Virtual size: 160KB