G:\Work\2345Soft\2345input\bin\Win32\Release\pdb\2345PinyinWizard.pdb
Static task
static1
Behavioral task
behavioral1
Sample
819efbe99ab5f392a42cf6c4b0978419aec8feea65461024f781ecdc3dbe0c5d.exe
Resource
win7-20240221-en
General
-
Target
819efbe99ab5f392a42cf6c4b0978419aec8feea65461024f781ecdc3dbe0c5d
-
Size
3.8MB
-
MD5
104d1cd418caa78f2bfc24fd68e41c78
-
SHA1
ed174867aea21c26754f74d31847a4dd9ec85e9e
-
SHA256
819efbe99ab5f392a42cf6c4b0978419aec8feea65461024f781ecdc3dbe0c5d
-
SHA512
60da8c9369f0de3c8a5b6aaa98fe92f700ca8d9213d1e2c37ce701ad2c5f3e7aee0ad5eff0833b8078e62ce9fc36fb23772b18169d2812a3545c4330bca2d19c
-
SSDEEP
98304:I94IrL/dxF7LQ5dCI2Zj19xiMtBRlQVqv:y4s/dxF7LQ5Q/tx9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 819efbe99ab5f392a42cf6c4b0978419aec8feea65461024f781ecdc3dbe0c5d
Files
-
819efbe99ab5f392a42cf6c4b0978419aec8feea65461024f781ecdc3dbe0c5d.exe windows:5 windows x86 arch:x86
43c182f7ce802936453e84731739261a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msimg32
AlphaBlend
kernel32
LockFile
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
GetEnvironmentVariableA
FindClose
WaitForSingleObject
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
GetProcessHeap
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
FlushFileBuffers
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenW
LockResource
GlobalAlloc
GlobalFree
SetFileAttributesW
CopyFileW
MulDiv
lstrcpyW
CreateProcessW
LCMapStringW
WaitForMultipleObjects
CreateEventW
SetEvent
ResetEvent
GlobalMemoryStatusEx
OpenProcess
GetStartupInfoW
SetFileTime
OpenFileMappingW
OpenMutexW
VirtualQuery
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCurrentProcess
DeviceIoControl
ExpandEnvironmentStringsW
GetFullPathNameW
GetTempFileNameW
FindNextFileW
DuplicateHandle
GetFileType
CreateDirectoryW
GetCurrentDirectoryW
DosDateTimeToFileTime
ExitProcess
ReleaseMutex
GetDriveTypeW
lstrcatW
GetFileTime
GetACP
QueryDosDeviceW
GetLongPathNameW
ResumeThread
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetWindowsDirectoryW
GetFileSizeEx
HeapFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetCPInfo
GetLocaleInfoW
CompareStringW
EncodePointer
TlsFree
HeapCreate
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
GetStringTypeW
OpenEventW
OutputDebugStringA
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
FindFirstFileExW
PeekNamedPipe
GetStdHandle
GetTimeZoneInformation
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleCP
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FindFirstFileW
TryEnterCriticalSection
AreFileApisANSI
CreateFileW
SetEnvironmentVariableA
WriteConsoleW
WriteFile
ReadFile
CloseHandle
InterlockedExchange
InterlockedExchangeAdd
Sleep
GetTickCount
GetCurrentProcessId
LoadLibraryExW
lstrcmpiW
InterlockedIncrement
FreeLibrary
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
DecodePointer
FindResourceW
LoadResource
RaiseException
GetLastError
MultiByteToWideChar
GetCurrentThreadId
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
InterlockedDecrement
EnterCriticalSection
SetLastError
SizeofResource
GetLogicalDriveStringsW
InterlockedCompareExchange
TerminateProcess
user32
FindWindowExW
GetWindowThreadProcessId
GetLastActivePopup
AttachThreadInput
SystemParametersInfoW
IsIconic
GetForegroundWindow
SetScrollInfo
ShowScrollBar
FillRect
GetScrollInfo
SetScrollPos
SetFocus
GetDC
ReleaseDC
DrawTextW
SetRect
IsWindow
MonitorFromPoint
SetWindowPos
MonitorFromWindow
EndDialog
SetWindowTextW
OffsetRect
GetMonitorInfoW
ClientToScreen
MapWindowPoints
LoadIconW
GetDlgItem
GetParent
GetWindowLongW
DefWindowProcW
CallWindowProcW
PostMessageW
GetWindowRect
ScreenToClient
GetCursor
RegisterClassExW
SetTimer
LoadCursorW
SetCursor
GetClientRect
KillTimer
GetClassInfoExW
PtInRect
InvalidateRect
GetCursorPos
BeginPaint
EndPaint
CreateWindowExW
SendMessageW
MoveWindow
MessageBoxW
UnregisterClassW
GetActiveWindow
ShowWindow
CharNextW
FindWindowW
SetWindowLongW
DialogBoxParamW
SetForegroundWindow
GetWindow
UpdateWindow
gdi32
DeleteDC
SetViewportOrgEx
DeleteObject
SelectObject
CreateCompatibleBitmap
GetObjectW
CreateDIBSection
CreateCompatibleDC
SetBkColor
SetBkMode
SetTextColor
GetBitmapBits
CreateFontIndirectW
GetTextMetricsW
GetDeviceCaps
GetStockObject
EnumFontFamiliesW
CreateSolidBrush
BitBlt
advapi32
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteKeyW
SystemFunction036
RegCreateKeyExW
RegEnumKeyExW
GetSecurityDescriptorDacl
GetAclInformation
GetAce
EqualSid
SetEntriesInAclW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
LookupAccountNameW
GetFileSecurityW
GetNamedSecurityInfoW
RegCloseKey
SetNamedSecurityInfoW
shell32
SHGetFolderPathW
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
oleaut32
SysAllocString
SysFreeString
VarUI4FromStr
gdiplus
GdipDisposeImage
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipAlloc
GdipCreateFont
GdipCreateSolidFill
GdipGraphicsClear
GdipGetGenericFontFamilySansSerif
GdipFree
GdipDrawString
GdipCreateFromHDC
GdipSetTextRenderingHint
GdipCloneBrush
GdipMeasureString
GdipDeleteGraphics
GdipDeleteFont
GdipDrawImageI
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromStream
GdipCloneImage
GdipDeleteBrush
iphlpapi
GetAdaptersAddresses
Exports
Exports
sqlite3_carray_init
sqlite3_csv_init
sqlite3_fileio_init
sqlite3_series_init
sqlite3_shathree_init
sqlite3_uuid_init
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 681KB - Virtual size: 680KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 119KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 193KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 211KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE