084f88957cd3080270dc46cc18f89b45b31b1d813a0a83317c7f70256e529fff

Sharing

Copy URL Twitter E-mail

General

Target

084f88957cd3080270dc46cc18f89b45b31b1d813a0a83317c7f70256e529fff
Size

3.7MB
MD5

b0b19314ce33a45a81991de18b1dda67
SHA1

3827b1c24b2befcaa627d9e0331adabb0a0795d8
SHA256

084f88957cd3080270dc46cc18f89b45b31b1d813a0a83317c7f70256e529fff
SHA512

0acce99bb711df11f6079a56a226d8e20b75b816b8c48b666fb421e9fb1734c31ab1519efee2b71559b4ad8576f3b6cbec28ee04cdd287df9bbc3db58f9c50d1
SSDEEP

98304:vNM0CjCCl8gEadD/FNmtxxzYPYb3ouR7Nrkbu:vNvCKG4txitbu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
084f88957cd3080270dc46cc18f89b45b31b1d813a0a83317c7f70256e529fff

Files

084f88957cd3080270dc46cc18f89b45b31b1d813a0a83317c7f70256e529fff
.exe windows:6 windows x86 arch:x86

24237138a01da7cdbe399fd7754e09e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\zuhao\ggzuhao_Unicode\Output\Release\Uninstall.pdb

Imports

kernel32

RaiseException
InitializeCriticalSectionEx
DecodePointer
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
CreateThread
GetPrivateProfileStringA
GetModuleFileNameW
GetEnvironmentVariableW
CopyFileW
lstrcpyW
lstrcatW
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
ExitProcess
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetModuleHandleW
Wow64EnableWow64FsRedirection
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
CreateProcessA
CreateDirectoryA
FindResourceA
QueryPerformanceCounter
FreeLibrary
SystemTimeToFileTime
FlushFileBuffers
GetCurrentProcessId
DeleteCriticalSection
GetFileSize
LockFileEx
LocalFree
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
HeapSize
HeapValidate
UnmapViewOfFile
GetCurrentThreadId
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
MapViewOfFile
GetTickCount
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
GetProcessHeap
GetFullPathNameA
SetFilePointer
InitializeCriticalSection
EncodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetCurrentDirectoryW
GetACP
MulDiv
GetLocalTime
FreeResource
CreateDirectoryW
GetFileType
SetFileTime
DuplicateHandle
DosDateTimeToFileTime
GlobalAlloc
GlobalUnlock
GlobalLock
RtlUnwind
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetFileSizeEx
SetFilePointerEx
GetConsoleCP
GetConsoleMode
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
LeaveCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
EnterCriticalSection
HeapFree
HeapCreate
TryEnterCriticalSection
ReadFile
AreFileApisANSI
WideCharToMultiByte
MultiByteToWideChar
GetPrivateProfileIntW
GetPrivateProfileStringW

user32

UnionRect
IsRectEmpty
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
SetCursor
LoadCursorW
wvsprintfW
OffsetRect
DefWindowProcW
EnableWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetCaretBlinkTime
GetCaretPos
CreateCaret
HideCaret
ShowCaret
SetCaretPos
ClientToScreen
GetSysColor
IsZoomed
SetWindowRgn
MessageBoxW
MonitorFromWindow
GetMonitorInfoW
CallWindowProcW
RegisterClassW
GetClientRect
GetClassInfoExW
ScreenToClient
SetPropW
GetPropW
LoadImageW
CharPrevW
DrawTextW
FillRect
SetRect
MoveWindow
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
GetKeyState
GetFocus
GetActiveWindow
SetFocus
CharNextW
IsIconic
IsWindowVisible
DestroyWindow
IsWindow
CreateWindowExW
PostMessageW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
PtInRect
IntersectRect
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
MapWindowPoints
GetCursorPos
GetSystemMetrics
ReleaseDC
GetDC
GetWindowRect
KillTimer
SetTimer
ReleaseCapture
RegisterClassExW
SetCapture
SetWindowPos
SetForegroundWindow
BringWindowToTop
wsprintfW
ShowWindow
PostQuitMessage

advapi32

RegQueryValueExA
RegCreateKeyExA
RegDisableReflectionKey
RegQueryInfoKeyW
RegEnumKeyExA
RegEnableReflectionKey
RegCloseKey
RegOpenKeyExA
RegDeleteTreeW

shell32

CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetSpecialFolderPathA
SHChangeNotify

ole32

CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoUninitialize
CoInitialize

shlwapi

PathFileExistsA
PathFileExistsW

iphlpapi

GetAdaptersInfo

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionFontW
ImmSetCompositionWindow

comctl32

ord17
_TrackMouseEvent

gdi32

CreateRoundRectRgn
GetDeviceCaps
SetTextColor
SetBkMode
CreateSolidBrush
Rectangle
CreatePatternBrush
SetWindowOrgEx
GetObjectW
GetTextMetricsW
SelectObject
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SaveDC
BitBlt
GetStockObject
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
RestoreDC
StretchBlt
SetStretchBltMode
CreateDIBSection
MoveToEx
TextOutW
ExtTextOutW
GdiFlush
GetObjectA

oleaut32

VariantInit
SysFreeString
VariantClear
SysAllocString

gdiplus

GdipImageGetFrameCount
GdipGetImageHeight
GdipGetImageWidth
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushI
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipGraphicsClear
GdipDrawImage
GdipDrawImageRectI
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipGetFamily
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipLoadImageFromStream
GdipLoadImageFromStreamICM

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 111KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

24237138a01da7cdbe399fd7754e09e9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

iphlpapi

imm32

comctl32

gdi32

oleaut32

gdiplus

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 149KB - Virtual size: 148KB

.data Size: 49KB - Virtual size: 60KB

.rsrc Size: 2.3MB - Virtual size: 2.3MB

.reloc Size: 111KB - Virtual size: 112KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 149KB - Virtual size: 148KB

.data
Size: 49KB - Virtual size: 60KB

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

.reloc
Size: 111KB - Virtual size: 112KB