e06bc5e46f32321a4849b6367bcfff4a684914550c77403cc506f83ed0a2cd3a

Sharing

Copy URL Twitter E-mail

General

Target
e06bc5e46f32321a4849b6367bcfff4a684914550c77403cc506f83ed0a2cd3a
Size 1.7MB
Sample240417-yvtresch99
SHA256 e06bc5e46f32321a4849b6367bcfff4a684914550c77403cc506f83ed0a2cd3a
MD5 ccbcc5df5e4660ccaf3ecd74c8fba5c5
SHA1 6286c67bda90a31a7e608100b5358e61d65ff89a
SHA512 da1454e980e2a1a0df5d112f739d64741e3d4706789a4eea1ffff9d008459cce7b63c29ed864e68cec08fa3bed077f5e3aee45317d8a761177c233e510ce4e76
SSDEEP 49152:yaPPPtOHCvpEwv8wTG9QrOGyZgcyAvQYR3Q7XJv:yaPPPM6pEWTGLGGr30XJv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e06bc5e46f32321a4849b6367bcfff4a684914550c77403cc506f83ed0a2cd3a

File Explorer

e06bc5e46f32321a4849b6367bcfff4a684914550c77403cc506f83ed0a2cd3a

.dll 1.7MB

e06bc5e46f32321a4849b6367bcfff4a684914550c77403cc506f83ed0a2cd3a

IMPHASH 3bc8ffc122cb848ee85fba740bb8883d
SHA256 e06bc5e46f32321a4849b6367bcfff4a684914550c77403cc506f83ed0a2cd3a
MD5 ccbcc5df5e4660ccaf3ecd74c8fba5c5
SHA1 6286c67bda90a31a7e608100b5358e61d65ff89a
SHA512 da1454e980e2a1a0df5d112f739d64741e3d4706789a4eea1ffff9d008459cce7b63c29ed864e68cec08fa3bed077f5e3aee45317d8a761177c233e510ce4e76
SSDEEP 49152:yaPPPtOHCvpEwv8wTG9QrOGyZgcyAvQYR3Q7XJv:yaPPPM6pEWTGLGGr30XJv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1699840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\项目\天梦者通用开发包\windows开发包\TMZwindow开发包\tmz\Release\tmz.pdb

kernel32

CompareStringW GetDriveTypeW GetTimeZoneInformation GetCurrentDirectoryW PeekNamedPipe GetFileInformationByHandle GetLastError HeapFree HeapAlloc GetFileAttributesA EncodePointer DecodePointer GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy GetModuleHandleW ExitProcess GetStdHandle GetModuleFileNameW HeapSize RaiseException GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError InitializeCriticalSectionAndSpinCount RtlUnwind MultiByteToWideChar ReadFile GetConsoleMode SetHandleCount GetFileType GetStartupInfoW DeleteCriticalSection SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryW HeapReAlloc LCMapStringW GetStringTypeW SetStdHandle IsProcessorFeaturePresent WriteConsoleW FlushFileBuffers SetEndOfFile GetProcessHeap CreateFileW SetupComm GetCommState WaitForSingleObject SetEvent SetCommState SetCommTimeouts CreateEventA GetOverlappedResult ResetEvent CancelIo PurgeComm GetWindowsDirectoryA GetDriveTypeA CreateDirectoryA GetLogicalDriveStringsA RemoveDirectoryA GetLocalTime GetCurrentDirectoryA GetFullPathNameA FindClose FindNextFileA FindFirstFileExA CloseHandle GetModuleHandleA GetModuleFileNameA LoadLibraryA IsValidCodePage GetProcAddress WideCharToMultiByte WriteFile FreeLibrary MoveFileExA CreateFileA DeleteFileA GetTempPathA EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetConsoleCP Sleep FileTimeToSystemTime FileTimeToLocalFileTime SetEnvironmentVariableA

shlwapi

PathRemoveFileSpecA

hid

HidD_SetFeature HidD_GetPreparsedData HidP_GetCaps HidD_GetFeature HidD_FreePreparsedData HidD_GetAttributes HidD_GetHidGuid

setupapi

SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces

user32

GetDC ReleaseDC LoadImageA

gdi32

CreateFontA GetDIBits SetBkColor CreateBitmap SetBkMode DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap SetDIBits SetTextCharacterExtra GetObjectA TextOutA BitBlt SetTextColor SetViewportOrgEx SelectObject

Name

.text

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rmnet

Size

56KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

e06bc5e46f32321a4849b6367bcfff4a684914550c77403cc506f83ed0a2cd3a

kernel32

shlwapi

hid

setupapi

user32

gdi32

generic