34f65f538bd51b9d2ed331ba0448f2eee937f4751f529e6c1a2d2a24fef96a3d

Sharing

Copy URL Twitter E-mail

General

Target

34f65f538bd51b9d2ed331ba0448f2eee937f4751f529e6c1a2d2a24fef96a3d
Size

1.9MB
MD5

408042dbe0eda0aef2a91d592aa1341b
SHA1

4aedab4786f1e12d4893c1364d1c81c4e7c6d50a
SHA256

34f65f538bd51b9d2ed331ba0448f2eee937f4751f529e6c1a2d2a24fef96a3d
SHA512

7287c0697c187e56aa884c9fd604811161c48333a88a2ed06b9a76bea74aa93ab2779bfd3192849ab9615e5dfc26f4ac266e2834217be161db9b02b236338291
SSDEEP

49152:ODGFwbbasA8V9G9P3BV77ODOzQmzex9T7Tf2j8QJ/gU:0GiOIDOzQmpgQJx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
34f65f538bd51b9d2ed331ba0448f2eee937f4751f529e6c1a2d2a24fef96a3d

Files

34f65f538bd51b9d2ed331ba0448f2eee937f4751f529e6c1a2d2a24fef96a3d
.exe windows:6 windows x86 arch:x86

c56b04f70b7adedc74050a8138b08562

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\biubiu\AppData\Local\Jenkins\.jenkins\workspace\electronBuildNew\build\uninstall.pdb

Imports

ws2_32

inet_addr
WSACleanup
__WSAFDIsSet
closesocket
select
shutdown
WSASocketW
inet_pton
getaddrinfo
WSAStartup
getpeername
getsockname
send
socket
ntohs
connect
recv
getsockopt
freeaddrinfo
ioctlsocket
getnameinfo
setsockopt
WSAGetLastError

iphlpapi

GetAdaptersInfo
GetIpForwardTable

libssl-1_1

SSL_connect
OPENSSL_init_ssl
SSL_free
SSL_get_error
SSL_shutdown
SSL_CTX_load_verify_locations
SSL_set_verify
SSL_read
SSL_pending
SSL_set_bio
SSL_ctrl
TLS_client_method
SSL_get_verify_result
SSL_write
SSL_CTX_new
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_CTX_set_cert_store
SSL_CTX_free
SSL_new
SSL_get_peer_certificate
SSL_CTX_get_cert_store

libcrypto-1_1

BIO_new_mem_buf
RSA_public_encrypt
RSA_size
OPENSSL_LH_strhash
X509_STORE_free
X509_NAME_get_text_by_NID
EVP_MD_CTX_new
d2i_X509
X509_STORE_add_cert
OPENSSL_sk_num
X509_get_subject_name
EVP_md5
EVP_sha256
EVP_DigestUpdate
GENERAL_NAMES_free
EVP_MD_CTX_free
EVP_DigestInit_ex
OPENSSL_sk_value
ASN1_STRING_get0_data
EVP_sha512
BIO_new_socket
X509_free
ASN1_STRING_length
X509_get_ext_d2i
EVP_DigestFinal_ex
BIO_new
BIO_ctrl
RSA_free
BIO_s_file
PEM_read_bio_RSA_PUBKEY
BIO_free

kernel32

GetCommandLineA
FreeEnvironmentStringsW
TlsFree
GetCommandLineW
GetEnvironmentStringsW
TlsAlloc
TlsSetValue
QueryPerformanceCounter
GetSystemTimeAsFileTime
SystemTimeToFileTime
QueryPerformanceFrequency
LocalFileTimeToFileTime
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
GetSystemDirectoryW
VirtualQuery
FindResourceW
LoadResource
GetStdHandle
SizeofResource
CopyFileW
GetCurrentDirectoryW
GetFileAttributesW
GetOEMCP
CreateEventW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
Sleep
GetLastError
SetEvent
CloseHandle
DeleteCriticalSection
CreateEventA
GetVersionExW
LoadLibraryW
GetProcAddress
FreeLibrary
CreateDirectoryW
ReadFile
GetFileSizeEx
SetLastError
WriteFile
GetModuleFileNameW
SetEndOfFile
CreateFileW
MultiByteToWideChar
FileTimeToSystemTime
FileTimeToLocalFileTime
SetFilePointerEx
WideCharToMultiByte
GetFileTime
ResetEvent
GetPrivateProfileIntW
GetPrivateProfileStringW
FindClose
GetACP
GetCurrentProcess
TerminateProcess
GetModuleHandleA
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetNativeSystemInfo
GetCurrentProcessId
GetModuleHandleW
IsWow64Process
InitializeCriticalSectionEx
RaiseException
DecodePointer
GetTickCount64
GetTickCount
CreateMutexW
OutputDebugStringW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
DeleteFileW
LoadLibraryExW
SetFilePointer
GetFileSize
MoveFileExW
LocalFree
GetFileType
SetEnvironmentVariableW
SetThreadPriority
GetCurrentThreadId
GetProcessHeap
TlsGetValue
WaitForSingleObjectEx
LCMapStringEx
TerminateThread
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
VerifyVersionInfoW
VerSetConditionMask
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GlobalSize
HeapSize
WriteConsoleW
GetEnvironmentVariableW
InitOnceComplete
EncodePointer
CompareStringEx
GetCPInfo
GetLocaleInfoEx
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
FindFirstFileExW
InitializeSListHead
RtlUnwind
CreateThread
ExitThread
InitOnceBeginInitialize
InitializeSRWLock
ReleaseSRWLockExclusive
WritePrivateProfileStringW
FreeLibraryAndExitThread
GetModuleHandleExW
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
ExitProcess
HeapFree
HeapReAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
AcquireSRWLockExclusive
HeapAlloc
FlushFileBuffers
SetStdHandle
GetFileAttributesExW
GetTimeZoneInformation
IsValidCodePage

user32

GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetParent
IsIconic
SetWindowPos
LoadImageW
SendMessageW
CallWindowProcW
SetPropW
GetPropW
GetDC
SetWindowTextW
InvalidateRect
IsWindowVisible
ScreenToClient
GetKeyState
GetCursorPos
DrawTextW
SetCapture
ReleaseCapture
BeginPaint
SetFocus
EndPaint
MoveWindow
GetWindow
GetWindowLongW
IsWindow
SetWindowLongW
GetUpdateRect
GetClientRect
IsRectEmpty
IntersectRect
UpdateLayeredWindow
PtInRect
GetClassInfoExW
RegisterClassW
LoadCursorW
ReleaseDC
DefWindowProcW
PostMessageW
DestroyWindow
CreateWindowExW
WaitMessage
GetDesktopWindow
ShowWindow
EnableWindow
PostQuitMessage
SetForegroundWindow
UnregisterClassW
GetSystemMetrics
OffsetRect
UnionRect
SetCursor
RegisterClassExW
DispatchMessageW
SetTimer
PeekMessageW
MsgWaitForMultipleObjectsEx
CallMsgFilterW
GetQueueStatus
TranslateMessage
GetFocus
KillTimer
CharNextW
ClientToScreen
GetSysColor
GetAsyncKeyState
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
IsZoomed
MonitorFromPoint
GetWindowPlacement
MonitorFromRect
SetWindowRgn
MessageBoxW
InflateRect
FindWindowW
MapWindowPoints

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
GetSecurityInfo
RegDeleteValueW
RegDeleteKeyW

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoCreateGuid
CoTaskMemFree
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

SafeArrayDestroy
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayGetElemsize
SafeArrayGetElement
SysAllocString

shlwapi

PathIsRelativeW
PathFileExistsW

winmm

timeKillEvent
timeSetEvent
timeGetTime

comctl32

ord17
_TrackMouseEvent

gdiplus

GdipSetEffectParameters
GdipDeleteEffect
GdipCreateEffect
GdipSetClipRegion
GdipDeleteRegion
GdipCreateRegionPath
GdipSetPathGradientPresetBlend
GdipSetPathGradientWrapMode
GdipCreatePathGradientFromPath
GdipAddPathLine
GdipAddPathArc
GdipDrawPath
GdipFillEllipseI
GdipDrawEllipseI
GdipDrawString
GdipFillPath
GdipGetFontStyle
GdipGetFontSize
GdipAddPathString
GdipGetFamily
GdipDeleteFontFamily
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipGetFontCollectionFamilyCount
GdipNewInstalledFontCollection
GdipDrawRectangleI
GdipDrawBezierI
GdipDrawLineI
GdipFillRectangle
GdipDeletePath
GdipIsOutlineVisiblePathPointI
GdipIsVisiblePathPointI
GdipGetPathWorldBoundsI
GdipAddPathPolygonI
GdipAddPathPieI
GdipAddPathArcI
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipAddPathCurveI
GdipAddPathBezierI
GdipAddPathLine2I
GdipAddPathLineI
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathFillMode
GdipSetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath
GdipCreateTexture
GdipCreateBitmapFromHBITMAP
GdipGetPenDashStyle
GdipBitmapApplyEffect
GdipGetPenLineJoin
GdipSetPenLineJoin
GdipGetPenDashCap197819
GdipGetPenEndCap
GdipGetPenStartCap
GdipSetPenDashCap197819
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenColor
GdipGetPenWidth
GdipSetPenWidth
GdipClonePen
GdipLoadImageFromFile
GdipImageRotateFlip
GdipDrawImageRect
GdipCreatePen2
GdipSetLineBlend
GdipCreateLineBrushFromRect
GdipDrawArc
GdipDeletePen
GdipCreatePen1
GdipSetSmoothingMode
GdipMeasureString
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipCreateHBITMAPFromBitmap
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipDrawImageRectRect
GdipCreateFromHDC
GdipDrawImage
GdipSetWorldTransform
GdipRotateMatrix
GdipTranslateMatrix
GdipGetWorldTransform
GdipDeleteMatrix
GdipCreateMatrix
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipCloneBrush
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdiplusShutdown
GdiplusStartup
GdipSetPenDashStyle
GdipScaleMatrix
GdipTransformPath

imm32

ImmGetOpenStatus
ImmSetOpenStatus
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

msimg32

AlphaBlend

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenSystemStoreW

uiautomationcore

UiaRaiseAutomationPropertyChangedEvent
UiaClientsAreListening
UiaReturnRawElementProvider
UiaHostProviderFromHwnd
UiaRaiseAutomationEvent

gdi32

AddFontResourceExW
DeleteDC
CreateDIBSection
AddFontMemResourceEx
GetDIBits
GetObjectW
GetStockObject
CreateFontIndirectW
DeleteObject
SelectObject
BitBlt
GetDeviceCaps
CreateRoundRectRgn
StretchBlt
ExtSelectClipRgn
CreateRectRgnIndirect
GetTextExtentPoint32W
GetObjectA
SetTextColor
SetBkMode
SetStretchBltMode
SetWindowOrgEx
GetWindowOrgEx
RestoreDC
SaveDC
CreateCompatibleDC
CreateDCW

Exports

Exports

OPENSSL_Applink

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 253KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 52KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 319KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 135KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c56b04f70b7adedc74050a8138b08562

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

iphlpapi

libssl-1_1

libcrypto-1_1

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

winmm

comctl32

gdiplus

imm32

msimg32

crypt32

uiautomationcore

gdi32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 253KB - Virtual size: 252KB

.data Size: 52KB - Virtual size: 120KB

.rsrc Size: 319KB - Virtual size: 319KB

.reloc Size: 135KB - Virtual size: 136KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 253KB - Virtual size: 252KB

.data
Size: 52KB - Virtual size: 120KB

.rsrc
Size: 319KB - Virtual size: 319KB

.reloc
Size: 135KB - Virtual size: 136KB