e:\project\ime_comp\branch\PinyinDev_R_7_5\Bin\SogouPdb\Component\ScreenCapture\ScreenCaptureexe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
47b3db571cc22650b7470aec4740be18b3666cac9c188378843768b68a9f9746.exe
Resource
win7-20240221-en
General
-
Target
47b3db571cc22650b7470aec4740be18b3666cac9c188378843768b68a9f9746
-
Size
1.5MB
-
MD5
0d53cd07e850f27c34803b868c9c6ca1
-
SHA1
f97de57186d301a5ffa4449ed2d9943f17a3962b
-
SHA256
47b3db571cc22650b7470aec4740be18b3666cac9c188378843768b68a9f9746
-
SHA512
ddbf0f8993c1037c1ae7f48b93f84be4863eb8aaead6c54da20d070343304311b048f2e55f6b9eb84df9d1b344b9f6523c097da436ea2c9300d6e531d2faeadc
-
SSDEEP
24576:NmPdxdenL+LRZr1RM9PJYAT+CbTLhxYoTmzf:WOnLWRanhT+CbTLhxj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 47b3db571cc22650b7470aec4740be18b3666cac9c188378843768b68a9f9746
Files
-
47b3db571cc22650b7470aec4740be18b3666cac9c188378843768b68a9f9746.exe windows:5 windows x86 arch:x86
35abc763e38ec5f9e9d68d1cc6f7eb4e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
gdiplus
GdipCreateFromHDC
GdipSaveImageToFile
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipSaveImageToStream
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdiplusStartup
GdipFillEllipseI
GdipDrawEllipseI
GdipFillPath
GdipDrawPath
GdipSetPenWidth
GdipSetPenLineJoin
GdipSetPenEndCap
GdipSetPenStartCap
GdipAddPathLine2I
GdipDeletePath
GdipCreatePath
GdipCloneBrush
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipDeletePen
GdipCreatePen1
GdipSetSmoothingMode
GdipDeleteGraphics
GdipDrawImageRectRectI
kernel32
GetCurrentProcessId
LoadLibraryW
FreeLibrary
WaitForSingleObject
TerminateProcess
RaiseException
CompareStringW
CompareStringA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetDriveTypeA
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetProcessHeap
SetEndOfFile
SetStdHandle
GetModuleHandleA
LCMapStringW
LCMapStringA
GetCurrentDirectoryA
GetTimeZoneInformation
QueryPerformanceCounter
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
HeapSize
GetModuleFileNameA
CloseHandle
ExitProcess
HeapDestroy
HeapCreate
VirtualAlloc
VirtualFree
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetFileType
RtlUnwind
OpenProcess
TlsSetValue
TlsAlloc
TlsGetValue
GetSystemTimeAsFileTime
GetDriveTypeW
FileTimeToLocalFileTime
GetStartupInfoW
ResumeThread
GetFullPathNameW
UnhandledExceptionFilter
HeapFree
HeapReAlloc
HeapAlloc
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseMutex
OpenMutexW
CreateMutexW
FlushFileBuffers
ReadFile
GetFileSize
LocalAlloc
GetCommandLineW
CreateThread
GetModuleFileNameW
GlobalAddAtomW
GetModuleHandleW
GetProcAddress
FindNextFileW
FindResourceExW
lstrcpyW
FindFirstFileW
SetLastError
FindClose
GetSystemDirectoryW
GetModuleHandleExW
GetTickCount
MulDiv
lstrcpynW
GetLocalTime
GlobalUnlock
GlobalLock
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
GetVersionExW
GetCurrentThread
LoadResource
LockResource
SizeofResource
GetLastError
FindResourceW
GlobalFree
GlobalAlloc
SetEnvironmentVariableA
InterlockedCompareExchange
IsProcessorFeaturePresent
InitializeCriticalSection
VirtualProtect
SetThreadContext
MultiByteToWideChar
WideCharToMultiByte
IsDebuggerPresent
LocalFree
ExitThread
SetFileAttributesW
DeleteFileW
lstrcatW
lstrlenW
CreateFileW
FormatMessageW
WriteFile
OutputDebugStringW
SetUnhandledExceptionFilter
CreateProcessW
VirtualQuery
SetFilePointer
FileTimeToSystemTime
Sleep
GetThreadContext
TlsFree
SuspendThread
GetStdHandle
user32
UnregisterClassA
GetFocus
SetTimer
IsIconic
NotifyWinEvent
IsWindowEnabled
SetPropW
GetPropW
PostThreadMessageW
MoveWindow
UpdateLayeredWindow
SubtractRect
MonitorFromRect
GetForegroundWindow
PeekMessageW
TrackMouseEvent
GetClassInfoExW
RegisterClassExW
CreateWindowExW
LoadIconW
WaitForInputIdle
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowTextW
MessageBoxW
UnregisterHotKey
RegisterHotKey
PostQuitMessage
LoadCursorW
SetCursor
ChildWindowFromPointEx
SetRect
GetWindow
UnionRect
ReleaseCapture
SetCapture
SetCursorPos
GetKeyState
FindWindowW
HideCaret
UpdateWindow
IsWindowVisible
InflateRect
GetWindowTextLengthW
GetWindowTextW
GetWindowDC
SetWindowPos
GetParent
GetWindowRect
DestroyWindow
SetFocus
GetMonitorInfoW
DrawTextW
PtInRect
ScreenToClient
MonitorFromPoint
ClientToScreen
InvalidateRect
EnumDisplayMonitors
GetSystemMetrics
IsRectEmpty
IntersectRect
CopyRect
SetForegroundWindow
ShowWindow
KillTimer
DrawIcon
GetIconInfo
GetCursorPos
GetCursorInfo
SetRectEmpty
GetClipboardData
SetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
CloseClipboard
OpenClipboard
EndPaint
BeginPaint
CallWindowProcW
DefWindowProcW
FillRect
ReleaseDC
GetDC
GetDesktopWindow
SendMessageW
PostMessageW
GetClientRect
GetWindowLongW
SetWindowLongW
IsWindow
wvsprintfW
gdi32
DeleteObject
SetStretchBltMode
SetViewportOrgEx
SetPixel
EnumFontFamiliesExW
CreatePen
LineTo
MoveToEx
GetTextExtentPointW
GetTextExtentExPointW
GetBitmapDimensionEx
CreateSolidBrush
StretchBlt
GetPixel
SetBkMode
SetTextColor
CreateFontIndirectW
GetClipBox
GetStockObject
CreateCompatibleBitmap
GetCurrentObject
GetDeviceCaps
DeleteDC
BitBlt
CreateDIBSection
SelectObject
GetObjectW
CreateCompatibleDC
EndPath
StrokePath
StrokeAndFillPath
GetFontData
comdlg32
GetSaveFileNameW
ChooseColorW
GetOpenFileNameW
shell32
SHGetFolderPathW
ShellExecuteW
SHGetSpecialFolderPathW
ole32
CoUninitialize
OleInitialize
CoInitialize
CreateStreamOnHGlobal
OleSetContainedObject
OleCreate
oleaut32
VariantInit
VariantClear
SysAllocString
wininet
InternetQueryOptionW
InternetErrorDlg
InternetCloseHandle
InternetSetOptionW
InternetOpenUrlW
InternetOpenW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
msimg32
AlphaBlend
TransparentBlt
oleacc
LresultFromObject
AccessibleObjectFromWindow
advapi32
RegCreateKeyExW
GetSecurityDescriptorSacl
GetSidLengthRequired
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeAcl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx
RegCloseKey
RegOpenKeyExW
RegQueryValueW
RegQueryValueExW
Sections
.text Size: 563KB - Virtual size: 562KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 18KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 681KB - Virtual size: 680KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 109KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE