47b3db571cc22650b7470aec4740be18b3666cac9c188378843768b68a9f9746

Sharing

Copy URL Twitter E-mail

General

Target

47b3db571cc22650b7470aec4740be18b3666cac9c188378843768b68a9f9746
Size

1.5MB
MD5

0d53cd07e850f27c34803b868c9c6ca1
SHA1

f97de57186d301a5ffa4449ed2d9943f17a3962b
SHA256

47b3db571cc22650b7470aec4740be18b3666cac9c188378843768b68a9f9746
SHA512

ddbf0f8993c1037c1ae7f48b93f84be4863eb8aaead6c54da20d070343304311b048f2e55f6b9eb84df9d1b344b9f6523c097da436ea2c9300d6e531d2faeadc
SSDEEP

24576:NmPdxdenL+LRZr1RM9PJYAT+CbTLhxYoTmzf:WOnLWRanhT+CbTLhxj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
47b3db571cc22650b7470aec4740be18b3666cac9c188378843768b68a9f9746

Files

47b3db571cc22650b7470aec4740be18b3666cac9c188378843768b68a9f9746
.exe windows:5 windows x86 arch:x86

35abc763e38ec5f9e9d68d1cc6f7eb4e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\project\ime_comp\branch\PinyinDev_R_7_5\Bin\SogouPdb\Component\ScreenCapture\ScreenCaptureexe.pdb

Imports

gdiplus

GdipCreateFromHDC
GdipSaveImageToFile
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipSaveImageToStream
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdiplusStartup
GdipFillEllipseI
GdipDrawEllipseI
GdipFillPath
GdipDrawPath
GdipSetPenWidth
GdipSetPenLineJoin
GdipSetPenEndCap
GdipSetPenStartCap
GdipAddPathLine2I
GdipDeletePath
GdipCreatePath
GdipCloneBrush
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipDeletePen
GdipCreatePen1
GdipSetSmoothingMode
GdipDeleteGraphics
GdipDrawImageRectRectI

kernel32

GetCurrentProcessId
LoadLibraryW
FreeLibrary
WaitForSingleObject
TerminateProcess
RaiseException
CompareStringW
CompareStringA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetDriveTypeA
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetProcessHeap
SetEndOfFile
SetStdHandle
GetModuleHandleA
LCMapStringW
LCMapStringA
GetCurrentDirectoryA
GetTimeZoneInformation
QueryPerformanceCounter
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
HeapSize
GetModuleFileNameA
CloseHandle
ExitProcess
HeapDestroy
HeapCreate
VirtualAlloc
VirtualFree
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetFileType
RtlUnwind
OpenProcess
TlsSetValue
TlsAlloc
TlsGetValue
GetSystemTimeAsFileTime
GetDriveTypeW
FileTimeToLocalFileTime
GetStartupInfoW
ResumeThread
GetFullPathNameW
UnhandledExceptionFilter
HeapFree
HeapReAlloc
HeapAlloc
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseMutex
OpenMutexW
CreateMutexW
FlushFileBuffers
ReadFile
GetFileSize
LocalAlloc
GetCommandLineW
CreateThread
GetModuleFileNameW
GlobalAddAtomW
GetModuleHandleW
GetProcAddress
FindNextFileW
FindResourceExW
lstrcpyW
FindFirstFileW
SetLastError
FindClose
GetSystemDirectoryW
GetModuleHandleExW
GetTickCount
MulDiv
lstrcpynW
GetLocalTime
GlobalUnlock
GlobalLock
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
GetVersionExW
GetCurrentThread
LoadResource
LockResource
SizeofResource
GetLastError
FindResourceW
GlobalFree
GlobalAlloc
SetEnvironmentVariableA
InterlockedCompareExchange
IsProcessorFeaturePresent
InitializeCriticalSection
VirtualProtect
SetThreadContext
MultiByteToWideChar
WideCharToMultiByte
IsDebuggerPresent
LocalFree
ExitThread
SetFileAttributesW
DeleteFileW
lstrcatW
lstrlenW
CreateFileW
FormatMessageW
WriteFile
OutputDebugStringW
SetUnhandledExceptionFilter
CreateProcessW
VirtualQuery
SetFilePointer
FileTimeToSystemTime
Sleep
GetThreadContext
TlsFree
SuspendThread
GetStdHandle

user32

UnregisterClassA
GetFocus
SetTimer
IsIconic
NotifyWinEvent
IsWindowEnabled
SetPropW
GetPropW
PostThreadMessageW
MoveWindow
UpdateLayeredWindow
SubtractRect
MonitorFromRect
GetForegroundWindow
PeekMessageW
TrackMouseEvent
GetClassInfoExW
RegisterClassExW
CreateWindowExW
LoadIconW
WaitForInputIdle
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowTextW
MessageBoxW
UnregisterHotKey
RegisterHotKey
PostQuitMessage
LoadCursorW
SetCursor
ChildWindowFromPointEx
SetRect
GetWindow
UnionRect
ReleaseCapture
SetCapture
SetCursorPos
GetKeyState
FindWindowW
HideCaret
UpdateWindow
IsWindowVisible
InflateRect
GetWindowTextLengthW
GetWindowTextW
GetWindowDC
SetWindowPos
GetParent
GetWindowRect
DestroyWindow
SetFocus
GetMonitorInfoW
DrawTextW
PtInRect
ScreenToClient
MonitorFromPoint
ClientToScreen
InvalidateRect
EnumDisplayMonitors
GetSystemMetrics
IsRectEmpty
IntersectRect
CopyRect
SetForegroundWindow
ShowWindow
KillTimer
DrawIcon
GetIconInfo
GetCursorPos
GetCursorInfo
SetRectEmpty
GetClipboardData
SetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
CloseClipboard
OpenClipboard
EndPaint
BeginPaint
CallWindowProcW
DefWindowProcW
FillRect
ReleaseDC
GetDC
GetDesktopWindow
SendMessageW
PostMessageW
GetClientRect
GetWindowLongW
SetWindowLongW
IsWindow
wvsprintfW

gdi32

DeleteObject
SetStretchBltMode
SetViewportOrgEx
SetPixel
EnumFontFamiliesExW
CreatePen
LineTo
MoveToEx
GetTextExtentPointW
GetTextExtentExPointW
GetBitmapDimensionEx
CreateSolidBrush
StretchBlt
GetPixel
SetBkMode
SetTextColor
CreateFontIndirectW
GetClipBox
GetStockObject
CreateCompatibleBitmap
GetCurrentObject
GetDeviceCaps
DeleteDC
BitBlt
CreateDIBSection
SelectObject
GetObjectW
CreateCompatibleDC
EndPath
StrokePath
StrokeAndFillPath
GetFontData

comdlg32

GetSaveFileNameW
ChooseColorW
GetOpenFileNameW

shell32

SHGetFolderPathW
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoUninitialize
OleInitialize
CoInitialize
CreateStreamOnHGlobal
OleSetContainedObject
OleCreate

oleaut32

VariantInit
VariantClear
SysAllocString

wininet

InternetQueryOptionW
InternetErrorDlg
InternetCloseHandle
InternetSetOptionW
InternetOpenUrlW
InternetOpenW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

msimg32

AlphaBlend
TransparentBlt

oleacc

LresultFromObject
AccessibleObjectFromWindow

advapi32

RegCreateKeyExW
GetSecurityDescriptorSacl
GetSidLengthRequired
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeAcl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx
RegCloseKey
RegOpenKeyExW
RegQueryValueW
RegQueryValueExW

Sections

.text
Size: 563KB - Virtual size: 562KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 18KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 681KB - Virtual size: 680KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 109KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

35abc763e38ec5f9e9d68d1cc6f7eb4e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

kernel32

user32

gdi32

comdlg32

shell32

ole32

oleaut32

wininet

version

msimg32

oleacc

advapi32

Sections

.text Size: 563KB - Virtual size: 562KB

.rdata Size: 124KB - Virtual size: 123KB

.data Size: 18KB - Virtual size: 31KB

.rsrc Size: 681KB - Virtual size: 680KB

.reloc Size: 109KB - Virtual size: 112KB

.text
Size: 563KB - Virtual size: 562KB

.rdata
Size: 124KB - Virtual size: 123KB

.data
Size: 18KB - Virtual size: 31KB

.rsrc
Size: 681KB - Virtual size: 680KB

.reloc
Size: 109KB - Virtual size: 112KB