467afd60c3c057af1f4cb4c7632bb6a01ae9a389857addac11cd00013c0c0c16

Sharing

Copy URL Twitter E-mail

General

Target

467afd60c3c057af1f4cb4c7632bb6a01ae9a389857addac11cd00013c0c0c16
Size

543KB
MD5

f1bff34be32be41cbd1dd3de7ea6c601
SHA1

ceb514da79f9c9e7c1e3a1940f7fd9f95ceab1b2
SHA256

467afd60c3c057af1f4cb4c7632bb6a01ae9a389857addac11cd00013c0c0c16
SHA512

250e3c6638083a128f09da8a159301b6b330f1cc7c4ee02c12161bf92509ee7ed7b34bab62fe833462bacdac161ea7250ae6ac1be9308c5b9f0158607918d00c
SSDEEP

12288:QrEK1u7CKD84jat4nqkDCWNTWU3oWcUt26TGhnTO:KiDqkwUYn6GZTO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
467afd60c3c057af1f4cb4c7632bb6a01ae9a389857addac11cd00013c0c0c16

Files

467afd60c3c057af1f4cb4c7632bb6a01ae9a389857addac11cd00013c0c0c16
.exe windows:4 windows x86 arch:x86

fd793eec6b0365d0cb9aa03f45aec4c3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\KINGSOFT_DUBA\Build\Build_Src\kisengine_git\1517\product\win32\dbginfo\newtempleate.pdb

Imports

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
QueryPerformanceCounter
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
CreateMutexW
OpenMutexW
Sleep
FlushFileBuffers
GetLocalTime
InterlockedDecrement
WriteFile
DeleteFileW
OutputDebugStringW
GetModuleHandleW
lstrlenW
GetWindowsDirectoryW
FreeResource
GetCurrentThreadId
EnterCriticalSection
SetLastError
CreateFileW
FindResourceExW
GetFileSize
ReadFile
LoadResource
CloseHandle
LockResource
lstrlenA
SizeofResource
MultiByteToWideChar
InterlockedExchange
FindResourceW
FlushInstructionCache
GetCurrentProcess
GetPrivateProfileStringW
GlobalAlloc
LoadLibraryW
GlobalLock
InitializeCriticalSection
GetLastError
FreeLibrary
GetVersionExW
GetProcAddress
GlobalUnlock
WideCharToMultiByte
GlobalFree
RaiseException
GetModuleFileNameW
GetPrivateProfileIntW
DeleteCriticalSection

user32

LoadImageW
PostMessageW
SetForegroundWindow
AttachThreadInput
SetWindowPos
UnregisterClassA
GetActiveWindow
GetDesktopWindow
RegisterClassExW
IsWindowEnabled
EnableWindow
ShowWindow
SetWindowLongW
GetDlgItem
DestroyWindow
GetWindowThreadProcessId
GetClassInfoExW
GetForegroundWindow
FindWindowW
SystemParametersInfoW
TranslateMessage
SetRectEmpty
GetDC
CopyRect
UpdateLayeredWindow
SetCapture
ScreenToClient
ReleaseCapture
IsRectEmpty
GetCursorPos
IsWindowVisible
GetDlgCtrlID
PtInRect
EqualRect
SetRect
DrawIconEx
BeginPaint
SetFocus
SetWindowTextW
ClientToScreen
GetFocus
EndPaint
IsChild
DrawFrameControl
IntersectRect
SetTimer
SetCursor
RegisterWindowMessageW
LoadBitmapW
SetActiveWindow
MoveWindow
ReleaseDC
SendMessageW
DefWindowProcW
DispatchMessageW
LoadCursorW
MapWindowPoints
GetClientRect
InvalidateRect
GetWindowLongW
IsWindow
GetWindowRect
GetWindow
CreateWindowExW
KillTimer
GetParent
IsDialogMessageW
GetWindowPlacement
LoadIconW
GetNextDlgTabItem
OffsetRect
DestroyIcon
MonitorFromWindow
PostThreadMessageW
GetMonitorInfoW
DrawTextW
PeekMessageW
BringWindowToTop
CallWindowProcW
GetMessageW
InflateRect

gdi32

GetStockObject
CreateCompatibleDC
Rectangle
SetBkColor
ExtTextOutW
GetDeviceCaps
CreateBitmap
CreateDIBSection
StretchBlt
SetStretchBltMode
BitBlt
CreatePen
SetTextColor
DeleteDC
CreateRectRgn
DeleteObject
SelectObject
RestoreDC
TextOutW
MoveToEx
OffsetRgn
GetClipRgn
RoundRect
CreateRectRgnIndirect
CreateFontIndirectW
CreateRoundRectRgn
CombineRgn
GetCurrentObject
SetViewportOrgEx
GetTextExtentPoint32W
SetBkMode
ExtSelectClipRgn
GetViewportOrgEx
LineTo
GetTextColor
RectInRegion
GetObjectW
SelectClipRgn
CreateCompatibleBitmap
SaveDC

advapi32

RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW

shell32

ShellExecuteW

ole32

CreateStreamOnHGlobal

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathAddBackslashW
StrToIntW
PathFileExistsW
StrToIntA

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??$?5DU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z

gdiplus

GdipDrawLinesI
GdipSetPenEndCap
GdipAddPathPieI
GdipSetPenStartCap
GdipClosePathFigure
GdipSetPenDashStyle
GdipSetPenMode
GdipCreateSolidFill
GdipDeleteFont
GdipCreatePen1
GdipCreateFontFromLogfontW
GdipAddPathRectangleI
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipDrawRectangleI
GdipNewPrivateFontCollection
GdipCreateStringFormat
GdipSetClipPath
GdipGetFamily
GdipDeletePrivateFontCollection
GdipDeleteStringFormat
GdipMeasureString
GdipPrivateAddFontFile
GdipCreateFont
GdipAddPathStringI
GdipGetFontCollectionFamilyCount
GdipSetStringFormatAlign
GdipDrawPath
GdipGetFontSize
GdipSetStringFormatLineAlign
GdipDrawImageI
GdipSetStringFormatTrimming
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipSetTextRenderingHint
GdipDrawString
GdipCreateLineBrushFromRectWithAngleI
GdipAddPathArcI
GdipDeletePen
GdipFillPath
GdipCloneBrush
GdipDeleteBrush
GdipFillRectangle
GdipCreateFromHDC
GdipSetInterpolationMode
GdipCreateBitmapFromScan0
GdiplusStartup
GdipResetWorldTransform
GdipFillRectangleI
GdipRotateWorldTransform
GdipDeletePath
GdipTranslateWorldTransform
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipCreatePath
GdipSetStringFormatFlags
GdipGraphicsClear
GdipCloneImage
GdipAlloc
GdipDrawImageRectI
GdipFree
GdipDisposeImage
GdipCloneBitmapArea
GdipDeleteFontFamily
GdipDrawImageRectRectI
GdipImageRotateFlip
GdipCreateBitmapFromStream
GdipCreateImageAttributes
GdipDrawImageRectRect
GdipDisposeImageAttributes
GdipCreateHBITMAPFromBitmap
GdipLoadImageFromStream
GdipSetImageAttributesColorMatrix
GdipDrawImagePointsRectI
GdipGetImageWidth
GdipGetImageHeight
GdipLoadImageFromFile
GdiplusShutdown
GdipDeleteGraphics
GdipDrawLine

msvcr80

floor
atoi
_stricmp
_wcsicmp
malloc
swprintf_s
memcpy_s
??1exception@std@@UAE@XZ
??_V@YAXPAX@Z
vsprintf_s
_vscprintf
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
wcsrchr
_recalloc
??0exception@std@@QAE@ABQBD@Z
_wtof
_purecall
memmove_s
??2@YAPAXI@Z
_mbscmp
wcsspn
wcscspn
wcsstr
vswprintf_s
calloc
_vscwprintf
_mbsicmp
__CxxFrameHandler3
_CxxThrowException
memcpy
free
??0exception@std@@QAE@XZ
_waccess
_wcslwr_s
?what@exception@std@@UBEPBDXZ
??3@YAXPAX@Z
ceil
wcscpy_s
__RTDynamicCast
wcscat_s
wcschr
_mbschr
_beginthreadex
memmove
_vsnprintf_s
fprintf
tolower
isalpha
strncmp
isspace
strchr
isalnum
memset
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
_wtoi

Sections

.text
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fd793eec6b0365d0cb9aa03f45aec4c3

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

msimg32

msvcp80

gdiplus

msvcr80

Sections

.text Size: 332KB - Virtual size: 331KB

.rdata Size: 60KB - Virtual size: 57KB

.data Size: 8KB - Virtual size: 8KB

.rsrc Size: 132KB - Virtual size: 132KB

.text
Size: 332KB - Virtual size: 331KB

.rdata
Size: 60KB - Virtual size: 57KB

.data
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 132KB - Virtual size: 132KB