3eeb72ab20c08eb432921d74502ffe4b26124d8ddae2b414891f3190eab98362

Sharing

Copy URL Twitter E-mail

General

Target

3eeb72ab20c08eb432921d74502ffe4b26124d8ddae2b414891f3190eab98362
Size

1.3MB
MD5

1f2003c61b608497c38b58c94a7f5df7
SHA1

1e4f4211f15cdb3b3c509962cd00aadd007f38ac
SHA256

3eeb72ab20c08eb432921d74502ffe4b26124d8ddae2b414891f3190eab98362
SHA512

690f8ad2d3b01274aff72a8b37acba394137b210c4938d485a06630e26f2c28c9d5990ab0f249ecf5c30d9175e62522b218aab1e9af7e01a43218bb643ce48f6
SSDEEP

24576:tTGK6tmsMLwVvlnqTNqq6y28jXp625Yq:ZGK6tmsMLioz5lt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3eeb72ab20c08eb432921d74502ffe4b26124d8ddae2b414891f3190eab98362

Files

3eeb72ab20c08eb432921d74502ffe4b26124d8ddae2b414891f3190eab98362
.exe windows:5 windows x86 arch:x86

5675b3c3b0adb627bc5d41e6a9d5953c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\code\open_http\20140613\Debug\QQ Cloud News.pdb

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
ReleaseMutex
IsBadWritePtr
VirtualProtect
GetModuleFileNameA
GetCurrentDirectoryA
WriteFile
DeleteFileW
CreateProcessW
GetStartupInfoW
LoadLibraryExW
lstrcmpiW
GetCurrentThread
OpenProcess
GetExitCodeThread
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
CreateEventW
TerminateThread
SetEvent
GetModuleHandleW
CreateFileW
GetFileSize
LoadLibraryExA
SuspendThread
GetThreadContext
SetThreadContext
ResumeThread
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
CreateFileA
SetStdHandle
SetFilePointer
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetStringTypeW
LCMapStringW
FlushFileBuffers
InterlockedDecrement
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
ReadFile
HeapCreate
HeapQueryInformation
GetConsoleMode
GetConsoleCP
GetLocaleInfoW
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetConsoleCtrlHandler
FatalAppExitA
HeapSetInformation
GetCommandLineW
ExitThread
CreateThread
IsBadReadPtr
HeapValidate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
EncodePointer
DecodePointer
GetStdHandle
GetFileType
WriteConsoleW
GetTimeZoneInformation
GetSystemTimeAsFileTime
RtlUnwind
InterlockedExchange
OpenFileMappingA
CreateFileMappingA
GetSystemInfo
InterlockedCompareExchange
IsProcessorFeaturePresent
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
InterlockedPushEntrySList
HeapDestroy
InterlockedIncrement
DeleteCriticalSection
MulDiv
GetLastError
lstrcmpW
RaiseException
MultiByteToWideChar
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
GetCurrentProcess
FlushInstructionCache
SetLastError
WideCharToMultiByte
lstrlenW
Sleep
OpenFileMappingW
MapViewOfFile
ExitProcess
CreateFileMappingW
UnmapViewOfFile
CreateDirectoryA
VirtualQuery
GetCurrentThreadId
FindClose
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
GetModuleFileNameW
LoadLibraryW
GetProcAddress
FreeLibrary
GetTickCount
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
lstrlenA
OutputDebugStringW
OutputDebugStringA
OpenEventA
GetCurrentProcessId
FindFirstFileW
FindNextFileW
QueryPerformanceCounter

user32

DispatchMessageA
GetMessageA
SubtractRect
IsWindowUnicode
PeekMessageA
UnionRect
InflateRect
EqualRect
SetRectEmpty
SetRect
CopyRect
ReleaseDC
GetIconInfo
IntersectRect
FillRect
DrawTextW
InvalidateRect
SetWindowRgn
OffsetRect
GetWindowRect
IsRectEmpty
EndPaint
BeginPaint
MsgWaitForMultipleObjectsEx
IsWindow
GetDC
UnregisterClassA
GetClassNameW
UnregisterClassW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW
FindWindowExW
SendMessageW
InvalidateRgn
SetCapture
ReleaseCapture
ScreenToClient
ClientToScreen
CreateAcceleratorTableW
GetDesktopWindow
CharNextW
GetUpdateRect
RedrawWindow
IsChild
SetFocus
GetFocus
GetSysColor
DestroyAcceleratorTable
RegisterWindowMessageW
GetClassInfoExW
LoadCursorW
RegisterClassExW
IsDialogMessageW
GetDlgItem
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
DestroyWindow
CreateDialogParamW
PostQuitMessage
CallWindowProcW
DefWindowProcW
SetWindowLongW
GetParent
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
KillTimer
SetTimer
ShowWindow
MoveWindow
PostMessageW
CreateWindowExW
LoadBitmapW
SetWindowPos
PtInRect
GetClientRect

gdi32

SaveDC
RestoreDC
SetBkColor
GetObjectType
CreateRoundRectRgn
CreateFontW
SetBkMode
SetTextColor
RoundRect
CreatePen
GetStockObject
Rectangle
CreateSolidBrush
StretchBlt
BitBlt
SelectObject
SetStretchBltMode
CreateDIBSection
GetObjectW
CreateBitmap
DeleteDC
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps

advapi32

RegCloseKey
RevertToSelf
SetThreadToken
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExA
RegQueryValueExW
RegSetValueExA
OpenThreadToken

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA

ole32

CLSIDFromProgID
CoGetClassObject
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
CLSIDFromString
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoUninitialize
CoInitialize
CoTaskMemFree
OleLockRunning
CoTaskMemAlloc
CoReleaseMarshalData
CoMarshalInterface
CoUnmarshalInterface
CoRevokeClassObject
CoRegisterClassObject

oleaut32

VariantChangeType
VariantCopy
VarUI4FromStr
SysStringLen
LoadTypeLi
SysAllocString
SysFreeString
SysAllocStringLen
VariantInit
VariantClear
OleCreateFontIndirect
LoadRegTypeLi

shlwapi

PathFindFileNameW
PathFileExistsW
PathRemoveFileSpecW
PathAppendA

comctl32

InitCommonControlsEx
_TrackMouseEvent

msimg32

TransparentBlt

ws2_32

inet_addr
inet_ntoa
gethostbyname
WSACleanup
recv
WSASend
WSAStartup
socket
htons
connect
closesocket
send

Sections

.textbss
Size: - Virtual size: 502KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5675b3c3b0adb627bc5d41e6a9d5953c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

ws2_32

Sections

.textbss Size: - Virtual size: 502KB

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 209KB - Virtual size: 209KB

.data Size: 13KB - Virtual size: 23KB

.idata Size: 10KB - Virtual size: 10KB

.rsrc Size: 28KB - Virtual size: 27KB

.reloc Size: 40KB - Virtual size: 39KB

.textbss
Size: - Virtual size: 502KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 209KB - Virtual size: 209KB

.data
Size: 13KB - Virtual size: 23KB

.idata
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 28KB - Virtual size: 27KB

.reloc
Size: 40KB - Virtual size: 39KB