C:\app\cc\LVInstaller\VideofusionInstaller\build\CC_RELEASE\JianyingLauncher.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9c5fc1aab7b291cff6372c3c815a9ef8a8059e0d98fe5a24a6aec8cc4333f2fc.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9c5fc1aab7b291cff6372c3c815a9ef8a8059e0d98fe5a24a6aec8cc4333f2fc.exe
Resource
win10v2004-20240426-en
General
-
Target
9c5fc1aab7b291cff6372c3c815a9ef8a8059e0d98fe5a24a6aec8cc4333f2fc
-
Size
2.0MB
-
MD5
b35054b7a75de548622eab3820df3b90
-
SHA1
d2c0b8ebe1831caa4bfea218f71973912006c427
-
SHA256
9c5fc1aab7b291cff6372c3c815a9ef8a8059e0d98fe5a24a6aec8cc4333f2fc
-
SHA512
7f7fb450fe681a1e05be76cb893c08c3a2baed5bd09778bfaacee230b5aeb72620b5bc75b5f35af76f44cb615e405b132532dce12d2ac8ec38fc58831339b8dc
-
SSDEEP
49152:M1fiSvhsfZfyl+m6GlRh6fuFe62ugX88RPGB9t2r4PRSEk1ul:M1cxghNFe62uWRPct2sEE5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9c5fc1aab7b291cff6372c3c815a9ef8a8059e0d98fe5a24a6aec8cc4333f2fc
Files
-
9c5fc1aab7b291cff6372c3c815a9ef8a8059e0d98fe5a24a6aec8cc4333f2fc.exe windows:6 windows x86 arch:x86
d9d4b6638e70a577bf807d3ce2c101d6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
powrprof
PowerDeterminePlatformRole
setupapi
CM_Get_Device_IDW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
kernel32
DeleteCriticalSection
GetFileInformationByHandle
GetLocalTime
GetTickCount
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FileTimeToSystemTime
ProcessIdToSessionId
GetCommandLineW
GetDiskFreeSpaceExW
GetVolumeInformationW
QueryDosDeviceW
GetTempPathW
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetVersion
GetSystemDirectoryW
LocalAlloc
lstrcmpW
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
CopyFileW
MoveFileExW
WTSGetActiveConsoleSessionId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
CreateEventW
CreateThread
MoveFileW
InitializeCriticalSectionAndSpinCount
OpenMutexA
GetEnvironmentVariableW
lstrlenW
GetProcessId
GetModuleHandleA
GetNativeSystemInfo
GetCurrentThreadId
CreateMutexW
FormatMessageA
OutputDebugStringA
ReleaseMutex
RegisterWaitForSingleObject
UnregisterWaitEx
Sleep
SetThreadPriority
GetThreadPriority
IsDebuggerPresent
DuplicateHandle
GetUserDefaultLangID
TryEnterCriticalSection
SystemTimeToTzSpecificLocalTime
QueryPerformanceCounter
InitializeCriticalSectionEx
TzSpecificLocalTimeToSystemTime
QueryPerformanceFrequency
GetModuleHandleExW
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
SetInformationJobObject
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
WaitForMultipleObjects
GlobalMemoryStatusEx
RtlCaptureStackBackTrace
QueueUserWorkItem
GetModuleHandleExA
GetProcessHeaps
HeapSetInformation
HeapUnlock
HeapLock
HeapWalk
GetProcessIoCounters
VirtualQueryEx
GetProcessTimes
GetSystemInfo
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryExW
WriteConsoleW
SetStdHandle
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
FatalAppExitA
FlushFileBuffers
SetFilePointerEx
ReadConsoleW
GetFileType
CreateSemaphoreW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStdHandle
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
EncodePointer
IsValidCodePage
AreFileApisANSI
ExitProcess
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
DecodePointer
SetFileTime
SystemTimeToFileTime
SetFilePointer
LocalFileTimeToFileTime
GetCurrentDirectoryW
GetCurrentThread
GetCurrentProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
LoadLibraryW
FreeLibrary
GetWindowsDirectoryW
OpenProcess
WaitForSingleObject
LocalFree
GetProcAddress
GetModuleHandleW
GetVersionExW
DeviceIoControl
SetLastError
SetFileAttributesW
GetLongPathNameW
GetFullPathNameW
ExpandEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
WriteFile
ReadFile
GetFileSize
CreateFileW
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
RemoveDirectoryW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
GetUserDefaultLCID
EnumSystemLocalesW
SetEndOfFile
SetEnvironmentVariableA
OutputDebugStringW
GetSystemTimeAsFileTime
LoadLibraryExA
GetFileAttributesExW
IsProcessorFeaturePresent
VirtualQuery
VirtualProtect
VirtualAlloc
RtlUnwind
user32
GetWindowLongW
EnumWindows
GetClassNameW
GetWindowThreadProcessId
GetWindowTextLengthW
GetQueueStatus
GetWindowTextW
PostMessageW
ExitWindowsEx
UnregisterClassW
GetDC
GetDesktopWindow
DestroyWindow
SetTimer
PostQuitMessage
KillTimer
WaitMessage
TranslateMessage
RegisterClassExW
CallMsgFilterW
PeekMessageW
MsgWaitForMultipleObjectsEx
CreateWindowExW
DefWindowProcW
DispatchMessageW
CharUpperW
GetKeyState
IsWindowEnabled
FindWindowW
SystemParametersInfoW
IsWindow
GetSystemMetrics
gdi32
DeleteObject
GetDeviceCaps
advapi32
GetTraceEnableLevel
UnregisterTraceGuids
TraceEvent
GetTraceLoggerHandle
GetTraceEnableFlags
RegNotifyChangeKeyValue
RegEnumValueW
RegDeleteValueW
ConvertSidToStringSidW
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegOpenCurrentUser
RegCloseKey
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
FreeSid
EqualSid
DuplicateToken
AllocateAndInitializeSid
AddAccessAllowedAce
AccessCheck
LookupPrivilegeValueW
RevertToSelf
ImpersonateSelf
AdjustTokenPrivileges
OpenThreadToken
SetThreadToken
ConvertStringSidToSidW
LookupAccountSidW
SetTokenInformation
GetTokenInformation
DuplicateTokenEx
OpenProcessToken
CreateProcessAsUserW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
IsValidSid
InitializeSid
InitializeAcl
GetSidSubAuthority
GetSidLengthRequired
GetLengthSid
GetAclInformation
GetAce
CopySid
AddAce
RegisterTraceGuidsW
shell32
SHGetKnownFolderPath
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetFolderPathA
CommandLineToArgvW
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
CoInitialize
PropVariantClear
CoTaskMemFree
oleaut32
SysAllocString
SysStringLen
VariantClear
SysFreeString
shlwapi
SHStrDupW
StrToIntW
ord176
SHSetValueW
StrChrW
SHGetValueW
StrCmpNW
StrCmpNIW
PathRemoveFileSpecW
PathIsDirectoryW
PathGetDriveNumberW
PathFindExtensionW
PathAddBackslashW
PathFileExistsW
PathAppendW
StrRChrW
StrCmpIW
StrCpyNW
userenv
LoadUserProfileW
DestroyEnvironmentBlock
CreateEnvironmentBlock
UnloadUserProfile
mpr
WNetGetResourceInformationW
psapi
GetProcessMemoryInfo
GetProcessImageFileNameW
GetModuleFileNameExW
EnumProcesses
EnumProcessModules
QueryWorkingSet
netapi32
NetGetJoinInformation
NetApiBufferFree
winmm
timeBeginPeriod
timeGetTime
timeEndPeriod
Exports
Exports
GetHandleVerifier
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 600KB - Virtual size: 604KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE