ebd92500403301e870653e8479b1ca15fae9a279f48785ee485bc444c0070ed9

Sharing

Copy URL Twitter E-mail

General

Target

ebd92500403301e870653e8479b1ca15fae9a279f48785ee485bc444c0070ed9
Size

414KB
MD5

ba7d2e1a528a1471fc9b7b9ed08d108f
SHA1

769fbd3ad6228375eb8c728dcfd5721eef055695
SHA256

ebd92500403301e870653e8479b1ca15fae9a279f48785ee485bc444c0070ed9
SHA512

2056c9ef8172047eb8a9fecd04ff4a9a738dd93316973eb607a21714f4cd3c158176d8a53ce88ec27ea1d8f3e6cc94d7a5d4595fa4f3b842aefb7c4e2ba94891
SSDEEP

12288:QA4lKm740kP4IL6/8tomLhiLfLkAvGWx0FRSWSBfmejcSOIp1zelZF:QA4lKmfAomLQDwwGWPWSJmmEv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebd92500403301e870653e8479b1ca15fae9a279f48785ee485bc444c0070ed9

Files

ebd92500403301e870653e8479b1ca15fae9a279f48785ee485bc444c0070ed9
.exe windows:4 windows x86 arch:x86

7ff9aacd9f78fd0b5c5c68330c25aa16

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\ysws_dev\launcher\source\bin\Release\GenPatchRuntime.pdb

Imports

kernel32

InterlockedExchangeAdd
LoadLibraryA
GetVersionExA
GetCurrentThreadId
DeleteCriticalSection
GetModuleHandleA
EnterCriticalSection
GetThreadLocale
InterlockedExchange
RaiseException
FlushInstructionCache
GetACP
CreateProcessA
LeaveCriticalSection
InitializeCriticalSection
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
IsBadCodePtr
QueryPerformanceCounter
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetProcessHeap
HeapFree
GetCurrentProcess
HeapAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetOEMCP
FlushFileBuffers
ReadFile
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
CloseHandle
CreateMutexA
GetLastError
UnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
HeapSize
GetProcAddress
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
LCMapStringW
LCMapStringA
RtlUnwind
GetCPInfo
VirtualAlloc
VirtualProtect
CreateThread
SetFileTime
GetFileTime
CreateFileA
GetFileSize
GetSystemTimeAsFileTime
GetFileAttributesA
CreateDirectoryA
SetCurrentDirectoryA
RemoveDirectoryA
SetFileAttributesA
MoveFileA
GetCurrentDirectoryA
DeleteFileA
AllocConsole
Process32First
GetLogicalDrives
GetStdHandle
AttachConsole
Process32Next
GetModuleFileNameA
CreateToolhelp32Snapshot
GetDiskFreeSpaceExA
ExitProcess
SetFilePointer
WaitForSingleObject
GetTickCount
WriteFile
SetLastError
OutputDebugStringA
ReleaseMutex
GetCurrentProcessId
ExpandEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
GetExitCodeProcess
TerminateProcess
GetCurrentThread
IsDebuggerPresent
FileTimeToDosDateTime
GlobalMemoryStatus
VirtualQuery
lstrcpynA
SetUnhandledExceptionFilter
IsBadStringPtrA
Module32First
GetLocalTime
GetSystemInfo
Module32Next
FileTimeToLocalFileTime
GetVersion
LocalFree
FindResourceA
lstrlenA
FreeLibrary
LoadResource
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
SizeofResource
IsDBCSLeadByte
MultiByteToWideChar
lstrlenW
lstrcmpiA
LoadLibraryExA
IsBadReadPtr
HeapReAlloc
GetStartupInfoA
GetCommandLineA
SetStdHandle
GetFileType
GetTimeZoneInformation
ExitThread

user32

SystemParametersInfoA
SetWindowPos
MapWindowPoints
GetSystemMetrics
EnableWindow
CallWindowProcA
SetWindowTextA
LoadImageA
GetDlgItem
EndDialog
CreateWindowExA
GetWindowLongA
UnregisterClassA
LoadCursorA
GetWindow
IsWindow
PostMessageA
DefWindowProcA
GetActiveWindow
DialogBoxParamA
GetWindowRect
RegisterClassExA
GetClassInfoExA
GetParent
LoadIconA
wsprintfA
GetClientRect
SendMessageA
GetWindowTextA
CharNextA
SetWindowLongA
MessageBoxA

gdi32

GetStockObject
GetObjectA
DeleteObject
CreateFontIndirectA

shell32

ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA

oleaut32

VarUI4FromStr

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shlwapi

wnsprintfA

dbghelp

SymSetOptions
SymInitialize
SymFromAddr
SymGetTypeInfo
SymGetLineFromAddr
SymCleanup
SymFunctionTableAccess
SymGetModuleBase
MiniDumpWriteDump
StackWalk
SymEnumSymbols
UnDecorateSymbolName
SymSetContext

advapi32

RegCloseKey
RegQueryValueExA
RegEnumKeyExA
GetUserNameA
RegDeleteKeyA
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

Sections

.text
Size: 304KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ff9aacd9f78fd0b5c5c68330c25aa16

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

oleaut32

version

shlwapi

dbghelp

advapi32

ole32

Sections

.text Size: 304KB - Virtual size: 300KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 12KB - Virtual size: 18KB

.rsrc Size: 20KB - Virtual size: 17KB

.text
Size: 304KB - Virtual size: 300KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 12KB - Virtual size: 18KB

.rsrc
Size: 20KB - Virtual size: 17KB