176596b16c9f2f4c140d0d50b43768f5f3d9090168da268a770b28fa29f6befb

Sharing

Copy URL Twitter E-mail

General

Target

176596b16c9f2f4c140d0d50b43768f5f3d9090168da268a770b28fa29f6befb
Size

108KB
MD5

98c2d45a4ee81e47a4c25c172b693f97
SHA1

03161edc1edb7d417b992d440b7d4901c2718c81
SHA256

176596b16c9f2f4c140d0d50b43768f5f3d9090168da268a770b28fa29f6befb
SHA512

3b0346b56d56bef039075742469ec54f36061ebe6d467f36d4cfd137c0820611b03e1e2a73513f72aa2247d14c999ff3e212c49139619238132fc9408683784f
SSDEEP

768:8Ja20Rs4qBPK8swT8fIVWZLRzjnX2NjIkdg/DcyPVFo7yDuVvdte9sYpr7R06woJ:M0R4XT+I0yNjIky/D9keKVvdhYpHp9m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
176596b16c9f2f4c140d0d50b43768f5f3d9090168da268a770b28fa29f6befb

Files

176596b16c9f2f4c140d0d50b43768f5f3d9090168da268a770b28fa29f6befb
.exe windows:6 windows x86 arch:x86

63a48aa8f23dfd1ebbc35c4727e14bf1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Virtual-PC\Documents\Visual Studio 2013\Projects\文件助手1.1\FileServer\Debug\FileServer.pdb

Imports

mfc120ud

ord3554
ord15154
ord14415
ord3427
ord14419
ord15176
ord14109
ord2970
ord1970
ord1567
ord12485
ord3801
ord1047
ord8137
ord10860
ord10961
ord5097
ord12798
ord13092
ord12978
ord9969
ord7028
ord1885
ord2644
ord1252
ord3414
ord17064
ord7053
ord532
ord534
ord5718
ord1669
ord1668
ord1142
ord302
ord1880
ord15210
ord1655
ord10567
ord1952
ord1640
ord1601
ord1092
ord2760
ord1648

msvcr120d

??1type_info@@UAE@XZ
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
_CrtSetCheckCount
exit
_exit
_CRT_RTC_INITW
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__winitenv
_fmode
_commode
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
_wmakepath_s
_wsplitpath_s
_onexit
__dllonexit
_calloc_dbg
_unlock
_lock
??_V@YAXPAX@Z
free
_vsnwprintf_s
swprintf_s
_CxxThrowException
strlen
memcpy
memmove
_purecall
memset
__CxxFrameHandler3
_CrtDbgReportW
wcscpy_s
wprintf
_cexit
_recalloc
memmove_s
_hypot

kernel32

LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
EncodePointer
LoadLibraryW
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
SetLastError
OutputDebugStringA
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
GetModuleHandleW
GetCommandLineW
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
VirtualQuery
FreeLibrary

user32

UnregisterClassW

oleaut32

SysFreeString

msvcp120d

?uncaught_exception@std@@YA_NXZ
?_Debug_message@std@@YAXPB_W0I@Z
??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ

ws2_32

WSAStartup

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63a48aa8f23dfd1ebbc35c4727e14bf1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc120ud

msvcr120d

kernel32

user32

oleaut32

msvcp120d

ws2_32

Sections

.textbss Size: - Virtual size: 64KB

.text Size: 74KB - Virtual size: 74KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 1KB - Virtual size: 12KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.textbss
Size: - Virtual size: 64KB

.text
Size: 74KB - Virtual size: 74KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 1KB - Virtual size: 12KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB