G:\Work\new\2345Pinyin\bin\Win32\Release\pdb\2345PinyinSkinUtil.pdb
Static task
static1
Behavioral task
behavioral1
Sample
193301eec463f64548f026797bb52b348a16d029a01adb30760febffe1d80f57.exe
Resource
win7-20240419-en
General
-
Target
193301eec463f64548f026797bb52b348a16d029a01adb30760febffe1d80f57
-
Size
2.5MB
-
MD5
ee8249bab7af7605b202fabe9bdac646
-
SHA1
9e7715c26743a813056a0dc38e92d9bebbe375d4
-
SHA256
193301eec463f64548f026797bb52b348a16d029a01adb30760febffe1d80f57
-
SHA512
b4b7a9237132d951e8d1c9b90df210a1ace4700903ca07c6023168cc6c3d4dec728f750a5f8b65cdd719d58aca7b693f73faf097195906f35dd96e0c145a3a0e
-
SSDEEP
49152:3reCWbYLlfeh+30Xl2f80HA5dxF7LlYMCSRkkd7fscIUm0TkylXiljBsuG:bFCYIk25dxF7LzCQd7fscIUmG0o
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 193301eec463f64548f026797bb52b348a16d029a01adb30760febffe1d80f57
Files
-
193301eec463f64548f026797bb52b348a16d029a01adb30760febffe1d80f57.exe windows:5 windows x86 arch:x86
fcf1b636d5619a11f9bf3e8f8f7ae715
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
SHDeleteKeyW
imm32
ImmDisableIME
kernel32
FindFirstFileW
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
SetFileTime
LockFile
LeaveCriticalSection
InitializeCriticalSection
GetFullPathNameA
UnlockFileEx
GetTempPathW
CreateMutexW
GetEnvironmentVariableA
FindClose
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
DeleteFileW
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
DeleteCriticalSection
GetProcessHeap
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
FlushFileBuffers
GetDriveTypeW
AreFileApisANSI
OpenEventW
ReleaseMutex
LockResource
LoadResource
FindResourceW
lstrcmpiW
CreateProcessW
GetACP
GetFileTime
FileTimeToSystemTime
FileTimeToDosDateTime
FindNextFileW
CreateDirectoryW
lstrlenW
SetFileAttributesW
GetCurrentDirectoryW
CopyFileW
SetLastError
FreeLibrary
RaiseException
DecodePointer
GetEnvironmentVariableW
LoadLibraryExW
GetFileSizeEx
DeviceIoControl
GetProcAddress
LoadLibraryW
GetCurrentProcess
GetModuleHandleW
VirtualQuery
GetCommandLineW
OpenMutexW
ReadFile
TryEnterCriticalSection
GetModuleFileNameW
WaitForSingleObject
WriteFile
GetStringTypeW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
CompareStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
GetFileType
PeekNamedPipe
GetStdHandle
ExitProcess
GetTimeZoneInformation
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleCP
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
GetFileInformationByHandle
OpenProcess
CloseHandle
GetCurrentProcessId
GetCurrentThreadId
GetLastError
OpenFileMappingW
CreateFileW
GetTickCount
ResetEvent
InterlockedExchangeAdd
LCMapStringW
GetLocalTime
WideCharToMultiByte
MultiByteToWideChar
GetPrivateProfileStringW
WritePrivateProfileStringW
GetFileSize
SetEndOfFile
SetFilePointer
SetEvent
Sleep
CreateEventW
InitializeCriticalSectionAndSpinCount
user32
MessageBoxW
advapi32
RegEnumKeyExW
GetSecurityDescriptorDacl
GetAclInformation
GetAce
EqualSid
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetFileSecurityW
LookupAccountNameW
SystemFunction036
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyW
RegSetValueW
shell32
SHGetFolderPathW
SHChangeNotify
CommandLineToArgvW
iphlpapi
GetAdaptersAddresses
Exports
Exports
sqlite3_carray_init
sqlite3_csv_init
sqlite3_fileio_init
sqlite3_series_init
sqlite3_shathree_init
sqlite3_uuid_init
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 547KB - Virtual size: 547KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 110KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 89KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE