5217ac4b28e139ba3570ae9e893cd1783750936a36d9b94a232d01b2d4905d82

Sharing

Copy URL Twitter E-mail

General

Target

5217ac4b28e139ba3570ae9e893cd1783750936a36d9b94a232d01b2d4905d82
Size

558KB
MD5

5c1baab203c67e6ad2e2a73600bdcc2e
SHA1

6dba3f02818788dd9e6c86363eb45f2aade26dd8
SHA256

5217ac4b28e139ba3570ae9e893cd1783750936a36d9b94a232d01b2d4905d82
SHA512

c73899f20746c46be6065473f88813da5362c2566135abd882cb4c74550a2001e011e398dee46cf3c63e27384ab18068861eb7132f4892af624504be48dfba22
SSDEEP

6144:GIwlEiVTjN+qyQZ+vCrYzLw9ePh51hJ2/Sr4Jxr4J:GIYNYQX8hK62

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5217ac4b28e139ba3570ae9e893cd1783750936a36d9b94a232d01b2d4905d82

Files

5217ac4b28e139ba3570ae9e893cd1783750936a36d9b94a232d01b2d4905d82
.exe windows:6 windows x64 arch:x64

f00ef176b3b2b0cc7f7abe6397bf1d88

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\work\工具项目\加壳工具\x64\CLRHost64.pdb

Imports

kernel32

GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
SetEndOfFile
CreateFileW
GetStringTypeW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
VirtualQuery
WriteConsoleW
FlushFileBuffers
SetStdHandle
OutputDebugStringW
HeapReAlloc
GetCPInfo
GetLastError
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
LocalFree
lstrlenW
EncodePointer
DecodePointer
HeapFree
HeapAlloc
ReadFile
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
RtlPcToFileHeader
RaiseException
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
HeapSize
GetProcessHeap
GetStdHandle
WriteFile
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
CloseHandle
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetConsoleCP
LoadLibraryExW
SetLastError
GetCurrentThread
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
CreateSemaphoreW
FatalAppExitA
SetConsoleCtrlHandler
FreeLibrary
IsValidCodePage
GetACP
GetOEMCP

user32

MessageBoxW

shell32

ShellExecuteW

ole32

CoInitializeEx

oleaut32

SysAllocString
SetErrorInfo
VariantClear
VariantInit
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
SysFreeString
CreateErrorInfo
VariantChangeType
GetErrorInfo

mscoree

CLRCreateInstance

Sections

.text
Size: 262KB - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f00ef176b3b2b0cc7f7abe6397bf1d88

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

ole32

oleaut32

mscoree

Sections

.text Size: 262KB - Virtual size: 261KB

.rdata Size: 72KB - Virtual size: 71KB

.data Size: 8KB - Virtual size: 18KB

.pdata Size: 11KB - Virtual size: 11KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 194KB - Virtual size: 193KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 262KB - Virtual size: 261KB

.rdata
Size: 72KB - Virtual size: 71KB

.data
Size: 8KB - Virtual size: 18KB

.pdata
Size: 11KB - Virtual size: 11KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 194KB - Virtual size: 193KB

.reloc
Size: 4KB - Virtual size: 3KB