81b24961bd393c8da0f87d11d01b0e5efce29aeb61b1a4d8edebadcd4e7cb65a

Sharing

Copy URL Twitter E-mail

General

Target

81b24961bd393c8da0f87d11d01b0e5efce29aeb61b1a4d8edebadcd4e7cb65a
Size

115KB
MD5

5559f5f4d6d5f3b469785b9fb14c5cc3
SHA1

3a1ac4d3560f1af589f6cb804af198cd4b5be976
SHA256

81b24961bd393c8da0f87d11d01b0e5efce29aeb61b1a4d8edebadcd4e7cb65a
SHA512

bcdcf1f357b1b9d85f086301c351c230367ae829a61e2da7d2f935f54a27a5cd51fd9d9ca9856e58594e1d6891df0cba91bd3f2d73f803f6e59ec914cd799ede
SSDEEP

768:hI8qk4wn5mclMLSTpNWyJcBnd1E9Sbh9SbTZg5o:hIa3lMcBueCqZg5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81b24961bd393c8da0f87d11d01b0e5efce29aeb61b1a4d8edebadcd4e7cb65a

Files

81b24961bd393c8da0f87d11d01b0e5efce29aeb61b1a4d8edebadcd4e7cb65a
.exe windows:6 windows x86 arch:x86

1082fdf9c4e9bc23ed96a556154b5d59

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Jenkins\WorkSpace\workspace\Common_TSMonitor(同时生成C++库和Nuget包)\src\TSMonitor\Release\Monitor.pdb

Imports

kernel32

GetLastError
GetLocalTime
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
GetExitCodeProcess
OutputDebugStringW
OpenProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
Sleep
WaitForSingleObject
InitializeCriticalSectionEx
GetEnvironmentVariableW
CreateDirectoryW
IsDebuggerPresent

user32

LoadAcceleratorsW
EndDialog
CreateWindowExW
DestroyWindow
DefWindowProcW
RegisterClassExW
GetMessageW
EndPaint
BeginPaint
UpdateWindow
DialogBoxParamW
PostQuitMessage
LoadIconW
wsprintfW
LoadCursorW
LoadStringW
ShowWindow
DispatchMessageW
TranslateAcceleratorW
TranslateMessage

advapi32

RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

msvcp140

?_Xlength_error@std@@YAXPBD@Z

softwarelog

CreateExportObj
DestroyExportObj

vcruntime140

memcpy
_except_handler4_common
__std_exception_destroy
__std_exception_copy
memset
memmove
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_seh_filter_exe
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
exit
terminate
_controlfp_s
_initialize_onexit_table
_crt_atexit
_cexit
_invalid_parameter_noinfo_noreturn
_beginthreadex

api-ms-win-crt-convert-l1-1-0

wcstol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
_wfopen
__stdio_common_vswprintf
__stdio_common_vsprintf_s
fputws
fflush
_set_fmode
__p__commode
fclose

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1082fdf9c4e9bc23ed96a556154b5d59

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcp140

softwarelog

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 93KB - Virtual size: 93KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 93KB - Virtual size: 93KB

.reloc
Size: 2KB - Virtual size: 1KB