798a88adc6c96dbcedbd779bedca74baa0e7dab0bffa3b222a2c90d59aef22ac

Sharing

Copy URL Twitter E-mail

General

Target

798a88adc6c96dbcedbd779bedca74baa0e7dab0bffa3b222a2c90d59aef22ac
Size

115KB
MD5

5b13811d8df05981753055041be665c9
SHA1

0c099341515ba055d7eeaf77e1630a8d793803c0
SHA256

798a88adc6c96dbcedbd779bedca74baa0e7dab0bffa3b222a2c90d59aef22ac
SHA512

9f0eb29345504f37219eddc953805e6c3fd557bf61f5e634fa7aaba2f79478d5e6f52c29328e43d0c33f2a8c51db32421ebf6c998f3e740f4d59f3387f65fee3
SSDEEP

768:AI8qk4wn5mclMLSTpNWyJcBnd1E9Sbh9SbTZg5o:AIa3lMcBueCqZg5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
798a88adc6c96dbcedbd779bedca74baa0e7dab0bffa3b222a2c90d59aef22ac

Files

798a88adc6c96dbcedbd779bedca74baa0e7dab0bffa3b222a2c90d59aef22ac
.exe windows:6 windows x86 arch:x86

1082fdf9c4e9bc23ed96a556154b5d59

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Jenkins\WorkSpace\workspace\Common_TSMonitor(同时生成C++库和Nuget包)\src\TSMonitor\Release\Monitor.pdb

Imports

kernel32

GetLastError
GetLocalTime
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
GetExitCodeProcess
OutputDebugStringW
OpenProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
Sleep
WaitForSingleObject
InitializeCriticalSectionEx
GetEnvironmentVariableW
CreateDirectoryW
IsDebuggerPresent

user32

LoadAcceleratorsW
EndDialog
CreateWindowExW
DestroyWindow
DefWindowProcW
RegisterClassExW
GetMessageW
EndPaint
BeginPaint
UpdateWindow
DialogBoxParamW
PostQuitMessage
LoadIconW
wsprintfW
LoadCursorW
LoadStringW
ShowWindow
DispatchMessageW
TranslateAcceleratorW
TranslateMessage

advapi32

RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

msvcp140

?_Xlength_error@std@@YAXPBD@Z

softwarelog

CreateExportObj
DestroyExportObj

vcruntime140

memcpy
_except_handler4_common
__std_exception_destroy
__std_exception_copy
memset
memmove
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_seh_filter_exe
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
exit
terminate
_controlfp_s
_initialize_onexit_table
_crt_atexit
_cexit
_invalid_parameter_noinfo_noreturn
_beginthreadex

api-ms-win-crt-convert-l1-1-0

wcstol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
_wfopen
__stdio_common_vswprintf
__stdio_common_vsprintf_s
fputws
fflush
_set_fmode
__p__commode
fclose

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1082fdf9c4e9bc23ed96a556154b5d59

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcp140

softwarelog

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 93KB - Virtual size: 93KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 93KB - Virtual size: 93KB

.reloc
Size: 2KB - Virtual size: 1KB