ce6ebb449e1cedbd5037446e70bf9976cb513b5729cf0ef4fb5f6a31087e527c

Sharing

Copy URL Twitter E-mail

General

Target

ce6ebb449e1cedbd5037446e70bf9976cb513b5729cf0ef4fb5f6a31087e527c
Size

115KB
MD5

9cb030c3090aae2a78c39d33ca9a9078
SHA1

66877d30d8041e3d110b7cb2b9bb7698b1f547c4
SHA256

ce6ebb449e1cedbd5037446e70bf9976cb513b5729cf0ef4fb5f6a31087e527c
SHA512

ed3b0a0c854d2e994663874fa0339fc0eefd652ccb62538e14010b681268b629c61d01ce8a56fff53edad4f6b55c3e90ce10090c593809c37872ab7a7678b18e
SSDEEP

768:EI8qk4wn5mclMLSTpNWpJcBnd1E9Sbh9SbXsg5o:EIa3lMcQueCmsg5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce6ebb449e1cedbd5037446e70bf9976cb513b5729cf0ef4fb5f6a31087e527c

Files

ce6ebb449e1cedbd5037446e70bf9976cb513b5729cf0ef4fb5f6a31087e527c
.exe windows:6 windows x86 arch:x86

1082fdf9c4e9bc23ed96a556154b5d59

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Jenkins\WorkSpace\workspace\Common_TSMonitor(同时生成C++库和Nuget包)\src\TSMonitor\Release\Monitor.pdb

Imports

kernel32

GetLastError
GetLocalTime
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
GetExitCodeProcess
OutputDebugStringW
OpenProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
Sleep
WaitForSingleObject
InitializeCriticalSectionEx
GetEnvironmentVariableW
CreateDirectoryW
IsDebuggerPresent

user32

LoadAcceleratorsW
EndDialog
CreateWindowExW
DestroyWindow
DefWindowProcW
RegisterClassExW
GetMessageW
EndPaint
BeginPaint
UpdateWindow
DialogBoxParamW
PostQuitMessage
LoadIconW
wsprintfW
LoadCursorW
LoadStringW
ShowWindow
DispatchMessageW
TranslateAcceleratorW
TranslateMessage

advapi32

RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

msvcp140

?_Xlength_error@std@@YAXPBD@Z

softwarelog

CreateExportObj
DestroyExportObj

vcruntime140

memcpy
_except_handler4_common
__std_exception_destroy
__std_exception_copy
memset
memmove
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_seh_filter_exe
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
exit
terminate
_controlfp_s
_initialize_onexit_table
_crt_atexit
_cexit
_invalid_parameter_noinfo_noreturn
_beginthreadex

api-ms-win-crt-convert-l1-1-0

wcstol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
_wfopen
__stdio_common_vswprintf
__stdio_common_vsprintf_s
fputws
fflush
_set_fmode
__p__commode
fclose

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1082fdf9c4e9bc23ed96a556154b5d59

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcp140

softwarelog

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 93KB - Virtual size: 93KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 93KB - Virtual size: 93KB

.reloc
Size: 2KB - Virtual size: 1KB