ec26508ce2f2fe2c922b626d0b14aeb29baf51f4b6edd58f84a36f501721943b

Sharing

Copy URL Twitter E-mail

General

Target

ec26508ce2f2fe2c922b626d0b14aeb29baf51f4b6edd58f84a36f501721943b
Size

115KB
MD5

26ccaaac272c69d12ab52f1fa6780ff9
SHA1

fe3ee6437327e1a8e7bab761a0f540c7c2caa670
SHA256

ec26508ce2f2fe2c922b626d0b14aeb29baf51f4b6edd58f84a36f501721943b
SHA512

b0993aefff751e13fb189ed374c2c101b98a84569df2e9e5445d37017930efae69219e94d5aa11bdf4a4f6203a7df06b9ebf27da8d03e658316b3e3ddb796883
SSDEEP

768:sI8qk4wn5mclMLSTpNW4JcBnd1E9Sbh9Sbxng5o:sIa3lMc3ueCsng5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec26508ce2f2fe2c922b626d0b14aeb29baf51f4b6edd58f84a36f501721943b

Files

ec26508ce2f2fe2c922b626d0b14aeb29baf51f4b6edd58f84a36f501721943b
.exe windows:6 windows x86 arch:x86

1082fdf9c4e9bc23ed96a556154b5d59

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Jenkins\WorkSpace\workspace\Common_TSMonitor(同时生成C++库和Nuget包)\src\TSMonitor\Release\Monitor.pdb

Imports

kernel32

GetLastError
GetLocalTime
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
GetExitCodeProcess
OutputDebugStringW
OpenProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
Sleep
WaitForSingleObject
InitializeCriticalSectionEx
GetEnvironmentVariableW
CreateDirectoryW
IsDebuggerPresent

user32

LoadAcceleratorsW
EndDialog
CreateWindowExW
DestroyWindow
DefWindowProcW
RegisterClassExW
GetMessageW
EndPaint
BeginPaint
UpdateWindow
DialogBoxParamW
PostQuitMessage
LoadIconW
wsprintfW
LoadCursorW
LoadStringW
ShowWindow
DispatchMessageW
TranslateAcceleratorW
TranslateMessage

advapi32

RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

msvcp140

?_Xlength_error@std@@YAXPBD@Z

softwarelog

CreateExportObj
DestroyExportObj

vcruntime140

memcpy
_except_handler4_common
__std_exception_destroy
__std_exception_copy
memset
memmove
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_seh_filter_exe
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
exit
terminate
_controlfp_s
_initialize_onexit_table
_crt_atexit
_cexit
_invalid_parameter_noinfo_noreturn
_beginthreadex

api-ms-win-crt-convert-l1-1-0

wcstol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
_wfopen
__stdio_common_vswprintf
__stdio_common_vsprintf_s
fputws
fflush
_set_fmode
__p__commode
fclose

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1082fdf9c4e9bc23ed96a556154b5d59

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcp140

softwarelog

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 93KB - Virtual size: 93KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 93KB - Virtual size: 93KB

.reloc
Size: 2KB - Virtual size: 1KB