1c88d2740bbdf9a4dad476154848fe383729c6565d827e21fbef1c6c83983069

Sharing

Copy URL Twitter E-mail

General

Target

1c88d2740bbdf9a4dad476154848fe383729c6565d827e21fbef1c6c83983069
Size

394KB
MD5

dacfdba867a319459e37b6120cc8f13c
SHA1

e4f91bbcf6821d90566b6b886b1beffc9b8a3fe4
SHA256

1c88d2740bbdf9a4dad476154848fe383729c6565d827e21fbef1c6c83983069
SHA512

14fa262516311c81cf5e3e98a5d9ae72465f576c5fcd04e8c926690108ea91c86c3ba7e96fbd85de8f76f944a0d66a85ce01a7de2450dd3668b45f3cc41ab908
SSDEEP

6144:JwaTkh31pobzeRYB6i6EFgVao1OCMhQJ0Qlhz:JPQpKzGG6EFc7kQJ0ohz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c88d2740bbdf9a4dad476154848fe383729c6565d827e21fbef1c6c83983069

Files

1c88d2740bbdf9a4dad476154848fe383729c6565d827e21fbef1c6c83983069
.exe windows:6 windows x86 arch:x86

ee8294a8e3b7dfca25e1d88154586186

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\WorkshopAgent\DevelopProj\Code\Oppo\4.72.XXX.1301\UIHelper_4.73.808.1301\Bin\Release\UIHelper32.pdb

Imports

kernel32

WaitForSingleObject
OpenEventW
GetVersionExW
ReleaseMutex
CreateEventW
Sleep
SetEvent
ResetEvent
CreateSemaphoreW
OpenMutexW
ReadFile
CancelIo
SetNamedPipeHandleState
CreateNamedPipeW
GetOverlappedResult
WaitNamedPipeW
CreateMutexW
IsBadReadPtr
ReleaseSemaphore
MultiByteToWideChar
LoadLibraryW
FreeLibrary
GetCommandLineW
LocalFree
SizeofResource
GetUserDefaultUILanguage
LockResource
LoadResource
FindResourceW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WaitForMultipleObjects
GetLastError
GetCurrentThreadId
AllocConsole
WriteConsoleW
FreeConsole
CloseHandle
OutputDebugStringW
CreateFileW
SetFilePointer
WriteFile
GetStdHandle
GetModuleHandleW
GetProcAddress
GetTickCount
GetModuleFileNameW
GetCurrentProcessId
ConnectNamedPipe
DecodePointer
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
FindResourceExW
GetACP
lstrlenW
TerminateThread
ResumeThread
SetThreadPriority
CreateThread
GetExitCodeThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetSystemInfo
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
LoadLibraryA
EncodePointer
RtlUnwind
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
SetLastError
VirtualQuery
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetFileType
LCMapStringW
GetStringTypeW
FindClose
FindFirstFileExW
GetLocalTime

user32

DefWindowProcW
PostMessageW
PostThreadMessageW
MessageBoxW
GetSystemMetrics

advapi32

SetSecurityDescriptorDacl
GetAce
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
RegOpenKeyExW
RegCloseKey
RegCreateKeyW
RegOpenKeyW
RegQueryValueExW

shell32

CommandLineToArgvW

ws2_32

getpeername
getsockname
send
socket
ntohs
connect
closesocket
WSAIoctl
recvfrom
WSAStartup
getsockopt
htonl
htons
sendto
setsockopt
WSAGetLastError
listen
shutdown
bind
accept
WSACleanup
recv
ntohl

Sections

.text
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

TLCONFIG
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee8294a8e3b7dfca25e1d88154586186

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ws2_32

Sections

.text Size: 177KB - Virtual size: 176KB

.rdata Size: 85KB - Virtual size: 84KB

.data Size: 11KB - Virtual size: 19KB

.gfids Size: 512B - Virtual size: 316B

.tls Size: 512B - Virtual size: 9B

TLCONFIG Size: 1024B - Virtual size: 536B

.rsrc Size: 105KB - Virtual size: 105KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 177KB - Virtual size: 176KB

.rdata
Size: 85KB - Virtual size: 84KB

.data
Size: 11KB - Virtual size: 19KB

.gfids
Size: 512B - Virtual size: 316B

.tls
Size: 512B - Virtual size: 9B

TLCONFIG
Size: 1024B - Virtual size: 536B

.rsrc
Size: 105KB - Virtual size: 105KB

.reloc
Size: 12KB - Virtual size: 12KB