H:\WorkshopAgent\DevelopProj\Code\Oppo\4.72.XXX.1301\UIHelper_4.73.808.1301\Bin\Release\UIHelper32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1c88d2740bbdf9a4dad476154848fe383729c6565d827e21fbef1c6c83983069.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1c88d2740bbdf9a4dad476154848fe383729c6565d827e21fbef1c6c83983069.exe
Resource
win10v2004-20240611-en
General
-
Target
1c88d2740bbdf9a4dad476154848fe383729c6565d827e21fbef1c6c83983069
-
Size
394KB
-
MD5
dacfdba867a319459e37b6120cc8f13c
-
SHA1
e4f91bbcf6821d90566b6b886b1beffc9b8a3fe4
-
SHA256
1c88d2740bbdf9a4dad476154848fe383729c6565d827e21fbef1c6c83983069
-
SHA512
14fa262516311c81cf5e3e98a5d9ae72465f576c5fcd04e8c926690108ea91c86c3ba7e96fbd85de8f76f944a0d66a85ce01a7de2450dd3668b45f3cc41ab908
-
SSDEEP
6144:JwaTkh31pobzeRYB6i6EFgVao1OCMhQJ0Qlhz:JPQpKzGG6EFc7kQJ0ohz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c88d2740bbdf9a4dad476154848fe383729c6565d827e21fbef1c6c83983069
Files
-
1c88d2740bbdf9a4dad476154848fe383729c6565d827e21fbef1c6c83983069.exe windows:6 windows x86 arch:x86
ee8294a8e3b7dfca25e1d88154586186
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WaitForSingleObject
OpenEventW
GetVersionExW
ReleaseMutex
CreateEventW
Sleep
SetEvent
ResetEvent
CreateSemaphoreW
OpenMutexW
ReadFile
CancelIo
SetNamedPipeHandleState
CreateNamedPipeW
GetOverlappedResult
WaitNamedPipeW
CreateMutexW
IsBadReadPtr
ReleaseSemaphore
MultiByteToWideChar
LoadLibraryW
FreeLibrary
GetCommandLineW
LocalFree
SizeofResource
GetUserDefaultUILanguage
LockResource
LoadResource
FindResourceW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WaitForMultipleObjects
GetLastError
GetCurrentThreadId
AllocConsole
WriteConsoleW
FreeConsole
CloseHandle
OutputDebugStringW
CreateFileW
SetFilePointer
WriteFile
GetStdHandle
GetModuleHandleW
GetProcAddress
GetTickCount
GetModuleFileNameW
GetCurrentProcessId
ConnectNamedPipe
DecodePointer
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
FindResourceExW
GetACP
lstrlenW
TerminateThread
ResumeThread
SetThreadPriority
CreateThread
GetExitCodeThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetSystemInfo
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
LoadLibraryA
EncodePointer
RtlUnwind
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
SetLastError
VirtualQuery
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetFileType
LCMapStringW
GetStringTypeW
FindClose
FindFirstFileExW
GetLocalTime
user32
DefWindowProcW
PostMessageW
PostThreadMessageW
MessageBoxW
GetSystemMetrics
advapi32
SetSecurityDescriptorDacl
GetAce
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
RegOpenKeyExW
RegCloseKey
RegCreateKeyW
RegOpenKeyW
RegQueryValueExW
shell32
CommandLineToArgvW
ws2_32
getpeername
getsockname
send
socket
ntohs
connect
closesocket
WSAIoctl
recvfrom
WSAStartup
getsockopt
htonl
htons
sendto
setsockopt
WSAGetLastError
listen
shutdown
bind
accept
WSACleanup
recv
ntohl
Sections
.text Size: 177KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TLCONFIG Size: 1024B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ