836301b6907b5ae68ecced17351b2dacd9c5829170d60c4b3c5bca1f6c3420fd

Sharing

Copy URL Twitter E-mail

General

Target

836301b6907b5ae68ecced17351b2dacd9c5829170d60c4b3c5bca1f6c3420fd
Size

311KB
MD5

5210bac15e8873eee93ba135576a5aba
SHA1

fd19f37a17b1400682e2fcebd5c5bd6cf801fcf2
SHA256

836301b6907b5ae68ecced17351b2dacd9c5829170d60c4b3c5bca1f6c3420fd
SHA512

e40f55546051c17fd42a2aefa2693cae8c4eb02f3b6f90de8d7e8c3ebbebaab1a8d47caca9d5381f06d2c0f076e7689a0d51d2e74c4034943a35b3664634e45d
SSDEEP

3072:a6X3JRFL4CE7pNenWmxRVRcPG/bcfyd7UNgHiBZRnget1dcAmvrmb5chRHx28WyB:jXtHE/e/VV/bcaCNgCzT0g2oR7xEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
836301b6907b5ae68ecced17351b2dacd9c5829170d60c4b3c5bca1f6c3420fd

Files

836301b6907b5ae68ecced17351b2dacd9c5829170d60c4b3c5bca1f6c3420fd
.exe windows:4 windows x86 arch:x86

378a6957a81dfaa9f4c53415b2c15ae6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\KINGSOFT_DUBA\Build\Build_Src\kisengine_git\1517\product\win32\dbginfo\ksyshelper.pdb

Imports

kernel32

SizeofResource
Sleep
LockResource
CloseHandle
LoadResource
OpenProcess
GetExitCodeThread
GetModuleHandleW
TerminateThread
FindResourceExW
GetProcAddress
GetCurrentProcessId
GetLastError
MultiByteToWideChar
GetCommandLineW
WideCharToMultiByte
WriteFile
ReadFile
WritePrivateProfileStringW
GetFileType
SetHandleCount
SetEnvironmentVariableA
CompareStringW
CompareStringA
InterlockedDecrement
LoadLibraryW
FindResourceW
GetModuleFileNameW
GetSystemDirectoryW
CreateFileA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
LoadLibraryA
SetFilePointer
FlushFileBuffers
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetModuleFileNameA
GetStdHandle
VirtualAlloc
VirtualFree
HeapCreate
GetDateFormatA
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetTimeFormatA
GetTickCount
QueryPerformanceCounter
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
InterlockedIncrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCurrentThreadId
CreateThread
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetOEMCP
IsValidCodePage

user32

GetWindowThreadProcessId
UnregisterClassA
FindWindowExW
PostMessageW
FindWindowW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

ole32

CoUninitialize
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CLSIDFromString
CoInitialize
CoCreateInstance

oleaut32

VariantClear
VarUdateFromDate
VariantInit
SysFreeString
SafeArrayDestroy
VarBstrFromCy
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantChangeType
SysAllocString

shlwapi

PathRemoveFileSpecW
PathAppendW
StrToIntW

psapi

GetModuleFileNameExW

Sections

.text
Size: 184KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

378a6957a81dfaa9f4c53415b2c15ae6

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

psapi

Sections

.text Size: 184KB - Virtual size: 180KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 76KB - Virtual size: 76KB

.text
Size: 184KB - Virtual size: 180KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 76KB - Virtual size: 76KB