d8ebe994f9c9651f455b49df945ba51b3cb00e572a38d405eccbb7b5ee14c3a0

Sharing

Copy URL Twitter E-mail

General

Target

d8ebe994f9c9651f455b49df945ba51b3cb00e572a38d405eccbb7b5ee14c3a0
Size

1.3MB
MD5

77c4cfacdf53b14cd28ce1e597030966
SHA1

6a91c07e184f282671fb8b7168982475398c9578
SHA256

d8ebe994f9c9651f455b49df945ba51b3cb00e572a38d405eccbb7b5ee14c3a0
SHA512

96fc440e07a3792f89ad75358bb475a8bff94ead2e16a01a353e1219d0d83c529d7923d518355d37b0748cf29579a599a4d624475cad56946a6f8aa67614a5b3
SSDEEP

12288:C5ZZ5Tt4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:aL5R4+mIJz5IcuMlQHJxrDiSi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d8ebe994f9c9651f455b49df945ba51b3cb00e572a38d405eccbb7b5ee14c3a0

Files

d8ebe994f9c9651f455b49df945ba51b3cb00e572a38d405eccbb7b5ee14c3a0
.exe windows:6 windows x64 arch:x64

ee1b9422449a16e7b5b8bd062db4ef9a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\devops_yanfa\agent\workspace\p-e7b3c53a46f54196b0dc8829382a1ea8\src\wes-service\build\pdb\Release\ocl_check.pdb

Imports

uhp

?UHPSetExceptionCallback@@YA?AW4ResultCode@uhp@@PEAXP6AX0W4ExceptionLevel@2@W4ExceptionType@2@@Z@Z
?UHPSetLogCallback@@YA?AW4ResultCode@uhp@@PEAXP6AX0PEBD@Z@Z
UHPLogSetLogLevelThreshold
?UHPGetAdapterInfos@@YA?AV?$vector@UAdapterInfo_@platform@uhp@@V?$allocator@UAdapterInfo_@platform@uhp@@@std@@@std@@XZ

core

?Find@JsonObject@core@@QEAAPEAVJsonMember@2@PEBD@Z
?Add@JsonObject@core@@QEAAAEAVJsonMember@2@PEBD$$T@Z
?Erase@JsonObject@core@@QEAA_NPEBD@Z
?begin@JsonObject@core@@QEBA?AV?$JXIterator@$$CBVJsonMember@core@@@detail@2@XZ
??0JsonDoc@core@@QEAA@XZ
??1JsonDoc@core@@QEAA@XZ
?ParseFile@JsonDoc@core@@QEAAHPEBD@Z
?PrettyDumpFile@JsonDoc@core@@QEBAHPEBD@Z
?PrettyDump@JsonDoc@core@@QEBAHAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?WESCore_Unicode_Uft8@core@@YA_NPEB_WAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1JsonObject@core@@QEAA@XZ
?Clear@JsonValue@core@@QEAAXXZ
??0JsonObject@core@@QEAA@XZ
?PrettyDump@JsonValue@core@@QEBAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?WESCore_UTF8_Unicode@core@@YA_NPEBDAEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?end@JsonObject@core@@QEBA?AV?$JXIterator@$$CBVJsonMember@core@@@detail@2@XZ
?AsInt@JsonValue@core@@QEBAHXZ
?AsUint@JsonValue@core@@QEBAIXZ
?AsString@JsonValue@core@@QEBAPEBDXZ
?Name@JsonMember@core@@QEBAPEBDXZ
?Add@JsonArray@core@@QEAAAEAVJsonElem@2@$$T@Z
?end@JsonArray@core@@QEAA?AV?$JXIterator@VJsonElem@core@@@detail@2@XZ
?begin@JsonArray@core@@QEAA?AV?$JXIterator@VJsonElem@core@@@detail@2@XZ
?MakeEmptyArray@JsonValue@core@@QEAAAEAVJsonArray@2@XZ
?MakeEmptyObject@JsonValue@core@@QEAAAEAVJsonObject@2@XZ
?Set@JsonValue@core@@QEAAAEAVJsonObject@2@AEBV32@@Z
?Set@JsonValue@core@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Get@JsonValue@core@@QEAA_NAEAPEAVJsonObject@2@@Z
?AsArray@JsonValue@core@@QEAAAEAVJsonArray@2@XZ
?AsObject@JsonValue@core@@QEAAAEAVJsonObject@2@XZ
?AsObject@JsonValue@core@@QEBAAEBVJsonObject@2@XZ
?getExecutablePath@core@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ

opencl

clGetPlatformInfo
clReleaseDevice
clGetPlatformIDs
clGetDeviceInfo
clGetDeviceIDs

kernel32

GetModuleHandleW
MultiByteToWideChar
MoveFileW
SetErrorMode
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
GetLastError
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LocalFree

ole32

CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitialize

oleaut32

SysAllocString
VariantClear
SysFreeString

msvcp140

_Cnd_signal
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_wait
_Cnd_destroy
_Cnd_init
_Mtx_unlock
_Mtx_lock
_Mtx_destroy
_Mtx_init
_Thrd_id
_Thrd_sleep
_Thrd_join
_Xtime_get_ticks
_Thrd_start
?_Throw_C_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_do_broadcast_at_thread_exit

vcruntime140

__std_terminate
_set_purecall_handler
__C_specific_handler
__CxxFrameHandler3
memchr
memcmp
memcpy
memmove
memset
_purecall
strchr
__std_exception_copy
__std_exception_destroy
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_exit
__p___argc
_invalid_parameter_noinfo_noreturn
terminate
__p___wargv
_set_invalid_parameter_handler
_c_exit
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
exit
_register_thread_local_exe_atexit_callback

api-ms-win-crt-convert-l1-1-0

wcstombs
_wtoi

api-ms-win-crt-stdio-l1-1-0

fopen_s
__p__commode
__acrt_iob_func
fread
__stdio_common_vsscanf
__stdio_common_vsnprintf_s
fgetc
__stdio_common_vfprintf
fseek
fclose
ferror
ftell
__stdio_common_vsprintf
_set_fmode

api-ms-win-crt-string-l1-1-0

isalpha
strncmp
isdigit
isspace
_wcsicmp
strcmp

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
_set_new_mode
free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ee1b9422449a16e7b5b8bd062db4ef9a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

uhp

core

opencl

kernel32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 80KB - Virtual size: 79KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1.2MB - Virtual size: 1.9MB

.text
Size: 80KB - Virtual size: 79KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1.2MB - Virtual size: 1.9MB