115ccc83585b9d17311faa2b76765483c161753967034e20e62b3500c1f2faa1

Sharing

Copy URL Twitter E-mail

General

Target

115ccc83585b9d17311faa2b76765483c161753967034e20e62b3500c1f2faa1
Size

901KB
MD5

922b3b9fdc5f9a804b6083cc63cdbbb8
SHA1

170080ca2636e0759a4b5c4613553938f80e48e7
SHA256

115ccc83585b9d17311faa2b76765483c161753967034e20e62b3500c1f2faa1
SHA512

a4dbea2ffa5a23d11fdd03410de805184f2273ca5af49883d3e199e48458f7bdf5a6429d3d0e424a7b0d040070052b6b33f9fca4b206ab06cf947af43e20d31c
SSDEEP

12288:dOZBy+kvy/lDEMRrle0WZsDvloBANSitPaRQ:d0KvE1FR4SDYfyPcQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
115ccc83585b9d17311faa2b76765483c161753967034e20e62b3500c1f2faa1

Files

115ccc83585b9d17311faa2b76765483c161753967034e20e62b3500c1f2faa1
.exe windows:6 windows x86 arch:x86

94e02c55e06299c067ef46dd9a2c3c26

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\data\landun\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SogouImeBroker.pdb

Imports

kernel32

GetProcAddress
GetModuleHandleW
LoadResource
GetModuleFileNameW
SizeofResource
FreeLibrary
GetSystemDirectoryW
CreateEventW
LoadLibraryExW
WaitForSingleObject
SetEvent
FindResourceW
lstrcmpiW
MultiByteToWideChar
GetCommandLineW
CloseHandle
RaiseException
InitializeCriticalSectionEx
Sleep
CreateThread
GetCurrentThreadId
ReadFile
SetLastError
GetCurrentProcess
WriteFile
CreateFileW
ExitThread
FormatMessageW
GlobalAlloc
GlobalFree
LocalFree
GetFileSize
GetFileAttributesW
SetFileAttributesW
FileTimeToSystemTime
CreateProcessW
GetFileTime
GetTempPathW
LoadLibraryW
GetCurrentProcessId
OpenMutexW
WideCharToMultiByte
FindNextFileW
FindClose
DeleteCriticalSection
HeapFree
LocalAlloc
OutputDebugStringW
HeapAlloc
GetProcessHeap
FlushFileBuffers
CreateMutexW
ReleaseMutex
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
VirtualFree
VirtualAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
VerSetConditionMask
VerifyVersionInfoW
TlsSetValue
TlsGetValue
IsDebuggerPresent
EncodePointer
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
InitializeSListHead
RtlUnwind
TlsAlloc
TlsFree
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
HeapSize
HeapReAlloc
CompareStringW
LCMapStringW
GetFileType
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetConsoleOutputCP
SetEndOfFile
WriteConsoleW
GetEnvironmentVariableW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
DecodePointer

user32

wsprintfW
ToAscii
SendMessageW
GetSystemMetrics
SetRectEmpty
CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
CharUpperW

advapi32

SetSecurityDescriptorSacl
RegSetValueExW
RegQueryInfoKeyW
GetTokenInformation
LookupAccountSidW
OpenProcessToken
RegQueryValueExW
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
AddMandatoryAce
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW

shell32

ShellExecuteW
SHGetFolderPathW
ShellExecuteExW

ole32

CoRevokeClassObject
CoResumeClassObjects
CoUninitialize
CoReleaseServerProcess
CoCreateInstance
StringFromGUID2
CoInitialize
CoRegisterClassObject
CoTaskMemFree
CoTaskMemRealloc
CoAddRefServerProcess
CoTaskMemAlloc

oleaut32

UnRegisterTypeLi
SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysAllocString
RegisterTypeLi

imm32

ImmReSizeIMCC
ImmLockIMCC
ImmLockIMC
ImmUnlockIMC
ImmUnlockIMCC
ImmCreateIMCC
ImmDestroyContext
ImmCreateContext
ImmGetIMCCSize
ImmDisableIME

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 518KB - Virtual size: 518KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

94e02c55e06299c067ef46dd9a2c3c26

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

imm32

version

Sections

.text Size: 518KB - Virtual size: 518KB

.rdata Size: 185KB - Virtual size: 185KB

.data Size: 32KB - Virtual size: 84KB

.rsrc Size: 107KB - Virtual size: 107KB

.reloc Size: 56KB - Virtual size: 56KB

.text
Size: 518KB - Virtual size: 518KB

.rdata
Size: 185KB - Virtual size: 185KB

.data
Size: 32KB - Virtual size: 84KB

.rsrc
Size: 107KB - Virtual size: 107KB

.reloc
Size: 56KB - Virtual size: 56KB