0b228591bddbfc872bc2cf0ac0ca6dae9bf1843acc8001d43b18b0e9bcfbabab

Sharing

Copy URL Twitter E-mail

General

Target

0b228591bddbfc872bc2cf0ac0ca6dae9bf1843acc8001d43b18b0e9bcfbabab
Size

2.4MB
MD5

b71d29b57f3589b94cbe9055edda3703
SHA1

eec7bbd2f31463418b8f95a6467754f58178b97e
SHA256

0b228591bddbfc872bc2cf0ac0ca6dae9bf1843acc8001d43b18b0e9bcfbabab
SHA512

4dcc366df21715407717b41da8d306284c6177d14bc917e92b981ebd8611638d7ad68c75cbf6d8ab4a03430e8f25e32aecd57bbde9e9901d18b5ef9a45a88a97
SSDEEP

49152:czodJaynV5ONSMkZe3V7T1FTXZOqthgDN/DZ3faT2:czodJayLONS9Ze3V7T1FTXZzmZoS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b228591bddbfc872bc2cf0ac0ca6dae9bf1843acc8001d43b18b0e9bcfbabab

Files

0b228591bddbfc872bc2cf0ac0ca6dae9bf1843acc8001d43b18b0e9bcfbabab
.exe windows:5 windows x86 arch:x86

f55ce6c4d2563a0688f587e36d933428

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\workspace\windows_ads_dev\liyy\easynote\VS2015Truck\MFC\build_temp\Win32\compile\Release\ShortNoteUninstall\ShortNoteUninstall.pdb

Imports

psapi

EnumProcesses
GetModuleBaseNameW
EnumProcessModules

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wininet

InternetCrackUrlW

kernel32

GetACP
ExitProcess
GetStdHandle
QueryPerformanceFrequency
VirtualQuery
VirtualAlloc
GetSystemInfo
HeapQueryInformation
GetFileType
SetStdHandle
GetCommandLineW
GetModuleHandleExW
FreeLibraryAndExitThread
RtlUnwind
GetCPInfo
GetStringTypeW
LCMapStringW
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
WaitForSingleObjectEx
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetDriveTypeW
GetTimeZoneInformation
SetFilePointerEx
GetConsoleCP
GetConsoleMode
GetSystemDirectoryW
WaitForSingleObject
WideCharToMultiByte
MultiByteToWideChar
SizeofResource
FindFirstFileW
InitializeCriticalSectionAndSpinCount
FindClose
LockResource
LoadResource
FindResourceW
GetVersionExW
OpenProcess
CloseHandle
LoadLibraryW
GetProcAddress
GetStartupInfoW
ReadFile
HeapFree
GetCurrentProcess
HeapSize
GetLastError
GlobalAlloc
GlobalFree
HeapReAlloc
RaiseException
HeapAlloc
SearchPathW
GetProfileIntW
GetTempPathW
GetTempFileNameW
VerifyVersionInfoW
VerSetConditionMask
FindResourceExW
lstrcpyW
GetWindowsDirectoryW
VirtualProtect
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetCurrentDirectoryW
SetErrorMode
GetFileTime
GetFileSizeEx
GetFileAttributesExW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GlobalGetAtomNameW
FindNextFileW
DecodePointer
DeleteCriticalSection
FileTimeToLocalFileTime
GlobalFindAtomW
EncodePointer
GetCurrentProcessId
GlobalAddAtomW
GetPrivateProfileIntW
SetThreadPriority
lstrcmpW
GlobalDeleteAtom
GetCurrentThread
lstrcmpA
LoadLibraryA
lstrcmpiW
GetModuleHandleA
DuplicateHandle
OutputDebugStringA
UnlockFile
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
FlushFileBuffers
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
LocalAlloc
LoadLibraryExW
SetLastError
FormatMessageW
MulDiv
LocalFree
GlobalSize
GetFileSize
SetFilePointer
Sleep
ResumeThread
GetCurrentThreadId
ResetEvent
SetEvent
CreateEventW
ExitThread
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
CopyFileW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FreeResource
GlobalUnlock
GlobalLock
CreateThread
WriteFile
CreateFileW
TerminateProcess
GetModuleFileNameW
GetModuleHandleW
GetTickCount
GetProcessHeap

user32

MonitorFromPoint
UpdateLayeredWindow
LockWindowUpdate
SetRect
DrawIcon
FrameRect
CopyIcon
SetCursorPos
IsZoomed
DrawFrameControl
DrawEdge
DrawStateW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetWindowRgn
SetClassLongW
EnumDisplayMonitors
SetLayeredWindowAttributes
NotifyWinEvent
InvertRect
HideCaret
EnableScrollBar
MessageBeep
GetIconInfo
DrawIconEx
DrawFocusRect
GetNextDlgGroupItem
SetParent
GetSystemMenu
UnionRect
MapVirtualKeyW
GetKeyNameTextW
TrackMouseEvent
GetMenuDefaultItem
ReuseDDElParam
UnpackDDElParam
LoadImageW
InsertMenuItemW
CreatePopupMenu
LoadMenuW
TranslateAcceleratorW
LoadAcceleratorsW
BringWindowToTop
IntersectRect
MapDialogRect
GetAsyncKeyState
InflateRect
GetMenuItemInfoW
DestroyMenu
OffsetRect
SendDlgItemMessageA
DestroyIcon
KillTimer
RealChildWindowFromPoint
DeleteMenu
SystemParametersInfoW
CopyImage
WindowFromPoint
WaitMessage
GetSysColorBrush
IsDialogMessageW
SetWindowTextW
CheckDlgButton
MoveWindow
ShowWindow
FillRect
ClientToScreen
ReleaseDC
GetWindowDC
GetComboBoxInfo
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
GetMonitorInfoW
MonitorFromWindow
PostThreadMessageW
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
WinHelpW
GetScrollInfo
SetScrollInfo
GetWindow
GetTopWindow
GetClassNameW
GetClassLongW
EqualRect
GetSysColor
MapWindowPoints
AdjustWindowRectEx
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
UpdateWindow
TrackPopupMenu
SetMenu
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
GetMenu
GetCapture
GetDlgCtrlID
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
CreateMenu
GetWindowRgn
DestroyCursor
GetWindowThreadProcessId
UnregisterClassW
LoadIconW
GetClientRect
SendMessageW
SetTimer
EnableWindow
wsprintfW
IsWindow
GetCursorPos
InvalidateRect
ReleaseCapture
SetWindowLongW
SetCursor
SetCapture
LoadCursorW
SetFocus
ScreenToClient
PostMessageW
CallWindowProcW
DefWindowProcW
GetWindowLongW
SetRectEmpty
IsRectEmpty
CopyRect
PtInRect
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
GetDesktopWindow
CharUpperW
GetSystemMetrics
PostQuitMessage
GetFocus
CheckMenuItem
EnableMenuItem
GetDC
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
GetParent
LoadBitmapW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
SetWindowsHookExW
CallNextHookEx
ShowOwnedPopups
IsWindowEnabled
MessageBoxW
GetLastActivePopup
DestroyWindow
CreateDialogIndirectParamW
EndDialog
GetDlgItem
GetNextDlgTabItem
SetActiveWindow
UnhookWindowsHookEx
RegisterWindowMessageW
GetMessagePos
GetMessageTime
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsMenu
IsChild
SetWindowPos
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsIconic

gdi32

SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetTextAlign
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectW
GetTextExtentPoint32W
GetTextMetricsW
CombineRgn
CreateRectRgnIndirect
PatBlt
SetRectRgn
DPtoLP
EnumFontFamiliesExW
RestoreDC
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CopyMetaFileW
CreateDCW
GetDeviceCaps
CreateBitmap
SetBkColor
SetTextColor
GetObjectW
CreateHatchBrush
CreatePen
CreatePatternBrush
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
Escape
ExcludeClipRect
GetClipBox
SetROP2

msimg32

TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegQueryValueExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
RegDeleteValueW
RegCloseKey
RegSetValueExW

shell32

DragQueryFileW
ShellExecuteW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW
SHAppBarMessage
SHBrowseForFolderW
SHGetDesktopFolder
DragFinish

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathIsUNCW
PathStripToRootW
PathFindExtensionW
PathRemoveFileSpecW
StrFormatKBSizeW
PathFindFileNameW

uxtheme

GetThemeSysColor
GetWindowTheme
IsAppThemed
GetThemePartSize
GetCurrentThemeName
GetThemeColor
CloseThemeData
OpenThemeData
DrawThemeParentBackground
DrawThemeBackground
DrawThemeText
IsThemeBackgroundPartiallyTransparent

ole32

CoDisconnectObject
CoInitializeEx
DoDragDrop
OleGetClipboard
CoLockObjectExternal
RevokeDragDrop
OleLockRunning
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoCreateGuid
ReleaseStgMedium
OleDuplicateData
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance
CoInitialize
RegisterDragDrop

oleaut32

SysAllocStringLen
VariantChangeType
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantCopy
VarBstrFromDate
LoadTypeLi
VariantClear
VariantInit
SysAllocString
SysFreeString

gdiplus

GdipDeleteFontFamily
GdipCreateStringFormat
GdipGetFontSize
GdipGetPathWorldBounds
GdipGetFontStyle
GdipCreatePath
GdipDeletePath
GdipAddPathString
GdipGetFamily
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipSetImageAttributesColorMatrix
GdipBitmapUnlockBits
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipSetInterpolationMode
GdipDrawImageRectI
GdiplusStartup
GdipSetStringFormatAlign
GdiplusShutdown
GdipCreateFromHDC
GdipDeleteGraphics
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipFree
GdipAlloc
GdipCloneImage
GdipDeleteBrush
GdipCreateSolidFill
GdipCloneBrush
GdipFillRectangleI
GdipDrawRectangleI
GdipCreateFontFamilyFromName
GdipDrawImageRectRect
GdipDisposeImageAttributes
GdipCreateFont
GdipSetSolidFillColor
GdipCreateImageAttributes
GdipDrawString
GdipSetImageAttributesWrapMode
GdipSetTextRenderingHint
GdipDeleteStringFormat
GdipDeleteFont
GdipDeletePen
GdipBitmapLockBits
GdipCreatePen1
GdipGetImageWidth
GdipGetImageHeight
GdipDisposeImage

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

netapi32

Netbios

snmpapi

SnmpUtilOidCpy
SnmpUtilOidNCmp
SnmpUtilVarBindFree

ws2_32

__WSAFDIsSet
closesocket
gethostbyname
select
send
socket
connect
recv
htons
WSAGetLastError
WSAStartup

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 373KB - Virtual size: 372KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 22KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 198KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f55ce6c4d2563a0688f587e36d933428

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

version

wininet

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

iphlpapi

netapi32

snmpapi

ws2_32

oleacc

imm32

winmm

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 373KB - Virtual size: 372KB

.data Size: 22KB - Virtual size: 47KB

.gfids Size: 104KB - Virtual size: 104KB

.giats Size: 512B - Virtual size: 16B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 157KB - Virtual size: 156KB

.reloc Size: 198KB - Virtual size: 200KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 373KB - Virtual size: 372KB

.data
Size: 22KB - Virtual size: 47KB

.gfids
Size: 104KB - Virtual size: 104KB

.giats
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 157KB - Virtual size: 156KB

.reloc
Size: 198KB - Virtual size: 200KB