1e5031c6336d4660f097a4e157786460c0b391b3c6c0879c9419e63b3263eedb

Sharing

Copy URL

Twitter E-mail

General

Target

1e5031c6336d4660f097a4e157786460c0b391b3c6c0879c9419e63b3263eedb
Size

14.8MB
MD5

e3c6788ae1436096962021a11789a884
SHA1

7e764119babee087d54f6af6be78d2765e021a00
SHA256

1e5031c6336d4660f097a4e157786460c0b391b3c6c0879c9419e63b3263eedb
SHA512

525b8bbad65961c4d689e7b8e9a5fd88c49099e7468001aa801b1f06c26ce4dfcc433e283a75ba555c69601305d3eb4f122269f4f6e7a7752d9b76740de6f473
SSDEEP

393216:+a++0B4FT2GSgKuio/OCFT6db2GJSV3DkhgLW:+aB0G9KhCZ6pgVzDLW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1e5031c6336d4660f097a4e157786460c0b391b3c6c0879c9419e63b3263eedb

Files

1e5031c6336d4660f097a4e157786460c0b391b3c6c0879c9419e63b3263eedb
.exe windows:5 windows x86 arch:x86

f2d9e8e24991c40d3a4c8dac0c1f0036

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\code\yebaoinstall\outputdd\DDInstall.pdb

Imports

ws2_32

setsockopt
ntohs
htons
socket
getsockname
getpeername
connect
bind
WSAGetLastError
closesocket
recv
WSASetLastError
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
shutdown
getnameinfo
getaddrinfo
freeaddrinfo
WSACleanup
recvfrom
sendto
ntohl
getsockopt
gethostbyname
select
WSAStringToAddressW
WSAStartup
inet_addr
send
WSAAddressToStringW
inet_ntoa
WSAIoctl
gethostname

kernel32

GetEnvironmentVariableW
DeviceIoControl
TerminateProcess
RemoveDirectoryW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
CreatePipe
GetTempPathW
FindClose
WaitForSingleObject
CreateFileW
GetCurrentThreadId
GetVersionExW
GetSystemDirectoryW
FreeResource
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
GetFileAttributesExW
Process32NextW
GetDiskFreeSpaceExW
LockResource
DeleteFileW
Process32FirstW
CloseHandle
SetEndOfFile
WriteConsoleW
GetFullPathNameA
GetCurrentDirectoryW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
HeapSize
SetConsoleCtrlHandler
SetStdHandle
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetTimeZoneInformation
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetACP
GetModuleFileNameA
ExitProcess
HeapReAlloc
GetModuleHandleExW
ResumeThread
ExitThread
RtlUnwind
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
SetProcessAffinityMask
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
FormatMessageA
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetStdHandle
GetEnvironmentVariableA
CompareFileTime
MoveFileExA
VerifyVersionInfoW
VerSetConditionMask
SleepEx
SetFilePointer
GetFileSize
SetFileAttributesW
SetFileTime
GlobalUnlock
GlobalLock
GlobalFree
CreateMutexW
IsBadReadPtr
GetModuleHandleA
LoadLibraryA
GetVersionExA
GetLocalTime
GetTickCount
MulDiv
GetFullPathNameW
SetLastError
GetFileAttributesW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
HeapDestroy
HeapCreate
FlushInstructionCache
MultiByteToWideChar
InterlockedIncrement
WideCharToMultiByte
OutputDebugStringW
InterlockedDecrement
OutputDebugStringA
GetProcessTimes
MoveFileW
GetSystemTime
GetTempFileNameW
CopyFileW
FreeLibrary
GetModuleHandleW
GlobalAlloc
LocalFree
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
SetEvent
IsDebuggerPresent
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ConvertThreadToFiber
CreateEventW
QueryPerformanceFrequency
QueryPerformanceCounter
EncodePointer
GetStringTypeW
GetNativeSystemInfo
GetExitCodeThread
GetCurrentThread
WaitForSingleObjectEx
DuplicateHandle
TryEnterCriticalSection
FormatMessageW
RaiseException
LoadLibraryW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
SetCurrentDirectoryW
CreateProcessW
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcess
FindNextFileW
HeapFree
FindFirstFileW
SizeofResource
ReadFile
GetCurrentProcessId
DeleteCriticalSection
MoveFileExW
GetProcAddress
GetStartupInfoW
CreateDirectoryW
RtlCaptureStackBackTrace
lstrlenA
WriteFile
ReadConsoleA
SetConsoleMode
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread

user32

DestroyCursor
InvertRect
FillRect
EqualRect
PostQuitMessage
EnableWindow
IsWindowEnabled
SetActiveWindow
GetDesktopWindow
CharNextW
DestroyIcon
GetIconInfo
TrackMouseEvent
AnimateWindow
SetLayeredWindowAttributes
IsIconic
IsZoomed
GetCapture
SetCapture
ReleaseCapture
UpdateWindow
GetDC
PtInRect
IsWindow
IsRectEmpty
OffsetRect
IntersectRect
InflateRect
SetFocus
DrawIconEx
UnionRect
EndPaint
InvalidateRect
SetWindowTextW
GetCursorPos
CreateCaret
GetCaretBlinkTime
HideCaret
SetCaretPos
ScreenToClient
GetClassNameW
LoadBitmapW
CreateIconFromResource
LoadImageW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
ClientToScreen
EnableMenuItem
SetRect
KillTimer
SetTimer
SetCursor
GetKeyState
BeginPaint
GetFocus
CopyRect
GetMonitorInfoW
MonitorFromWindow
LoadCursorW
GetWindow
GetProcessWindowStation
GetUserObjectInformationW
GetSysColor
GetSystemMetrics
MessageBoxW
LoadIconW
GetWindowPlacement
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
GetParent
SetWindowLongW
GetWindowLongW
MapWindowPoints
GetWindowRect
ReleaseDC
SetForegroundWindow
GetClientRect
EnumWindows
GetForegroundWindow
ShowWindow
UnregisterClassW
GetPropW
SetWindowPos
GetWindowThreadProcessId
SendMessageW
DestroyWindow
PostMessageW
GetActiveWindow
LoadStringA
LoadStringW
DefWindowProcW
CallWindowProcW
RegisterClassExW
CreateWindowExW
GetDlgItem
wsprintfW
MsgWaitForMultipleObjects
SetMenuContextHelpId
GetMenuItemInfoW
SetMenuInfo
GetMenuInfo
TrackPopupMenu
DeleteMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
CheckMenuItem
DestroyMenu
CreatePopupMenu
IsMenu
UpdateLayeredWindow
MapVirtualKeyA

gdi32

Arc
Ellipse
CreateEllipticRgnIndirect
BitBlt
EnumFontsW
DeleteObject
CreateRoundRectRgn
CreateBitmap
CreateCompatibleDC
DeleteDC
ExcludeClipRect
GetClipRgn
GetRgnBox
CreatePen
GetTextExtentPoint32W
IntersectClipRect
OffsetRgn
Pie
PtInRegion
RectInRegion
RestoreDC
RoundRect
SaveDC
ExtSelectClipRgn
SetRectRgn
SetROP2
SetTextColor
GetWorldTransform
SetWorldTransform
CreateDIBSection
ExtCreatePen
Polyline
GetCurrentObject
GetViewportOrgEx
CreatePatternBrush
CreateRectRgn
GetTextColor
CreateRectRgnIndirect
CombineRgn
SetViewportOrgEx
CreateCompatibleBitmap
StretchBlt
GetDCOrgEx
GetObjectW
SetBkMode
Rectangle
GetStockObject
GetClipBox
CreateSolidBrush
CreateFontIndirectW
SetGraphicsMode
GetDeviceCaps
SelectObject

advapi32

CryptEnumProvidersW
CryptSignHashW
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptGenRandom
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegEnumValueW
RegOpenKeyW
OpenServiceW
RegDeleteValueW
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExW
RegEnumKeyExW
ControlService
DeleteService
RegCreateKeyExW
RegDeleteKeyW
OpenSCManagerW
CloseServiceHandle
RegQueryInfoKeyW
RegCloseKey
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptDeriveKey
CryptCreateHash
CryptDecrypt
CryptEncrypt
QueryServiceStatus
CryptAcquireContextW
CryptGetKeyParam
CryptDestroyKey
RegQueryValueExW

shell32

SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
SHFileOperationW

ole32

CreateBindCtx
CLSIDFromProgID
CLSIDFromString
OleLockRunning
OleInitialize
OleUninitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoCreateGuid
CoInitialize
CreateStreamOnHGlobal

oleaut32

SysStringLen
VariantClear
SysFreeString
GetErrorInfo
VariantInit
CreateErrorInfo
SetErrorInfo
VariantChangeType
SysAllocString

shlwapi

StrCmpW
StrRChrW
PathIsDirectoryW
StrToIntExW
PathRemoveFileSpecW
PathCanonicalizeW
PathFindFileNameW
PathRemoveExtensionW
PathFileExistsW

netapi32

Netbios
NetApiBufferFree
NetWkstaGetInfo

iphlpapi

GetAdaptersInfo
GetIpForwardTable

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetSetOptionW

imm32

ImmAssociateContext
ImmGetContext
ImmReleaseContext

winhttp

WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpCrackUrl
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpAddRequestHeaders

gdiplus

GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipAlloc
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree

msimg32

GradientFill
AlphaBlend

crypt32

CertGetCertificateContextProperty
CertFindCertificateInStore
CertOpenStore
CertDuplicateCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage

wldap32

ord73
ord216
ord14
ord46
ord219
ord208
ord301
ord147
ord133
ord79
ord142
ord145
ord41
ord167
ord127
ord27
ord117
ord26

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 876KB - Virtual size: 876KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57.4MB - Virtual size: 57.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2d9e8e24991c40d3a4c8dac0c1f0036

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

netapi32

iphlpapi

version

wininet

imm32

winhttp

gdiplus

msimg32

crypt32

wldap32

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 876KB - Virtual size: 876KB

.data Size: 54KB - Virtual size: 147KB

.gfids Size: 6KB - Virtual size: 5KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 57.4MB - Virtual size: 57.4MB

.reloc Size: 176KB - Virtual size: 176KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 876KB - Virtual size: 876KB

.data
Size: 54KB - Virtual size: 147KB

.gfids
Size: 6KB - Virtual size: 5KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 57.4MB - Virtual size: 57.4MB

.reloc
Size: 176KB - Virtual size: 176KB