9b84412bc39144d5102fab8f9375e2df38826b71a66fffe01060b27a2406f878

Sharing

Copy URL Twitter E-mail

General

Target

9b84412bc39144d5102fab8f9375e2df38826b71a66fffe01060b27a2406f878
Size

1.5MB
MD5

d18131766303c75d74a9069b88d7ff98
SHA1

98960d538509308b1151bf6fe78f421f17d93874
SHA256

9b84412bc39144d5102fab8f9375e2df38826b71a66fffe01060b27a2406f878
SHA512

48c1d14d35a4c3b653f1386470ad80a58f0d933eabe72ec6731ff3db80f905c1645b53986f768563882e8c27cce13e9aa0e41834caead52e1973cbab13170949
SSDEEP

24576:k185z4WzAHatRvt5trni89FJB94Wr6pITV1WF3oa1lKTsmB/rr0mdwEHLyik5JI4:k1Whhh5zVHT6WrrV1WFx1lKhdwEryikI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b84412bc39144d5102fab8f9375e2df38826b71a66fffe01060b27a2406f878

Files

9b84412bc39144d5102fab8f9375e2df38826b71a66fffe01060b27a2406f878
.exe windows:5 windows x86 arch:x86

88de434c22f2e8c9c64305c194d3f5b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\rc_v11_personal_20200512_branch\Build\Release\WPSOffice\office6\wpscloudsvr.pdb

Imports

kernel32

GetModuleFileNameW
CloseHandle
TerminateProcess
OpenProcess
Process32NextW
Process32FirstW
GetCurrentProcessId
CreateToolhelp32Snapshot
GetLastError
Sleep
GetCurrentThreadId
FreeLibrary
GetProcAddress
LoadLibraryA
GetCommandLineW
EnterCriticalSection
LeaveCriticalSection
UnregisterWaitEx
InterlockedDecrement
WaitForMultipleObjects
DeleteFileW
InitializeCriticalSection
QueueUserWorkItem
InterlockedIncrement
WaitForSingleObject
DeleteCriticalSection
CreateThread
LocalFree
GetStartupInfoW
GetModuleHandleW
GetTickCount
GetTempPathW
CopyFileW
LoadLibraryW
SetDllDirectoryW
GetDllDirectoryW
DisconnectNamedPipe
ConnectNamedPipe
FlushFileBuffers
ReadFile
CreateIoCompletionPort
CreateNamedPipeW
WriteFile
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetOverlappedResult
CancelIo
InterlockedExchange
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
GetExitCodeProcess
GetVersionExW
LocalAlloc
GetCurrentProcess
GetPrivateProfileIntW
GetSystemDirectoryW
GetSystemWow64DirectoryW
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
CreateProcessW
GetProcessId
SetUnhandledExceptionFilter
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
OutputDebugStringW
VerifyVersionInfoW
VerSetConditionMask
SetEvent
CreateEventW
VirtualAlloc
VirtualFree
GetFileAttributesExW
GetSystemInfo
LoadLibraryExW
RaiseException
SetFilePointerEx
GetFileSizeEx
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
CompareFileTime
GetFileAttributesW
SystemTimeToTzSpecificLocalTime
FindClose
FindFirstFileW
CreateDirectoryW
FindNextFileW
ExpandEnvironmentStringsW
GetCurrentThread
ProcessIdToSessionId
GetCompressedFileSizeW
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
FlushViewOfFile
InterlockedCompareExchange
GetProcessHeap
OutputDebugStringA
WaitForSingleObjectEx
UnmapViewOfFile
UnlockFileEx
UnlockFile
SetFilePointer
SetEndOfFile
QueryPerformanceCounter
MapViewOfFile
LockFileEx
LockFile
HeapCompact
HeapValidate
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVersionExA
GetTempPathA
GetSystemTimeAsFileTime
GetFullPathNameW
GetFullPathNameA
GetFileSize
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
FormatMessageW
FormatMessageA
DeleteFileA
CreateMutexW
CreateFileMappingW
CreateFileMappingA
CreateFileA
AreFileApisANSI
TryEnterCriticalSection
GetStringTypeW
EncodePointer
DecodePointer
HeapSetInformation
RtlUnwind
SetConsoleCtrlHandler
UnhandledExceptionFilter
IsDebuggerPresent
ExitThread
LCMapStringW
GetCPInfo
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
IsProcessorFeaturePresent
SetEnvironmentVariableA
SetEnvironmentVariableW
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CompareStringW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW

Exports

Exports

GetHostInterface

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 28KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 161KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

88de434c22f2e8c9c64305c194d3f5b9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 201KB - Virtual size: 200KB

.data Size: 28KB - Virtual size: 56KB

.rsrc Size: 19KB - Virtual size: 18KB

.reloc Size: 161KB - Virtual size: 164KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 201KB - Virtual size: 200KB

.data
Size: 28KB - Virtual size: 56KB

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 161KB - Virtual size: 164KB