d:\svnroot\kuaizip\trunk\bin\Release\X86\UpdateChecker.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2b5e3fc054e2d3fa22b038fa117f43e0N.exe
Resource
win7-20240704-en
General
-
Target
2b5e3fc054e2d3fa22b038fa117f43e0N.exe
-
Size
642KB
-
MD5
2b5e3fc054e2d3fa22b038fa117f43e0
-
SHA1
deb64b81a60b6946bb673dc0655d9017387ea270
-
SHA256
0298b8b6e5b552ae5b66cc60312a3aba1fb917a75be1e73936752fbdd0a1d122
-
SHA512
78b7698dd22cd1d2e62db7fa23df03abfbf3ae5992806e053f1e55f017b5c49630cd40e0dd5ce6c40748d7d97f7c31e464ad0f2bcd0c4a1bb3a229b36a797436
-
SSDEEP
12288:FFRQwbvVA2cBSRZ1ge5rmq+9STkuw9/aULjIaw0vaA:bB1Eg+9IkuCpjAo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b5e3fc054e2d3fa22b038fa117f43e0N.exe
Files
-
2b5e3fc054e2d3fa22b038fa117f43e0N.exe.exe windows:5 windows x86 arch:x86
799329a90fe59c79f2ccdca96a295070
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
MoveFileA
ExitThread
CreateThread
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
FindClose
GetDriveTypeA
FindFirstFileA
GetModuleHandleA
GetFullPathNameA
GetCurrentDirectoryA
CreateMutexW
GetLocalTime
GetLastError
CloseHandle
CreateProcessA
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
HeapFree
HeapAlloc
WideCharToMultiByte
GetTimeZoneInformation
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetProcAddress
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
ReadFile
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapSize
VirtualAlloc
HeapReAlloc
SetFilePointer
FreeLibrary
LoadLibraryA
InitializeCriticalSectionAndSpinCount
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
FlushFileBuffers
CreateFileW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
SetEnvironmentVariableA
DeleteFileA
MoveFileExA
CreateToolhelp32Snapshot
Process32FirstW
lstrcmpiA
Process32NextW
ExpandEnvironmentStringsA
InitializeCriticalSection
SleepEx
VerifyVersionInfoA
VerSetConditionMask
WaitForSingleObject
FormatMessageA
PeekNamedPipe
WaitForMultipleObjects
LoadLibraryW
GetModuleHandleExW
GetModuleFileNameW
GetStartupInfoA
GetTempPathA
shlwapi
PathFileExistsW
PathStripPathA
StrStrIA
PathFileExistsA
imagehlp
MakeSureDirectoryPathExists
ws2_32
closesocket
getpeername
getsockopt
socket
bind
ntohs
getsockname
setsockopt
WSAIoctl
connect
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
listen
ioctlsocket
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
gethostname
htons
user32
WindowFromPoint
GetSystemMetrics
advapi32
CryptReleaseContext
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptDestroyHash
CryptAcquireContextW
RegCloseKey
RegOpenKeyExW
RegOpenCurrentUser
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
CryptDestroyKey
CryptEncrypt
CryptAcquireContextA
CryptImportKey
shell32
ShellExecuteA
Sections
.text Size: 414KB - Virtual size: 414KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 96KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE