8fc095cc1bdd1a1fadbf17593beb838629fc8f023c099fea17de360fee313011

Sharing

Copy URL

Twitter E-mail

General

Target

8fc095cc1bdd1a1fadbf17593beb838629fc8f023c099fea17de360fee313011
Size

1.2MB
MD5

71709094228329a7401c42252f516ecd
SHA1

9f6db04abbc7ee2a06a639702d26ae936f80844f
SHA256

8fc095cc1bdd1a1fadbf17593beb838629fc8f023c099fea17de360fee313011
SHA512

68a1940cc0648bda0ac9a128b13cf7adbf65b5fe28534d388563a3ddb65764ed065ee78ce59ecb96d9943c32bfde3f11348c0ef1e05df2fbb4fd7f896bb9511a
SSDEEP

24576:wR9xLcxwuNcPoZMufrikUpaWd5fLHX0p/BIOcY4PWN4Lvzqwr:022PPujikUpaWdVL0p/PNc7D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8fc095cc1bdd1a1fadbf17593beb838629fc8f023c099fea17de360fee313011

Files

8fc095cc1bdd1a1fadbf17593beb838629fc8f023c099fea17de360fee313011
.exe windows:5 windows x86 arch:x86

500bbdb3118b593deee4d41e8782bad6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\project\sogouime\dev_10.1_lingxi_modify\Bin\SogouPdb\SogouInput\crashrpt.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

kernel32

FreeLibrary
MultiByteToWideChar
CreateFileA
CreateMutexA
OpenMutexA
OutputDebugStringA
GetSystemDirectoryA
ReadFile
GetFileSize
Sleep
GlobalMemoryStatusEx
Process32Next
Process32First
CreateToolhelp32Snapshot
WideCharToMultiByte
CopyFileA
CreateDirectoryA
GetModuleHandleA
IsBadWritePtr
GetCurrentProcess
lstrlenW
WriteFile
TerminateProcess
GetModuleFileNameW
SetFilePointer
CreateFileW
GetCurrentThreadId
FormatMessageW
lstrcatW
LoadLibraryW
GetLocalTime
GetCurrentProcessId
CreateProcessW
GetModuleHandleW
lstrcpyW
GetTickCount
VirtualQuery
IsDebuggerPresent
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
EncodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
OutputDebugStringW
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetCurrentThread
HeapSize
GetFileType
GetConsoleCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
SetStdHandle
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
WriteConsoleW
GetProcessHeap
SetConsoleCtrlHandler
GetTimeZoneInformation
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
InterlockedDecrement
WaitForSingleObjectEx
CreateThread
SetEndOfFile
LoadLibraryA
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ReadProcessMemory
GetLastError
RaiseException
OpenProcess
GetProcAddress
DecodePointer
TerminateThread
GetTempPathW
GetSystemDirectoryW
Process32NextW
Process32FirstW
OpenMutexW
CreateDirectoryW
SetFileTime
GetProcessId
WaitForSingleObject
GetFileAttributesW
SetFileAttributesW
GetFileAttributesExW
FileTimeToSystemTime
GlobalAlloc
DeleteFileW
GlobalFree
MoveFileExW
SystemTimeToFileTime
CopyFileW
GetTempFileNameW
GetFileTime
GetExitCodeProcess
QueryDosDeviceW
FindFirstFileW
RemoveDirectoryW
GetLogicalDriveStringsW
InterlockedCompareExchange
DuplicateHandle
ExitThread
LocalFree
LocalAlloc
CreateMutexW
ReleaseMutex
GetVersionExW
GetWindowsDirectoryW
VirtualAlloc
QueryPerformanceFrequency
InterlockedIncrement
SetEvent
OpenFileMappingW
UnmapViewOfFile
FlushViewOfFile
CreateFileMappingW
MapViewOfFile
ResumeThread
FreeLibraryAndExitThread
LoadLibraryExW
SetEnvironmentVariableW

user32

SetWindowPos
IsWindowVisible
GetDC
SendMessageTimeoutW
GetWindowRect
FindWindowExW
MonitorFromPoint
GetWindowLongW
UnregisterClassW
ShowWindow
TranslateMessage
MsgWaitForMultipleObjectsEx
PeekMessageW
DispatchMessageW
wsprintfW
SetRectEmpty
MessageBoxW
GetMonitorInfoW
AttachThreadInput
EnumWindows
UnregisterClassA
GetClassNameW
GetDesktopWindow
SystemParametersInfoW
wvsprintfW
GetParent
SetForegroundWindow
IsIconic
ReleaseDC
GetWindowThreadProcessId
GetFocus
MonitorFromRect
GetForegroundWindow
WindowFromPoint
GetSystemMetrics

advapi32

RegQueryInfoKeyW
GetTokenInformation
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
LookupAccountSidW
OpenProcessToken
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegEnumValueW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegDeleteValueW
SetEntriesInAclW
RegCreateKeyExW
RegFlushKey
BuildExplicitAccessWithNameW
RegEnumKeyW
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorSacl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

imm32

ImmDisableIME

wininet

InternetCloseHandle
InternetConnectA
InternetOpenUrlA
InternetReadFile
InternetSetOptionA
HttpQueryInfoA
HttpEndRequestA
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
HttpAddRequestHeadersA

psapi

GetModuleInformation
GetModuleFileNameExW
GetProcessMemoryInfo

gdi32

GetDeviceCaps

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
SHFileOperationW
ShellExecuteW
ShellExecuteExW

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

Sections

.text
Size: 950KB - Virtual size: 949KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 14KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

500bbdb3118b593deee4d41e8782bad6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

kernel32

user32

advapi32

imm32

wininet

psapi

gdi32

shell32

ole32

oleaut32

Sections

.text Size: 950KB - Virtual size: 949KB

.rdata Size: 176KB - Virtual size: 176KB

.data Size: 14KB - Virtual size: 129KB

.rsrc Size: 80KB - Virtual size: 80KB

.text
Size: 950KB - Virtual size: 949KB

.rdata
Size: 176KB - Virtual size: 176KB

.data
Size: 14KB - Virtual size: 129KB

.rsrc
Size: 80KB - Virtual size: 80KB