49372d5ffdbe3c0dd46b3d910bcd2a57bb46781d7f493455d6a34cf40b169154

Sharing

Copy URL

Twitter E-mail

General

Target

49372d5ffdbe3c0dd46b3d910bcd2a57bb46781d7f493455d6a34cf40b169154
Size

2.4MB
MD5

365d6391c9c5bac5f39598a1fe5bd88b
SHA1

9cd5059aeabf5a8e85745efbd09fb9f3d4c39a41
SHA256

49372d5ffdbe3c0dd46b3d910bcd2a57bb46781d7f493455d6a34cf40b169154
SHA512

dcab63719388f9b4353f8327ccb6d7decff4d5fe76f13c1e2ff8dec439badaa1432cdbc65a5717fa9193459c190f459e99c8ea5ed8e7a0cd29ee5dd1e382c0ec
SSDEEP

49152:AA1Y+sJr3klqmufkFqPLK0Mj9N8nQzVPQLmMHyT:AA1Y+sJjoadPejILmM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49372d5ffdbe3c0dd46b3d910bcd2a57bb46781d7f493455d6a34cf40b169154

Files

49372d5ffdbe3c0dd46b3d910bcd2a57bb46781d7f493455d6a34cf40b169154
.exe windows:6 windows x86 arch:x86

01f088a8021eddf0440966893f15310c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Work\加速器\sg-tools\bin\Release\HttpProxy.pdb

Imports

ws2_32

getpeername
recvfrom
inet_ntop
inet_pton
setsockopt
htonl
socket
listen
sendto
closesocket
htons
accept
inet_addr
send
recv
freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
ntohs
getsockopt
getsockname
ioctlsocket
bind
WSAPoll
gethostbyname
inet_ntoa
connect
WSASetLastError

iphlpapi

IcmpCreateFile
IcmpSendEcho2
IcmpCloseHandle

shlwapi

PathAddBackslashA
PathRemoveFileSpecA

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

kernel32

GetDateFormatW
GetConsoleCP
GetFullPathNameW
GetLocalTime
GetLastError
DeleteFileA
SetEvent
WaitForSingleObject
CreateEventA
Sleep
CreateThread
WinExec
GetTickCount
CloseHandle
GetExitCodeProcess
OpenProcess
GetModuleFileNameA
FindFirstFileW
FindNextFileW
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
FindClose
GetVersionExW
CreateEventW
LoadLibraryW
GetProcAddress
GetCurrentProcessId
FreeLibrary
FlushFileBuffers
GetModuleHandleExW
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetTimeFormatW
GetFileType
WriteFile
GetModuleHandleW
MultiByteToWideChar
SwitchToFiber
DeleteFiber
CreateFiber
WideCharToMultiByte
GetSystemTime
SystemTimeToFileTime
QueryPerformanceCounter
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryA
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
QueryPerformanceFrequency
GetCurrentThread
GetThreadTimes
FormatMessageA
InitializeCriticalSection
GetACP
HeapReAlloc
ExitThread
SetFilePointerEx
GetFileAttributesExW
GetCurrentDirectoryW
SetStdHandle
HeapSize
DeleteFileW
GetProcessHeap
SetEndOfFile
FindFirstFileExA
FindNextFileA
IsValidCodePage
IsValidLocale
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetUserDefaultLCID
GetEnvironmentVariableW
EnumSystemLocalesW
HeapFree
HeapAlloc
GetTimeZoneInformation
WriteConsoleW
SetConsoleCtrlHandler
ExitProcess
ReadFile
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
CreateFileW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
TryEnterCriticalSection
EncodePointer
DecodePointer
RaiseException
DuplicateHandle
WaitForSingleObjectEx
QueueUserWorkItem
IsProcessorFeaturePresent
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
ResetEvent
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore

user32

MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW

advapi32

DeregisterEventSource
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW

dnsapi

DnsQuery_A
DnsFree

bcrypt

BCryptGenRandom

ntdll

RtlUnwind

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 537KB - Virtual size: 537KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01f088a8021eddf0440966893f15310c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

iphlpapi

shlwapi

crypt32

kernel32

user32

advapi32

dnsapi

bcrypt

ntdll

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 537KB - Virtual size: 537KB

.data Size: 31KB - Virtual size: 48KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 537KB - Virtual size: 537KB

.data
Size: 31KB - Virtual size: 48KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB