36edf4090f6e91fdc91a9bc3ec1f94c8cabad7ee22dface2651e1f01c1730ab8

Sharing

Copy URL

Twitter E-mail

General

Target

36edf4090f6e91fdc91a9bc3ec1f94c8cabad7ee22dface2651e1f01c1730ab8
Size

10.0MB
MD5

6b7aeb6425309816ce65f2108e52905a
SHA1

ccf1c022af31320e924739ea194bf31178a3fe9a
SHA256

36edf4090f6e91fdc91a9bc3ec1f94c8cabad7ee22dface2651e1f01c1730ab8
SHA512

4fecd428998c5fa0d0f8a709784150c6a0d4cd463936e4164fd3caeaa12363b3cf1129fa29233ce066510683fa0efd9acdb222473ee7e3406c2a246ceccacc01
SSDEEP

49152:YDzPnpt41VxiQFl60I4fbWgi2FJq3AhnY4F/HKx3/:4Ppt41HiylHnTqw6Kv+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36edf4090f6e91fdc91a9bc3ec1f94c8cabad7ee22dface2651e1f01c1730ab8

Files

36edf4090f6e91fdc91a9bc3ec1f94c8cabad7ee22dface2651e1f01c1730ab8
.exe windows:6 windows x86 arch:x86

6fc74a7b784f1384ef08d7d3d583721a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\lingjiang_git\pc_zhima\ProxySocksHttp\pia-s5-qt\Relese\PiaProxy_cata\PiaProxy.pdb

Imports

shell32

ExtractIconExW
ShellExecuteExA
CommandLineToArgvW

dbghelp

MiniDumpWriteDump

oleaut32

VariantClear

advapi32

OpenProcessToken
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
AdjustTokenPrivileges

ws2_32

WSAStartup
send
recv
accept
bind
closesocket
htonl
htons
inet_ntoa
WSACleanup
WSAGetLastError
WSASocketW
listen

kernel32

CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
UnmapViewOfFile
CreatePipe
LoadLibraryA
FormatMessageW
LocalFree
LoadLibraryW
GetCurrentThreadId
SetUnhandledExceptionFilter
IsDebuggerPresent
CreateFileW
UnhandledExceptionFilter
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
SetTimeZoneInformation
GetTimeZoneInformation
GetSystemTime
OpenProcess
TerminateProcess
GetCurrentProcess
AllocConsole
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
WaitForMultipleObjects
Sleep
OpenMutexW
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetLastError
CloseHandle
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
Process32NextW
GetCommandLineW

Exports

Exports

strdup

Sections

.text
Size: 863KB - Virtual size: 864KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 542KB - Virtual size: 541KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6fc74a7b784f1384ef08d7d3d583721a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

dbghelp

oleaut32

advapi32

ws2_32

kernel32

Exports

Exports

Sections

.text Size: 863KB - Virtual size: 864KB

.rdata Size: 2.5MB - Virtual size: 2.5MB

.data Size: 6KB - Virtual size: 12KB

.gfids Size: 512B - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 542KB - Virtual size: 541KB

.text
Size: 863KB - Virtual size: 864KB

.rdata
Size: 2.5MB - Virtual size: 2.5MB

.data
Size: 6KB - Virtual size: 12KB

.gfids
Size: 512B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 542KB - Virtual size: 541KB