goshimei[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

goshimei.exe
Size

4.1MB
MD5

869ac9ca71b35899d78d00452891e9a1
SHA1

7d291027cb648ebcfb00bd67e49c3bd206417c75
SHA256

48c72c58846a5b0375c6485d200c03bdf46fd608efe35968caf0de1f86d428f7
SHA512

32b645b4d3c1385ce6f9ffd158f0b711b6b98303503e3911976e8667f73cdc4d903ce5c42879ddaf6925b0a03824d80ab7c0ddf847bb76263c593cbe4f2c92af
SSDEEP

98304:qdik2guFwgebN/CEiQn1Lv+i73YQ2f7vB:sik2guFLebN/CEiQn1Lv+i73YQOvB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
goshimei.exe

Files

goshimei.exe
.exe windows:4 windows x86 arch:x86

3ef17ff7d6a79f402c1088d7b545ccd3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CompareFileTime
CreateDirectoryA
CreateFileA
CreateFileMappingA
CreateMutexA
CreateProcessA
CreateThread
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
ExitProcess
ExitThread
FindClose
FindFirstFileA
FindNextFileA
FormatMessageA
GetACP
GetCPInfo
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentStrings
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetLogicalDrives
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetShortPathNameA
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDefaultLangID
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByte
IsDBCSLeadByteEx
IsDebuggerPresent
IsValidLocale
LCMapStringA
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
MoveFileA
MultiByteToWideChar
OpenFileMappingA
OutputDebugStringA
RaiseException
ReadFile
ReleaseMutex
ResumeThread
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
SetLastError
SetThreadLocale
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpA
lstrcpyA
lstrcpynA
lstrlenA

comdlg32

GetOpenFileNameA
GetSaveFileNameA

gdi32

CreateCompatibleDC
CreateFontIndirectA
DeleteDC
DeleteObject
GetGlyphOutlineA
GetStockObject
GetTextMetricsA
SelectObject
SetDIBitsToDevice

shell32

DragAcceptFiles
DragFinish
DragQueryFileA

shfolder

SHGetFolderPathA

user32

AdjustWindowRectEx
BeginPaint
ChangeDisplaySettingsA
CharPrevA
ClientToScreen
CreateAcceleratorTableA
CreateWindowExA
DefWindowProcA
DestroyAcceleratorTable
DispatchMessageA
EndPaint
EnumThreadWindows
GetAsyncKeyState
GetClassInfoA
GetClientRect
GetCursorPos
GetDC
GetMessageA
GetSystemMetrics
GetWindowLongA
GetWindowRect
LoadCursorA
LoadIconA
MessageBoxA
MsgWaitForMultipleObjects
OffsetRect
PeekMessageA
PostMessageA
PostQuitMessage
PostThreadMessageA
RegisterClassA
ReleaseDC
ScreenToClient
SetCursorPos
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
TranslateAcceleratorA
TranslateMessage
ValidateRect
wsprintfA

winmm

timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetTime

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize

Exports

Exports

__GetExceptDLLinfo
___CPPdebugHook

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 403KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ef17ff7d6a79f402c1088d7b545ccd3

Headers

File Characteristics

Imports

kernel32

comdlg32

gdi32

shell32

shfolder

user32

winmm

ole32

Exports

Exports

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.data Size: 403KB - Virtual size: 576KB

.tls Size: 512B - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.idata Size: 4KB - Virtual size: 8KB

.edata Size: 512B - Virtual size: 4KB

.rsrc Size: 208KB - Virtual size: 208KB

.reloc Size: 64KB - Virtual size: 68KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.data
Size: 403KB - Virtual size: 576KB

.tls
Size: 512B - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.idata
Size: 4KB - Virtual size: 8KB

.edata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 208KB - Virtual size: 208KB

.reloc
Size: 64KB - Virtual size: 68KB