unknown_chinese_APT_shit_Sig6[.]bin

General

Target

unknown_chinese_APT_shit_Sig6.bin
Size

136KB
MD5

475c74a60981784b849008a84ef26819
SHA1

c972902566195ca0c2c6ce67a262a8bb5997d675
SHA256

24cab861cbbe7e8027649fa6c1987beae579893d0fe54f462e58ac41619b14ba
SHA512

5664731fc67fa36c29eaac05f8c6cae391dffbceccc4fcdea4e2e525dfc9b98dc20cded7fdee64600e3810deef87d976fb2dfbbf3d4256a83e652425369a3569
SSDEEP

768:NkR+hFrmDBDACquUiMx0RuivEQjEAToNS39WKNrkBJNWrVQY3Eqza3auJy7mp:JXmVDyDEubS39MXNWWQfcaa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unknown_chinese_APT_shit_Sig6.bin

Files

unknown_chinese_APT_shit_Sig6.bin
.exe windows:4 windows x86 arch:x86

8e622be7a68774a2898cc7e91a869408

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
ReadFile
SetFilePointer
SetFileTime
GetFileTime
GetTempFileNameA
GetTempPathA
GetCurrentProcess
CreateProcessA
WaitForSingleObject
OpenProcess
Process32First
LoadLibraryA
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
GetProcAddress
Process32Next
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
lstrcmpiA
SetFileAttributesA
DeleteFileA
FindResourceA
SizeofResource
LoadResource
CreateFileA
LockResource
WriteFile
CloseHandle
CopyFileA
GetCurrentProcessId
Sleep

advapi32

RegCloseKey
RegSetValueExA
RegRestoreKeyA
RegCreateKeyA
RegSaveKeyA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
RegDeleteValueA
RegDeleteKeyA

msvcrt

_except_handler3
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strchr
atoi
free
strrchr
sprintf
atol
malloc
_stricmp
_ltoa

shell32

SHGetSpecialFolderPathA

user32

GetTopWindow
GetWindow
CreateDialogParamA
ShowWindow
GetWindowThreadProcessId
wsprintfA

Sections

.CQSN
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CQSN
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CQSN
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

Files

8e622be7a68774a2898cc7e91a869408

Headers

File Characteristics

Imports

kernel32

advapi32

msvcrt

shell32

user32

Sections

.CQSN Size: 20KB - Virtual size: 20KB

.CQSN Size: 40KB - Virtual size: 40KB

.CQSN Size: 72KB - Virtual size: 72KB

.CQSN
Size: 20KB - Virtual size: 20KB

.CQSN
Size: 40KB - Virtual size: 40KB

.CQSN
Size: 72KB - Virtual size: 72KB