643a8d50bb08558af35f13e6ec5e6e27c160abf12124203ef241c089234ced99

Sharing

Copy URL Twitter E-mail

General

Target

643a8d50bb08558af35f13e6ec5e6e27c160abf12124203ef241c089234ced99
Size

4.4MB
MD5

fcd5cae26d19fca9be8c2a720abf0c36
SHA1

74c516caa4af28c0b5ab77915d51549921787712
SHA256

643a8d50bb08558af35f13e6ec5e6e27c160abf12124203ef241c089234ced99
SHA512

0d47fd2a89035e0fbe8498fb373b98e4ec040c089649baa43d10693dd6c3663e7454f7683ac26fc7e98eb8700ada4566a41178e2c3f271e5644741193fd28bfc
SSDEEP

98304:TDboL3Ac6GX6QWbhjZrJlFsQEDw1rkkgrCJfLp884Rsd6np+3bqdB0:TDboLQc6GX6QWblZrJLh+EgrCY6cZdB0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
643a8d50bb08558af35f13e6ec5e6e27c160abf12124203ef241c089234ced99

Files

643a8d50bb08558af35f13e6ec5e6e27c160abf12124203ef241c089234ced99
.exe windows:5 windows x86 arch:x86

375a00920598b4fe3332ff23da9eeacc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\data\landun\workspace\CommonComponent\ACE-Guard\1.compile_source\output\Win32\Release\SGuard32.pdb

Imports

psapi

GetModuleFileNameExW
GetMappedFileNameW
GetModuleInformation

userenv

ExpandEnvironmentStringsForUserW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

PathFindFileNameA
PathFileExistsW
StrStrIW
PathFindFileNameW
PathAppendW
PathRemoveFileSpecW

wtsapi32

WTSQueryUserToken

ws2_32

htonl
htons
freeaddrinfo
inet_addr
WSASetLastError
select
__WSAFDIsSet
WSACreateEvent
WSACloseEvent
WSAStartup
getaddrinfo
WSACleanup
WSAGetLastError
ioctlsocket
sendto
recv
setsockopt
listen
WSAIoctl
getpeername
WSAEventSelect
bind
WSAEnumNetworkEvents
accept
getsockopt
gethostname
recvfrom
connect
socket
send
closesocket
ntohs
getsockname

wldap32

ord79
ord200
ord301
ord143
ord217
ord46
ord33
ord35
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord30

kernel32

IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetStringTypeW
DuplicateHandle
GetCPInfo
OutputDebugStringW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
ExitThread
FreeLibraryAndExitThread
GetFileAttributesExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
WriteConsoleW
SetConsoleCtrlHandler
GetACP
GetConsoleCP
IsValidLocale
FlushFileBuffers
GetCurrentDirectoryW
GetFullPathNameW
GetFullPathNameA
SetStdHandle
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
ChangeTimerQueueTimer
GetProcessAffinityMask
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
CreateFileW
GetFileAttributesW
AreFileApisANSI
CloseHandle
RaiseException
GetLastError
SetLastError
HeapAlloc
HeapReAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
CreateMutexA
CreateMutexW
CreateEventW
Sleep
GetProcessTimes
TerminateProcess
GetCurrentThreadId
GetThreadTimes
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetVersionExW
GetNativeSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
MapViewOfFileEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryW
LocalAlloc
LocalFree
SetThreadAffinityMask
CreateFileMappingA
RegisterWaitForSingleObject
UnregisterWait
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
GetLocaleInfoW
GetSystemDefaultLangID
GetUserDefaultLCID
EnumSystemLocalesW
GetEnvironmentVariableW
ResumeThread
OpenProcess
ExitProcess
GetCurrentProcess
InterlockedCompareExchange
GetCurrentThread
WriteFile
SetFilePointer
GetFileSize
GetModuleHandleW
HeapSize
HeapDestroy
DeleteCriticalSection
GetProcessHeap
InterlockedExchange
GetCurrentProcessId
InterlockedIncrement
InterlockedDecrement
SizeofResource
FindFirstFileW
FindNextFileW
FindClose
SetFileAttributesW
LockResource
LoadResource
FindResourceW
GetWindowsDirectoryA
GetLogicalDriveStringsA
GetTempPathW
GetTempFileNameW
CreateThread
OpenEventW
SetCurrentDirectoryW
SystemTimeToFileTime
GetSystemTime
TryEnterCriticalSection
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CreateDirectoryW
GetModuleHandleExW
ExpandEnvironmentStringsW
DeleteFileW
VerSetConditionMask
VerifyVersionInfoW
ReadFile
GetFileSizeEx
EnumResourceNamesW
SetFilePointerEx
GetFileTime
TerminateThread
GetModuleHandleA
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
GlobalAlloc
GlobalFree
GetModuleFileNameA
Module32FirstW
Module32NextW
SetUnhandledExceptionFilter
GetCommandLineA
UnhandledExceptionFilter
OpenMutexW
LoadLibraryA
InterlockedExchangeAdd
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetFileType
GetStdHandle
OutputDebugStringA
DeleteFiber
FindFirstFileA
FindNextFileA
FormatMessageA
ConvertFiberToThread
QueryPerformanceCounter
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetExitCodeThread
InitializeCriticalSection
SleepEx
FormatMessageW
MoveFileExA
PeekNamedPipe
WaitForMultipleObjects
HeapCreate
GetDiskFreeSpaceW
LockFile
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
CreateFileA
DeleteFileA
HeapCompact
UnlockFile
LockFileEx
UnmapViewOfFile
GetUserDefaultUILanguage

user32

IsWindowEnabled
GetLayeredWindowAttributes
IsWindowVisible
GetWindowThreadProcessId
GetAncestor
EnumChildWindows
GetClassNameW
GetWindowInfo
SendMessageTimeoutW
GetWindow
LookupIconIdFromDirectory
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
GetMessageW
DefWindowProcW
CreateWindowExW
GetDesktopWindow
RegisterClassExW
IsWindow
DispatchMessageW
GetWindowLongW
TranslateMessage
SetWindowLongW
UpdateWindow

advapi32

ControlService
RegCloseKey
CryptDestroyKey
ImpersonateLoggedOnUser
RevertToSelf
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetTokenInformation
FreeSid
OpenProcessToken
SetEntriesInAclW
AllocateAndInitializeSid
SetFileSecurityW
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenServiceW
ChangeServiceConfigW
CryptDestroyHash
DeleteService
OpenSCManagerW
CloseServiceHandle
OpenEventLogW
ReadEventLogW
CloseEventLog
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptImportKey
CryptEncrypt
CryptHashData
CryptCreateHash
CryptGetHashParam

shell32

CommandLineToArgvW

pdh

PdhRemoveCounter
PdhGetFormattedCounterValue
PdhAddCounterW
PdhCloseQuery
PdhOpenQueryW
PdhCollectQueryData

dbghelp

MiniDumpWriteDump

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 770KB - Virtual size: 770KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tvm0
Size: 653KB - Virtual size: 656KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 115KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

375a00920598b4fe3332ff23da9eeacc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

userenv

version

shlwapi

wtsapi32

ws2_32

wldap32

kernel32

user32

advapi32

shell32

pdh

dbghelp

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 770KB - Virtual size: 770KB

.data Size: 68KB - Virtual size: 88KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 3KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 2KB

.tvm0 Size: 653KB - Virtual size: 656KB

.reloc Size: 115KB - Virtual size: 116KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 770KB - Virtual size: 770KB

.data
Size: 68KB - Virtual size: 88KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 2KB

.tvm0
Size: 653KB - Virtual size: 656KB

.reloc
Size: 115KB - Virtual size: 116KB