48b7fd8da254eb94af71cb3d8dca70926b721b1d220a4b00b7379076a946a72d

Sharing

Copy URL Twitter E-mail

General

Target

48b7fd8da254eb94af71cb3d8dca70926b721b1d220a4b00b7379076a946a72d
Size

420KB
MD5

ab7eb144a42541576a7f2dd33fa59365
SHA1

de2110676c17b2209d1339fc716b3b69d4ef2892
SHA256

48b7fd8da254eb94af71cb3d8dca70926b721b1d220a4b00b7379076a946a72d
SHA512

7ea7c4344f33d7ca86ad29cb1568fec3982291516a0f828cfac4d58c9702656bd1570546302144f81a80374f8aedd91b2a8dc8f97418911af1833da488368e97
SSDEEP

6144:iVnCGWx/n7W+nf9fWEXTW52N14jpHDFceXQVpWCfYwT5WmKtdmfE+D14fEJSgQ+f:snCRxV1FK52N1IpDJJmdTMYfxQg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48b7fd8da254eb94af71cb3d8dca70926b721b1d220a4b00b7379076a946a72d

Files

48b7fd8da254eb94af71cb3d8dca70926b721b1d220a4b00b7379076a946a72d
.dll windows:6 windows x86 arch:x86

4dc8cd53eb96c3407d07f3ec16166ca8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\admin\Desktop\AliyunLog-2017\UserInfoCollect\Release\AliyunWrap.pdb

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
CreateProcessAsUserW
LookupPrivilegeValueW
AdjustTokenPrivileges
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
RegOpenKeyW
GetUserNameW
LookupAccountNameW
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt

ws2_32

WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
recv
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
recvfrom
gethostname
send
WSACloseEvent
ioctlsocket
sendto
freeaddrinfo

wldap32

ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27
ord301

kernel32

VerifyVersionInfoW
GetModuleHandleA
VerSetConditionMask
GetEnvironmentVariableA
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetStdHandle
MoveFileExW
GetTickCount
LoadLibraryW
FreeLibrary
GetSystemDirectoryW
QueryPerformanceFrequency
SleepEx
InitializeCriticalSectionEx
FormatMessageW
SetLastError
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GlobalMemoryStatusEx
GetLocalTime
LocalFree
GetPrivateProfileIntW
GetFileAttributesW
WriteFile
DeleteFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetModuleFileNameW
MultiByteToWideChar
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
CreateProcessW
CreateMutexW
GetLastError
OpenEventW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
CreateThread
WaitForSingleObject
CloseHandle
Sleep
CopyFileW
CreateFileW
ReadFile
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
ReleaseMutex

shlwapi

StrRChrA

vcruntime140

__CxxFrameHandler3
strstr
_except_handler4_common
memset
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
wcsrchr
memcmp
memcpy
memmove
strchr
strrchr
memchr

api-ms-win-crt-string-l1-1-0

strpbrk
_stricmp
_strdup
wcscat_s
_wcsdup
wcspbrk
strncpy
wcscpy_s
towupper
strspn
strncmp
_wcsicmp
strlen
toupper
isalnum
strcspn
strtok

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s
fclose
fputs
_close
feof
fseek
fwrite
fread
__stdio_common_vswprintf
_write
fputc
fflush
_read
_wopen
_wfopen
puts
__stdio_common_vsscanf
fgets
__stdio_common_vsprintf
__acrt_iob_func
__stdio_common_vsprintf_s
_lseeki64
__stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_getpid
_beginthreadex
_cexit
_crt_atexit
_initialize_narrow_environment
_seh_filter_dll
_errno
_configure_narrow_argv
__sys_errlist
__sys_nerr
_execute_onexit_table
_initialize_onexit_table
_register_onexit_function

api-ms-win-crt-time-l1-1-0

_mktime64
_gmtime64
strftime
_time64
_localtime64

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
realloc
calloc

api-ms-win-crt-convert-l1-1-0

_wtoi64
wcstombs
strtoll
atoi
strtoul
strtol

api-ms-win-crt-locale-l1-1-0

setlocale

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_waccess
_wstat64
_fstat64
_unlink

api-ms-win-crt-math-l1-1-0

_fdopen
_except1

psapi

GetModuleFileNameExW
EnumProcessModules

iphlpapi

GetAdaptersInfo

rpcrt4

UuidCreate

bcrypt

BCryptGenRandom

Exports

Exports

?SendLogToCloud@@YA_NABV?$vector@U?$pair@PA_WPA_W@std@@V?$allocator@U?$pair@PA_WPA_W@std@@@2@@std@@@Z
?SendLogToCloud@@YA_NHPAPADPAI01@Z
AliyunAddParamToSessionA
AliyunAddParamToSessionW
AliyunCloseSession
AliyunEnableUserInfoCollect
AliyunEndCache
AliyunGetKeyValue
AliyunGetUserUid
AliyunInstallConfigFilePath
AliyunInstallInitUid
AliyunIsEnableUserInfoCollect
AliyunOpenSession
AliyunSendInfo
AliyunSetKeyValue
AliyunStopProcess
AliyunUninstallEnd
AliyunUninstallStart

Sections

.text
Size: 349KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4dc8cd53eb96c3407d07f3ec16166ca8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

ws2_32

wldap32

kernel32

shlwapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

psapi

iphlpapi

rpcrt4

bcrypt

Exports

Exports

Sections

.text Size: 349KB - Virtual size: 349KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 512B - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 349KB - Virtual size: 349KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 512B - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 13KB - Virtual size: 12KB