bb50138f645050105b09d5c2d14f70d0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

bb50138f645050105b09d5c2d14f70d0N.exe
Size

498KB
MD5

bb50138f645050105b09d5c2d14f70d0
SHA1

5a1293f04f08da8eca6f66e9ff5d686f8b7fb02d
SHA256

622b79a7690b4187124aefc0dee09de2defbdfa3d460d97b96da0fb64cdfd1d4
SHA512

c5340e66dc10053df459f203cfc7a825a210da89cc2b8b04d018db913389958844a10abd28c9286b4a7dd4754337fa51afcc010331b8d3628235509f57c1a678
SSDEEP

6144:zTW7Cx/F+emgFLh+5BH0+AO1yQ1YBtlSb7o7VRhOldhhd+pO:zT6CdC55BH0+6QSCoRhOjnd+w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb50138f645050105b09d5c2d14f70d0N.exe

Files

bb50138f645050105b09d5c2d14f70d0N.exe
.exe windows:5 windows x86 arch:x86

9b7548744d75cd73bfb69834a380fd5d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\project\sogouime\branch\PinyinDev_R_9_3_ARM\Bin\SogouPdb\SogouInput\SogouSvc.pdb

Imports

userenv

CreateEnvironmentBlock

kernel32

GetCommandLineW
CreateEventW
Sleep
WaitForSingleObject
SetEvent
GetCurrentThreadId
CreateThread
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
FindResourceW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
CloseHandle
SizeofResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
OpenProcess
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
SetEndOfFile
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
GetProcessHeap
GetOEMCP
IsValidCodePage
DecodePointer
ReadConsoleW
SetFilePointerEx
GetConsoleMode
CreateDirectoryW
GetConsoleCP
GetFileType
LoadLibraryW
WideCharToMultiByte
ReadFile
SetLastError
GetCurrentProcess
WriteFile
CreateFileW
FormatMessageW
LocalFree
FindNextFileW
FindClose
GetFileAttributesW
GetSystemDirectoryW
SetFileAttributesW
DeleteFileW
FlushFileBuffers
CreateMutexW
ReleaseMutex
OpenMutexW
GetCurrentProcessId
LocalAlloc
QueryPerformanceCounter
IsDebuggerPresent
OutputDebugStringW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
GetModuleHandleExW
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetStdHandle
GetACP
HeapSize
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW

user32

CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
CharUpperW
SetTimer
MessageBoxW
LoadStringW

advapi32

CreateProcessAsUserW
GetSecurityDescriptorSacl
OpenProcessToken
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
RegQueryValueExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
DuplicateTokenEx
SetSecurityInfo
FreeSid
AllocateAndInitializeSid
EqualSid
SetSecurityDescriptorDacl
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation

ole32

CoRevokeClassObject
CoResumeClassObjects
CoAddRefServerProcess
CoReleaseServerProcess
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
StringFromGUID2
CoRegisterClassObject
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc

oleaut32

SysAllocStringLen
SysFreeString
SysStringLen
VarUI4FromStr
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
LoadRegTypeLi
LoadTypeLi

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

shell32

SHGetFolderPathW

Sections

.text
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 84KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9b7548744d75cd73bfb69834a380fd5d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

userenv

kernel32

user32

advapi32

ole32

oleaut32

version

shell32

Sections

.text Size: 189KB - Virtual size: 189KB

.rdata Size: 94KB - Virtual size: 93KB

.data Size: 8KB - Virtual size: 41KB

.rsrc Size: 107KB - Virtual size: 107KB

.reloc Size: 84KB - Virtual size: 88KB

.text
Size: 189KB - Virtual size: 189KB

.rdata
Size: 94KB - Virtual size: 93KB

.data
Size: 8KB - Virtual size: 41KB

.rsrc
Size: 107KB - Virtual size: 107KB

.reloc
Size: 84KB - Virtual size: 88KB