526a195a135636c89e055cd14e225ab3a25ff176d449dc5b2ec4755614e01fd9

Sharing

Copy URL Twitter E-mail

General

Target

526a195a135636c89e055cd14e225ab3a25ff176d449dc5b2ec4755614e01fd9
Size

1.2MB
MD5

1a91250b6f3e27479794b1b795d2a8e8
SHA1

5db425fd483a7aa42f1cc481946b690179e1192c
SHA256

526a195a135636c89e055cd14e225ab3a25ff176d449dc5b2ec4755614e01fd9
SHA512

9620292664e2b796bee5912631db585edec5c93613bb0f1321d0a1ef89084f41c915e067ec8fccb0a567edbf5deaf93e64085cf3db8275efa8de02c857a5098b
SSDEEP

24576:Lz+vDT7kWIiTp1o1VCMBOQGIBv2arWQMMe8Zd/Y0r:P+7TUa/8CMdvZSQ88b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
526a195a135636c89e055cd14e225ab3a25ff176d449dc5b2ec4755614e01fd9

Files

526a195a135636c89e055cd14e225ab3a25ff176d449dc5b2ec4755614e01fd9
.exe windows:5 windows x86 arch:x86

1d25571a2acfe6647ed8bb65109a0618

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\project\wubi\WB_5_2\bin\SogouPdb\SogouWubi\ScdReg.pdb

Imports

imm32

ImmDisableIME

wininet

HttpQueryInfoW
InternetSetOptionW
InternetCloseHandle
InternetOpenW
InternetOpenUrlW

kernel32

SizeofResource
LockResource
FindResourceExW
LoadResource
FindResourceW
InterlockedExchangeAdd
InterlockedIncrement
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
InterlockedDecrement
QueryPerformanceFrequency
GetLastError
HeapSize
FindClose
GetTempPathW
InitializeCriticalSectionAndSpinCount
FindNextFileW
HeapFree
FindFirstFileW
GetDriveTypeW
PeekNamedPipe
GetCurrentDirectoryW
GetFullPathNameW
HeapReAlloc
ReadConsoleW
ReadFile
SetLastError
WriteFile
SetFilePointer
CreateFileW
SetFileAttributesW
Sleep
CloseHandle
GetFileSize
FlushFileBuffers
InterlockedCompareExchange
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
GetCurrentProcess
GetModuleFileNameW
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
LoadLibraryW
FreeLibrary
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetCurrentThreadId
ExitThread
CreateEventW
FormatMessageW
GlobalAlloc
GlobalFree
CreateThread
LocalFree
CreateProcessW
RemoveDirectoryW
GetFileAttributesW
GetVersionExW
GetSystemDirectoryW
DeleteFileW
MoveFileExW
CreateDirectoryW
WaitForSingleObject
GetFileAttributesExW
FileTimeToSystemTime
CopyFileW
LocalAlloc
OpenEventW
CreateMutexW
ReleaseMutex
OpenMutexW
QueryPerformanceCounter
SetEvent
IsBadWritePtr
lstrlenW
TerminateProcess
lstrcatW
GetLocalTime
lstrcpyW
VirtualQuery
IsDebuggerPresent
SetUnhandledExceptionFilter
HeapCreate
GetStringTypeW
EncodePointer
GetCPInfo
CompareStringW
LCMapStringW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
OutputDebugStringW
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
LoadLibraryExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
GetACP
GetFileType
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
SetEndOfFile

user32

IsWindowVisible
GetWindowThreadProcessId
CreateWindowExW
wvsprintfW
GetSystemMetrics
GetWindowTextW
EndPaint
SetRectEmpty
GetWindowLongW
DefWindowProcW
CallWindowProcW
GetWindowRect
GetDC
SetWindowPos
MessageBoxW
GetPropW
ScreenToClient
SendMessageW
EndDialog
RemovePropW
SetWindowTextW
SetTimer
TrackMouseEvent
IsDlgButtonChecked
SetPropW
GetWindowDC
SetWindowLongW
GetClientRect
GetDlgItem
DrawTextW
CheckDlgButton
GetClassNameW
ReleaseDC
BeginPaint
GetParent
DialogBoxParamW
InvalidateRect

gdi32

SetBkMode
DeleteObject
CreateSolidBrush
SetTextColor
GetTextExtentPoint32W
GetStockObject
SelectObject
GetObjectW
CreateFontIndirectW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

GetProcessMemoryInfo

hwsignature

GenHWID

advapi32

SetEntriesInAclW
SetSecurityDescriptorSacl
GetNamedSecurityInfoW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
SetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegOpenKeyW
InitializeAcl
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
AddAccessAllowedAceEx
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyW
RegCloseKey
GetTokenInformation
LookupAccountSidW
OpenProcessToken
GetLengthSid
InitializeSecurityDescriptor

shell32

ShellExecuteW
SHGetFolderPathW
SHFileOperationW

Sections

.text
Size: 656KB - Virtual size: 656KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 374KB - Virtual size: 373KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 73KB - Virtual size: 422KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1d25571a2acfe6647ed8bb65109a0618

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

imm32

wininet

kernel32

user32

gdi32

version

psapi

hwsignature

advapi32

shell32

Sections

.text Size: 656KB - Virtual size: 656KB

.rdata Size: 374KB - Virtual size: 373KB

.data Size: 73KB - Virtual size: 422KB

.rsrc Size: 92KB - Virtual size: 96KB

.text
Size: 656KB - Virtual size: 656KB

.rdata
Size: 374KB - Virtual size: 373KB

.data
Size: 73KB - Virtual size: 422KB

.rsrc
Size: 92KB - Virtual size: 96KB