7f1e134723a418e2717ba3a57cd7fe24a062ee51de2eefeb5f3f980198dc2b92

Sharing

Copy URL Twitter E-mail

General

Target

7f1e134723a418e2717ba3a57cd7fe24a062ee51de2eefeb5f3f980198dc2b92
Size

5.3MB
MD5

478baeb6ad610978a17debe189a15ccb
SHA1

9c93062027a1c739e5481a27abda27321534120f
SHA256

7f1e134723a418e2717ba3a57cd7fe24a062ee51de2eefeb5f3f980198dc2b92
SHA512

1bee8163ac644d603df1d287c7b68629b3bc57577d299c3afd95f73be89187feba3c9407ab3a86b85604c13491b2430c8c50e8cd1f45f89f9ae80f687bea6394
SSDEEP

98304:FJ4bLnrHLzXtGe3uX4DRozhChDCr6xb16hDyKHk8FLOAkGkzdnEVomFHKnP:D6Lnrn+Opdb16hDyQk8FLOyomFHKnP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7f1e134723a418e2717ba3a57cd7fe24a062ee51de2eefeb5f3f980198dc2b92

Files

7f1e134723a418e2717ba3a57cd7fe24a062ee51de2eefeb5f3f980198dc2b92
.exe windows:5 windows x86 arch:x86

78bb0d471277a5916ad8adb089c3fdd2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\hongzhenqian\Code\03_JisuBrowser_Yindao_Code\Release\JiSuSetup.pdb

Imports

kernel32

ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetConsoleCP
EnumSystemLocalesW
IsValidLocale
SetFilePointerEx
SetConsoleCtrlHandler
PeekNamedPipe
GetDriveTypeW
SetStdHandle
HeapQueryInformation
VirtualAlloc
FreeLibraryAndExitThread
ExitThread
ExitProcess
GetTimeZoneInformation
GetVersionExW
GetCommandLineA
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
GetNumaHighestNodeNumber
ConvertThreadToFiber
ConvertFiberToThread
GetFileType
GetStdHandle
FindFirstFileW
CreateFiber
DeleteFiber
SwitchToFiber
GetModuleHandleExW
GetSystemTime
LCMapStringW
CompareStringW
GetStringTypeW
GetTempPathW
GetFullPathNameW
GetFileAttributesExW
FindNextFileW
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
QueryPerformanceFrequency
SwitchToThread
TryEnterCriticalSection
OutputDebugStringW
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
DeleteTimerQueueTimer
GetEnvironmentVariableW
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
GetUserDefaultLCID
GetTempFileNameA
FindResourceExW
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
SetErrorMode
SearchPathA
GetProfileIntA
GetThreadTimes
GetTempPathA
SystemTimeToFileTime
FileTimeToSystemTime
GetACP
GetCPInfo
GetOEMCP
VirtualProtect
GetThreadLocale
GetVolumeInformationA
lstrcmpiA
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetFullPathNameA
FlushFileBuffers
FindFirstFileA
FindClose
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetCurrentDirectoryA
GetFileSize
GetFileAttributesA
CreateFileA
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GlobalFlags
VerifyVersionInfoA
lstrcpyA
VerSetConditionMask
CopyFileA
GlobalSize
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
EncodePointer
GlobalAddAtomA
GetCurrentProcessId
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
CompareStringA
GlobalDeleteAtom
LoadLibraryExW
FreeLibrary
GetCurrentThread
LoadLibraryA
GetModuleFileNameW
SetLastError
OutputDebugStringA
ResumeThread
SetThreadPriority
GetCurrentThreadId
SetEvent
HeapFree
MulDiv
CreateMutexA
FindResourceW
LockResource
FreeResource
GlobalUnlock
GlobalLock
LoadResource
GlobalFree
GlobalAlloc
FindResourceA
SizeofResource
GetExitCodeProcess
VirtualQuery
InterlockedIncrement
CreateProcessA
GetModuleHandleW
GetProcAddress
CreateThread
GetSystemInfo
CloseHandle
MoveFileExA
GetModuleHandleA
lstrcmpA
WaitForSingleObject
TerminateProcess
InterlockedDecrement
GetCurrentProcess
GetFileAttributesExA
ReadFile
LoadLibraryW
GetVersionExA
GetComputerNameW
LocalFree
GetSystemDirectoryW
GetWindowsDirectoryA
WideCharToMultiByte
MultiByteToWideChar
GetLocalTime
MoveFileA
GetModuleFileNameA
GetTickCount
DeleteFileA
Sleep
FormatMessageA
FormatMessageW
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
GetCommandLineW

user32

LoadBitmapW
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetIconInfo
CopyIcon
GetMenuDefaultItem
UnregisterClassA
EnableWindow
InvalidateRect
EnableMenuItem
CheckMenuItem
RemoveMenu
InsertMenuA
GetMenuState
GetMenuStringA
MapVirtualKeyA
GetKeyNameTextA
SetLayeredWindowAttributes
MapDialogRect
SetWindowContextHelpId
GetDesktopWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
IsDialogMessageA
SetWindowTextA
SendDlgItemMessageA
CheckDlgButton
MoveWindow
SetRectEmpty
LoadCursorA
LoadCursorW
EnumDisplayMonitors
IntersectRect
DestroyMenu
GetMenuItemInfoA
RealChildWindowFromPoint
SetParent
MonitorFromPoint
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DestroyIcon
LoadImageA
LoadImageW
CopyImage
TrackMouseEvent
ShowWindow
GetMonitorInfoA
IsZoomed
CharUpperA
GetAsyncKeyState
SetCapture
ReleaseCapture
LoadMenuW
DeleteMenu
MessageBeep
NotifyWinEvent
WindowFromPoint
GetWindowRgn
PostMessageA
ReleaseDC
GetDC
SendMessageA
FillRect
GetClientRect
SystemParametersInfoA
DrawTextExA
IsRectEmpty
TabbedTextOutA
GrayStringA
GetSysColor
CopyRect
DrawTextA
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
OffsetRect
RedrawWindow
IsIconic
KillTimer
AppendMenuA
LoadIconW
SetTimer
DrawIcon
GetSystemMetrics
GetSystemMenu
GetWindowDC
BeginPaint
EndPaint
SetRect
ScreenToClient
GetMessageA
TranslateMessage
DispatchMessageA
PeekMessageA
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExA
CallNextHookEx
RegisterWindowMessageA
DrawEdge
DrawFrameControl
GetFocus
DrawStateA
SetWindowRgn
GetWindowRect
MapWindowPoints
GetSysColorBrush
DrawFocusRect
InflateRect
GetParent
DrawIconEx
PostQuitMessage
ShowOwnedPopups
SetCursor
IsWindowEnabled
MessageBoxA
GetWindowLongA
GetWindowThreadProcessId
GetLastActivePopup
GetMessagePos
GetMessageTime
DefWindowProcA
CallWindowProcA
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
IsWindow
IsMenu
IsChild
DestroyWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetDlgItem
GetDlgCtrlID
SetFocus
GetCapture
GetMenu
SetMenu
GetSubMenu
GetMenuItemID
SetMenuDefaultItem
ModifyMenuA
DestroyAcceleratorTable
SetClassLongA
GetUpdateRect
WaitMessage
UpdateLayeredWindow
CharNextA
CopyAcceleratorTableA
InvalidateRgn
GetNextDlgGroupItem
GetKeyboardLayout
GetKeyboardState
ToAsciiEx
LoadAcceleratorsW
CreateAcceleratorTableA
SubtractRect
RegisterClipboardFormatA
CharUpperBuffA
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
InsertMenuItemA
UnpackDDElParam
ReuseDDElParam
FrameRect
IsClipboardFormatAvailable
PostThreadMessageA
IsCharLowerA
MapVirtualKeyExA
DrawMenuBar
DefFrameProcA
DefMDIChildProcA
TranslateMDISysAccel
GetComboBoxInfo
CreateMenu
EnableScrollBar
GetMenuItemCount
TrackPopupMenu
UpdateWindow
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropA
GetPropA
RemovePropA
GetWindowTextA
GetWindowTextLengthA
AdjustWindowRectEx
EqualRect
PtInRect
SetWindowLongA
GetClassLongA
GetClassNameA
GetTopWindow
DestroyCursor
InvertRect
HideCaret
GetWindow
UnhookWindowsHookEx
SetCursorPos
UnionRect
BringWindowToTop
LockWindowUpdate
CreatePopupMenu
ClientToScreen
GetDoubleClickTime
LoadIconA
SetScrollInfo
GetScrollInfo
WinHelpA
MonitorFromWindow

gdi32

SetROP2
SetTextColor
SetTextAlign
MoveToEx
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
CreateEllipticRgn
CreateRectRgnIndirect
Ellipse
GetBkColor
GetTextColor
PatBlt
CreatePolygonRgn
Polygon
Polyline
GetTextMetricsA
CopyMetaFileA
CreateDCA
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
GetMapMode
SetPolyFillMode
DPtoLP
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateRoundRectRgn
Rectangle
GetRgnBox
OffsetRgn
RoundRect
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExA
LPtoDP
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
SetPixelV
GetTextFaceA
GetLayout
SetLayout
SetMapMode
DeleteDC
GetDeviceCaps
CreateFontIndirectA
GetStockObject
CreatePalette
RealizePalette
GetViewportOrgEx
GetObjectA
PtVisible
Escape
TextOutA
CreateRectRgn
GetWindowOrgEx
RectVisible
CreateCompatibleDC
GetDIBColorTable
GetTextExtentPoint32A
ExtTextOutA
CreateCompatibleBitmap
BitBlt
CreateBitmap
CreateHatchBrush
CreatePen
CreatePatternBrush
CreateSolidBrush
DeleteObject
ExcludeClipRect
GetClipBox
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
OffsetClipRgn
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetRectRgn

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegSetValueExA
RegQueryValueExA
RegCloseKey
LookupAccountNameW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom
CryptCreateHash
ConvertSidToStringSidA
RegOpenKeyExA
RegEnumKeyExA
RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA

shell32

ShellExecuteA
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHBrowseForFolderA
DragFinish
DragQueryFileA
SHGetFileInfoA
SHAppBarMessage
SHGetDesktopFolder
SHGetFolderPathA

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionA
PathFindFileNameA
PathIsUNCA
PathStripToRootA
PathRemoveFileSpecW
StrFormatKBSizeA

uxtheme

GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
GetWindowTheme
DrawThemeText
IsAppThemed
DrawThemeParentBackground
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData

ole32

IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
OleLockRunning
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoInitialize
CreateStreamOnHGlobal
CoSetProxyBlanket
CoCreateGuid
CoInitializeEx
CoCreateInstance
CoUninitialize
CoRevokeClassObject
CoRegisterMessageFilter
RevokeDragDrop

oleaut32

LoadTypeLi
OleCreateFontIndirect
VarBstrFromDate
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VariantInit
SysAllocStringLen
SysAllocStringByteLen
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
SysAllocString
VariantClear

oledlg

ord8

gdiplus

GdipFree
GdipCreateFromHDC
GdipSetTextRenderingHint
GdipDeleteGraphics
GdipGetImageWidth
GdipDrawImageRectRectI
GdipLoadImageFromStream
GdiplusStartup
GdiplusShutdown
GdipDrawImageI
GdipDrawImageRectI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipGetImageHeight
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipCreateBitmapFromHBITMAP

ws2_32

WSAStartup
WSACleanup
WSAGetLastError
setsockopt
getnameinfo
ioctlsocket
freeaddrinfo
getsockopt
recv
WSASetLastError
__WSAFDIsSet
WSAStringToAddressA
closesocket
select
shutdown
WSASocketW
getaddrinfo
getpeername
getsockname
send
socket
ntohs
connect

crypt32

CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertCloseStore

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

winmm

PlaySoundA

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 825KB - Virtual size: 824KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78bb0d471277a5916ad8adb089c3fdd2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

ws2_32

crypt32

version

winmm

oleacc

imm32

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 825KB - Virtual size: 824KB

.data Size: 50KB - Virtual size: 80KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 214KB - Virtual size: 213KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 825KB - Virtual size: 824KB

.data
Size: 50KB - Virtual size: 80KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 214KB - Virtual size: 213KB