e39067780d5e4303bbb0ad175580c1381a23eda186f80605a5863d76757418b1

Sharing

Copy URL Twitter E-mail

General

Target

e39067780d5e4303bbb0ad175580c1381a23eda186f80605a5863d76757418b1
Size

1.2MB
MD5

da0c8bb65e9ab0d13c2d25006a2d03f1
SHA1

170b22805b08453043b5da1a0c78fe585ab388bc
SHA256

e39067780d5e4303bbb0ad175580c1381a23eda186f80605a5863d76757418b1
SHA512

310b42af323213f9c208f94e2fe5a1158bcfb83185a39db47b7df2f38a3b90bdc76be07d7c894ae3d9683e6641c1f68261c94bf16c6409fae22089f5ce04cd14
SSDEEP

12288:/TvwGbf3kjwfO2TT9UFD2nvFvIhuMRUB8HHi7YXmaaEaS53GeuENP9320W7G:jwGbf3k2OHs5IFUB8ni7YW1jKBP93207

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e39067780d5e4303bbb0ad175580c1381a23eda186f80605a5863d76757418b1

Files

e39067780d5e4303bbb0ad175580c1381a23eda186f80605a5863d76757418b1
.exe windows:6 windows x86 arch:x86

dfffcac19cde4922cc8e014f277fe49d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\landun\wubi_agent\workspace\p-3417ba0c0c0d46dfae3a04bc6431244c\src\bin\SogouPdb\SogouWubi\ScdReg.pdb

Imports

imm32

ImmDisableIME

kernel32

IsProcessorFeaturePresent
FindFirstFileW
HeapFree
FindNextFileW
GetTempPathW
InitializeCriticalSectionEx
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
GetDriveTypeW
GetCurrentDirectoryW
FindResourceW
LoadResource
FindResourceExW
LockResource
SizeofResource
FindClose
HeapSize
GetLastError
QueryPerformanceFrequency
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
ReadFile
SetLastError
WriteFile
SetFilePointer
CreateFileW
SetFileAttributesW
Sleep
CloseHandle
GetFileSize
FlushFileBuffers
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
GetCurrentProcess
GetModuleFileNameW
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
LoadLibraryW
FreeLibrary
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetCurrentThreadId
ExitThread
CreateEventW
FormatMessageW
GlobalAlloc
GlobalFree
CreateThread
LocalFree
CreateProcessW
RemoveDirectoryW
GetFileAttributesW
GetVersionExW
GetSystemDirectoryW
DeleteFileW
MoveFileExW
CreateDirectoryW
WaitForSingleObject
GetFileAttributesExW
FileTimeToSystemTime
CopyFileW
LocalAlloc
OpenEventW
CreateMutexW
ReleaseMutex
OpenMutexW
QueryPerformanceCounter
SetEvent
IsBadWritePtr
lstrlenW
TerminateProcess
GetProcessHeap
GetLocalTime
lstrcpyW
VirtualQuery
IsDebuggerPresent
SetUnhandledExceptionFilter
HeapCreate
GetStringTypeW
EncodePointer
GetCPInfo
CompareStringW
LCMapStringW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
lstrcatW
GetStartupInfoW
InitializeSListHead
RtlUnwind
LoadLibraryExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
GetACP
GetFileType
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetEndOfFile
ReadConsoleW
WriteConsoleW

user32

IsWindowVisible
GetWindowThreadProcessId
CreateWindowExW
wvsprintfW
SetWindowTextW
SetTimer
TrackMouseEvent
IsDlgButtonChecked
SetPropW
GetWindowDC
GetClientRect
GetDlgItem
DrawTextW
CheckDlgButton
GetParent
DialogBoxParamW
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
GetWindowTextW
RemovePropW
GetWindowLongW
CallWindowProcW
GetWindowRect
GetDC
SetWindowPos
MessageBoxW
GetPropW
ScreenToClient
SendMessageW
GetClassNameW
GetSystemMetrics
EndDialog
SetWindowLongW
SetRectEmpty
DefWindowProcW

gdi32

GetObjectW
CreateSolidBrush
DeleteObject
SelectObject
GetStockObject
GetTextExtentPoint32W
SetTextColor
SetBkMode
CreateFontIndirectW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

psapi

GetProcessMemoryInfo

wininet

HttpQueryInfoW
InternetCloseHandle
InternetSetOptionW
InternetOpenW
InternetWriteFile
InternetCrackUrlA
HttpEndRequestW
HttpSendRequestExW
InternetConnectA
HttpAddRequestHeadersW
HttpOpenRequestA
InternetOpenUrlW

advapi32

CryptAcquireContextW
CryptSetKeyParam
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
RegQueryValueExW
RegOpenKeyW
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
InitializeAcl
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
AddAccessAllowedAceEx
GetLengthSid
OpenProcessToken
LookupAccountSidW
GetTokenInformation
RegCloseKey
RegEnumKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW

shell32

SHFileOperationW
ShellExecuteW
SHGetFolderPathW

Sections

.text
Size: 689KB - Virtual size: 688KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 383KB - Virtual size: 382KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 76KB - Virtual size: 417KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dfffcac19cde4922cc8e014f277fe49d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

imm32

kernel32

user32

gdi32

version

psapi

wininet

advapi32

shell32

Sections

.text Size: 689KB - Virtual size: 688KB

.rdata Size: 383KB - Virtual size: 382KB

.data Size: 76KB - Virtual size: 417KB

.rsrc Size: 92KB - Virtual size: 96KB

.text
Size: 689KB - Virtual size: 688KB

.rdata
Size: 383KB - Virtual size: 382KB

.data
Size: 76KB - Virtual size: 417KB

.rsrc
Size: 92KB - Virtual size: 96KB