0eb99820cb0e5b2ab8080c41cb3a4b19c3c5b37780deb780653439ec0af3bf60

Sharing

Copy URL

Twitter E-mail

General

Target

0eb99820cb0e5b2ab8080c41cb3a4b19c3c5b37780deb780653439ec0af3bf60
Size

3.2MB
MD5

bec23f5e49bc914e787d5f89975fc900
SHA1

8903d00292e12d7e227537ba1576fc07a859764a
SHA256

0eb99820cb0e5b2ab8080c41cb3a4b19c3c5b37780deb780653439ec0af3bf60
SHA512

7a1dfbbf6f546706689b7a95ba0946f36d54cd88ece7b8b72b88f7b1726817537f3d070d8c1b0bdeec672738520bc065fa58502478ad324afc125ab8d3562bbc
SSDEEP

98304:IMvC/RtGBTxZoio+2qn6jxQNI6g6S1gFp+/nUKOKDOGOnWgthVB:/C/LGKioj+Fp+/nUKOKDCWgzVB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0eb99820cb0e5b2ab8080c41cb3a4b19c3c5b37780deb780653439ec0af3bf60

Files

0eb99820cb0e5b2ab8080c41cb3a4b19c3c5b37780deb780653439ec0af3bf60
.exe windows:6 windows x86 arch:x86

20442868b4ae6705438f8bbad42c0bbd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Subproject\10x相关dll\CloudDog\Win32\Release\EpointZJCloudSvc.pdb

Imports

kernel32

WideCharToMultiByte
MultiByteToWideChar
WTSGetActiveConsoleSessionId
GetPrivateProfileStringW
ProcessIdToSessionId
GetFileAttributesW
WaitForSingleObject
CreateFileW
GetModuleFileNameW
SetConsoleTextAttribute
CloseHandle
Process32FirstW
Process32NextW
GetLastError
LocalFree
FormatMessageA
GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
GetTempPathW
AreFileApisANSI
GetModuleHandleW
GetProcAddress
MoveFileExW
GetFileInformationByHandleEx
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
Sleep
GetCPInfo
DeleteFileW
RemoveDirectoryW
SetEndOfFile
SetFilePointer
GetEnvironmentVariableW
SetEnvironmentVariableW
GetSystemInfo
GetVersionExW
GetComputerNameW
GetStdHandle
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetStartupInfoW
RaiseException
SetEvent
SetThreadPriority
GetExitCodeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InitializeCriticalSectionAndSpinCount
GetLongPathNameW
GetSystemDirectoryW
GetTimeZoneInformation
FlushFileBuffers
WriteFile
CreateEventW
ReadFile
FormatMessageW
ResetEvent
ReleaseMutex
CreateMutexW
WaitForMultipleObjects
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
IsDebuggerPresent
SetConsoleCtrlHandler
GetConsoleScreenBufferInfo
FreeLibrary
LoadLibraryW
CreateMutexA
ExitThread
CreateThread
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
DeleteFiber
GetFileType
ConvertFiberToThread
LoadLibraryA
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
VirtualFree
RtlUnwind
InterlockedPushEntrySList
LoadLibraryExW
FreeLibraryAndExitThread
ExitProcess
GetCommandLineA
GetCommandLineW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
SetFilePointerEx
GetConsoleOutputCP
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
WriteConsoleW
CreateToolhelp32Snapshot
OpenProcess

advapi32

CryptGenRandom
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
ChangeServiceConfigW
CloseServiceHandle
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
OpenProcessToken
RegEnumKeyExW
RegCloseKey
RegSetValueExW
DuplicateTokenEx
CreateProcessAsUserW
SetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW

userenv

CreateEnvironmentBlock

iphlpapi

GetAdaptersAddresses

ws2_32

WSAGetLastError
send
recv
WSASetLastError
closesocket
WSACleanup
WSAStartup

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

bcrypt

BCryptGenRandom

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 728KB - Virtual size: 728KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20442868b4ae6705438f8bbad42c0bbd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

userenv

iphlpapi

ws2_32

crypt32

bcrypt

user32

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 728KB - Virtual size: 728KB

.data Size: 43KB - Virtual size: 63KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 112KB - Virtual size: 112KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 728KB - Virtual size: 728KB

.data
Size: 43KB - Virtual size: 63KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 112KB - Virtual size: 112KB