c6840499137c0459503885d127af9313a060b2c9ec24c861c96219db6b997d0c

General

Target
c6840499137c0459503885d127af9313a060b2c9ec24c861c96219db6b997d0c
Size 4.1MB
Sample240912-kxpnlazflh
SHA256 c6840499137c0459503885d127af9313a060b2c9ec24c861c96219db6b997d0c
MD5 cb70bb3597ba353f6ba350d77213d4c1
SHA1 38e83fa2f9749ffc25a7315afa876abb94377487
SHA512 efefe46ff2e33d7e5b6a4f9fb608b78fc9adb2c756e1f3313de5a7896e4c9d2e85e06f56d1c791f435b346c2970dbddc0a2d9968d20eb0041ff42f76643872df
SSDEEP 98304:rMmHt1xZ37UW8JQ7Ay3yaThVK3cIbM5eWu6lWA/pZ1GF:ZHt1xZoW5Ay33hzaM5q1A/di
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/名单助手I.exe

File Explorer

c6840499137c0459503885d127af9313a060b2c9ec24c861c96219db6b997d0c

.zip 4.1MB
名单助手I.exe

.exe 6.1MB
说明.pdf

.pdf 124KB

c6840499137c0459503885d127af9313a060b2c9ec24c861c96219db6b997d0c

SHA256 c6840499137c0459503885d127af9313a060b2c9ec24c861c96219db6b997d0c
MD5 cb70bb3597ba353f6ba350d77213d4c1
SHA1 38e83fa2f9749ffc25a7315afa876abb94377487
SHA512 efefe46ff2e33d7e5b6a4f9fb608b78fc9adb2c756e1f3313de5a7896e4c9d2e85e06f56d1c791f435b346c2970dbddc0a2d9968d20eb0041ff42f76643872df
SSDEEP 98304:rMmHt1xZ37UW8JQ7Ay3yaThVK3cIbM5eWu6lWA/pZ1GF:ZHt1xZoW5Ay33hzaM5q1A/di
MD5 SHA1 SHA512 SSDEEP

名单助手I.exe

IMPHASH 55cae8aa72c6432871434d6510649354
SHA256 fc1f2107672a4af330678c2dd2ca7a2701e8d79123c339292a72f0d31ce296a0
MD5 74f27f7c16f1df18dabb2e7cdaa1a972
SHA1 d333a571677f1472d5fd26ffa43ad2f96dde18fd
SHA512 b07c3e66674b6809d6773a8d1387dcca6859698ecd4a0c37aac0bc6103fa25efa0d6ea6dd342c68201b21dcc54ae80c9c1fc2a9aeee70022d690570fb287b12b
SSDEEP 98304:LYYX5YQmdT8PRv0J0hx09BSpKki9jBGrisYdMLU9V09DsL2qEKqjb:kiby94pFKjBGr97eL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

20544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\xdebb2010改\2008\x64\Release\2008.pdb

kernel32

GetProcAddress LoadLibraryA GetConsoleWindow InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection RaiseException RtlPcToFileHeader TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleFileNameW RtlUnwindEx GetCommandLineA HeapSize HeapValidate IsBadReadPtr EncodePointer DecodePointer FlsGetValue FlsSetValue GetCurrentThreadId FlsAlloc FlsFree SetLastError GetLastError DebugBreak GetStdHandle WriteFile OutputDebugStringA WriteConsoleW GetFileType OutputDebugStringW GetModuleHandleW ExitProcess LoadLibraryW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetStartupInfoA HeapSetInformation HeapCreate HeapAlloc HeapReAlloc HeapQueryInformation HeapFree GetACP GetOEMCP GetCPInfo IsValidCodePage FlushFileBuffers GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP SetFilePointer CloseHandle CreateFileA

user32

UpdateWindow ShowWindow

Sharing

General

Malware Config

Signatures

File Explorer

c6840499137c0459503885d127af9313a060b2c9ec24c861c96219db6b997d0c

名单助手I.exe

kernel32

user32

generic

说明.pdf