bdcb913450c2e7815ba73af81b3442c579024364142b79ba3f564c4bcd7a3a6b

Sharing

Copy URL Twitter E-mail

General

Target

bdcb913450c2e7815ba73af81b3442c579024364142b79ba3f564c4bcd7a3a6b
Size

128KB
MD5

d0eae534a8ab3b2f4cfbb8a65f5aeced
SHA1

14f272b2bac9182049f90a98c6f53934fafb263e
SHA256

bdcb913450c2e7815ba73af81b3442c579024364142b79ba3f564c4bcd7a3a6b
SHA512

3603c6592deaacff451d0e99b4b785b5fb7be8f3adaf975245f3326a769592db93c777e2eb7552e207c3f82934a51b7a27421c6132a980a618c5a1feeb8adac5
SSDEEP

3072:TWzDGmShwUAhNp5sJCj91cNSAJ/HQ4Ee6Wqre:5hwUAhNp5nx1c4AHf9d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bdcb913450c2e7815ba73af81b3442c579024364142b79ba3f564c4bcd7a3a6b

Files

bdcb913450c2e7815ba73af81b3442c579024364142b79ba3f564c4bcd7a3a6b
.exe windows:6 windows x64 arch:x64

eea9e00175c029771e07d987cd833f97

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Code\wt\WeTool\Src\Release\WeChatService.pdb

Imports

kernel32

GetCurrentProcess
CreateFileW
GetCurrentThreadId
MultiByteToWideChar
Sleep
K32GetProcessMemoryInfo
CloseHandle
LoadLibraryW
GetProcAddress
GetCurrentProcessId
FreeLibrary
IsDebuggerPresent
SetUnhandledExceptionFilter
WriteConsoleW
HeapReAlloc
HeapSize
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetFileType
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
GetProcessHeap

shell32

SHGetSpecialFolderPathA

servicebasic

?InitService@ServiceBasic@@SAXXZ
?GetPipeConnectState@ServiceBasic@@SA_NXZ
?GetCurVersion@ServiceBasic@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Quit@ServiceBasic@@SA_NXZ
?GetCurName@ServiceBasic@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?StopService@ServiceBasic@@SAXXZ

Sections

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eea9e00175c029771e07d987cd833f97

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

servicebasic

Sections

.text Size: 74KB - Virtual size: 74KB

.rdata Size: 41KB - Virtual size: 40KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 5KB - Virtual size: 5KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 74KB - Virtual size: 74KB

.rdata
Size: 41KB - Virtual size: 40KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 5KB - Virtual size: 5KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB