9d5ce524dac48afdd0b496e4b3916ddfade3064583120085cea0d97aa40f3a5f

Sharing

Copy URL Twitter E-mail

General

Target

9d5ce524dac48afdd0b496e4b3916ddfade3064583120085cea0d97aa40f3a5f
Size

61KB
MD5

feccb1ca9572079e4a5fa937fc78cbd5
SHA1

02e410ed50da534df1bf6d9219e4b4df1cd5aa12
SHA256

9d5ce524dac48afdd0b496e4b3916ddfade3064583120085cea0d97aa40f3a5f
SHA512

c1f123634b1aa05400e0cc2d09282686489de4782ec1a2c256531bd333e4d143dec1ff7af47343f5833dacb31563a23ee012f5c423a7355e6e7709b5ceab4c1a
SSDEEP

1536:AVvawbAZwTqawgKCMw4XeXgLmqsIp2lCKaR:AswcGT18LeYsIpACK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9d5ce524dac48afdd0b496e4b3916ddfade3064583120085cea0d97aa40f3a5f

Files

9d5ce524dac48afdd0b496e4b3916ddfade3064583120085cea0d97aa40f3a5f
.exe windows:5 windows x86 arch:x86

86fb0d0839de9f0af7b836ea9d276007

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\05_Work\10_SVN\001_SVN2\003_项目源码\CFCA_Projects\0x0084_中核财务\src\JinKeSerivce\Release\JinKeSerivce.pdb

Imports

crypt32

CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertCloseStore
CertOpenStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore

setupapi

CM_Get_Device_IDW
CM_Locate_DevNodeW
CM_Get_Parent

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

kernel32

CreateFileMappingW
CreateEventW
Process32NextW
lstrcmpiW
lstrcatW
CreateToolhelp32Snapshot
Process32FirstW
LocalFree
lstrcpyW
CreateFileA
DeviceIoControl
HeapSize
HeapReAlloc
IsProcessorFeaturePresent
RtlUnwind
LoadLibraryW
GetLastError
GetModuleFileNameW
Sleep
OpenProcess
OutputDebugStringW
SetEvent
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
CreateMutexW
GetCommandLineW
ReadFile
SetFilePointer
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
WriteConsoleW
CloseHandle
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
DecodePointer
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetProcAddress
HeapFree
HeapAlloc
LCMapStringW
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
CreateFileW

user32

RegisterDeviceNotificationW
MessageBoxW
SendMessageW
wsprintfW
CharNextW
FindWindowW

advapi32

CloseServiceHandle
OpenProcessToken
DeleteService
OpenSCManagerW
StartServiceCtrlDispatcherW
OpenServiceW
ControlService
GetSecurityDescriptorSacl
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetServiceStatus
QueryServiceStatus
StartServiceW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
RegisterServiceCtrlHandlerExW
CreateServiceW

shell32

SHGetFolderLocation
SHGetPathFromIDListW

ole32

CoTaskMemFree

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86fb0d0839de9f0af7b836ea9d276007

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

setupapi

userenv

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB