e2cb4048f4a54e2338f5ea845d026b299128f32d8847e1e2e5b59a6a9f4b6790

Sharing

Copy URL

Twitter E-mail

General

Target

e2cb4048f4a54e2338f5ea845d026b299128f32d8847e1e2e5b59a6a9f4b6790
Size

5.2MB
MD5

58770c2e0a87fea9436641f62afdf23c
SHA1

dbec9b90f99ee03440e88f48a14091dc9ff7cf1f
SHA256

e2cb4048f4a54e2338f5ea845d026b299128f32d8847e1e2e5b59a6a9f4b6790
SHA512

1f346e5a1ea1b115197096130bb890ac784e3a513e9074b5ca10ffdcbe9b365f51488ff2d8c34e20fe02680660603011c61c23f9ca6ab6eca652d0de2280ef24
SSDEEP

98304:wM7dFiMbcDFzylJs8IIUOUpTfyqBRFmS0ONljFfl+5bPBBBBBBBBBBBBBU22V:f7zlJ1IIwTfvR8S0WljSbPBBBBBBBBBa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e2cb4048f4a54e2338f5ea845d026b299128f32d8847e1e2e5b59a6a9f4b6790

Files

e2cb4048f4a54e2338f5ea845d026b299128f32d8847e1e2e5b59a6a9f4b6790
.exe windows:6 windows x86 arch:x86

a2fbc31f4bf142a983015210bcdab18e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\kele-installer\src\KeleInstaller\Builds\VisualStudio2017\Win32\ReleasePsBaiDU\App\Adobe Potoshop.pdb

Imports

kernel32

GetModuleHandleExW
DeviceIoControl
RemoveDirectoryW
SetFileTime
GetModuleFileNameW
SetThreadPriority
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
SetEndOfFile
GetTempPathW
CreateMutexW
FindClose
GetLocaleInfoW
CreateFileW
GetFileAttributesW
GetCurrentThreadId
ReleaseMutex
GetSystemDirectoryW
ResumeThread
CreateEventW
FormatMessageW
GetFileAttributesExW
OutputDebugStringW
SetEvent
GetLogicalProcessorInformation
GetCurrentThread
TerminateThread
QueryPerformanceFrequency
GetThreadPriority
DeleteFileW
GetCurrentDirectoryW
ReplaceFileW
ExitProcess
CopyFileW
CreateSymbolicLinkW
QueryPerformanceCounter
MoveFileW
IsDebuggerPresent
SetUnhandledExceptionFilter
FlushFileBuffers
GetCommandLineW
AttachConsole
CompareStringOrdinal
GlobalSize
LoadLibraryA
GlobalAlloc
GlobalFree
GlobalLock
FindNextFileW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
GetOEMCP
GetACP
IsValidCodePage
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
ExitThread
GetTimeZoneInformation
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualFree
VirtualProtect
VirtualAlloc
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
CreateThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
GetStringTypeW
LCMapStringW
CompareStringW
GetCPInfo
EncodePointer
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
SetLastError
GetCurrentProcess
EnterCriticalSection
SetPriorityClass
FindFirstFileW
SetThreadAffinityMask
CreateDirectoryW
GetExitCodeProcess
GetModuleHandleA
WaitForSingleObject
CreatePipe
WriteFile
SetHandleInformation
ReadFile
GetDiskFreeSpaceExA
GetCurrentProcessId
GetLogicalDriveStringsA
K32EnumProcesses
CloseHandle
Process32FirstW
QueryFullProcessImageNameA
InitializeCriticalSectionEx
Process32NextW
CreateToolhelp32Snapshot
OpenProcess
GetDriveTypeA
TerminateProcess
GetModuleHandleW
GetTickCount
VerifyVersionInfoW
FreeLibrary
VerSetConditionMask
GetProcAddress
LoadLibraryW
Sleep
GetVersionExW
WideCharToMultiByte
GetProcessHeap
HeapDestroy
HeapAlloc
HeapReAlloc
MultiByteToWideChar
HeapSize
HeapFree
GlobalMemoryStatusEx
DeleteCriticalSection
TryEnterCriticalSection
DecodePointer
RaiseException
GetLastError
GlobalUnlock
WriteConsoleW

user32

EnumChildWindows
MonitorFromWindow
EnumDisplayMonitors
SetWindowPos
UnregisterClassW
AttachThreadInput
GetWindowThreadProcessId
GetWindowTextW
SetWindowLongW
TranslateMessage
EnumWindows
PeekMessageW
DispatchMessageW
RegisterClassExW
CreateWindowExW
IsWindowVisible
GetWindowRect
MapVirtualKeyW
GetMessagePos
GetUpdateRgn
GetMessageExtraInfo
GetSystemMenu
SetFocus
SendMessageW
DestroyWindow
GetFocus
SendMessageTimeoutW
PostMessageW
DefWindowProcW
GetMessageW
GetWindowLongW
ReleaseDC
GetDC
EndPaint
BeginPaint
GetCursorPos
SetCursorPos
GetAncestor
InvalidateRect
ReleaseCapture
GetParent
SystemParametersInfoW
EnableMenuItem
GetDesktopWindow
ShowCaret
UpdateLayeredWindow
SetCursor
ToUnicode
SetClipboardData
SetWindowsHookExW
SetCapture
DestroyCaret
LoadCursorW
GetClipboardData
BringWindowToTop
SetLayeredWindowAttributes
GetMessageTime
UnhookWindowsHookEx
GetForegroundWindow
TrackMouseEvent
MapWindowPoints
CreateCaret
GetActiveWindow
IsChild
EmptyClipboard
CloseClipboard
CreateIconIndirect
GetMonitorInfoW
GetWindowInfo
DestroyIcon
RedrawWindow
GetCapture
OpenClipboard
GetAsyncKeyState
IsWindow
ShowWindow
CallNextHookEx
SetWindowTextW
MessageBeep
WindowFromPoint
GetWindowPlacement
DestroyCursor
GetKeyboardState
SetCaretPos

gdi32

SelectObject
GetKerningPairsW
CreateCompatibleDC
GetTextMetricsW
DeleteDC
SetMapperFlags
GetGlyphIndicesW
GetGlyphOutlineW
DeleteObject
CombineRgn
SetMapMode
GetOutlineTextMetricsW
ExcludeClipRect
GetRegionData
CreateRectRgn
CreateRectRgnIndirect
StretchDIBits
CreateDIBSection
SaveDC
CreateBitmap
RemoveFontMemResourceEx
RestoreDC
GetDeviceCaps
CreateFontIndirectW

advapi32

RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

shell32

ExtractAssociatedIconW
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ShellExecuteW
DragQueryFileW

ole32

RevokeDragDrop
RegisterDragDrop
CoCreateGuid
CoTaskMemAlloc
OleInitialize
OleUninitialize
CoUninitialize
CoInitialize
CoCreateInstance
DoDragDrop

oleaut32

SysAllocString
SafeArrayPutElement
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayDestroy

wininet

HttpSendRequestExW
InternetOpenW
InternetCrackUrlW
FtpOpenFileW
InternetWriteFile
InternetQueryOptionW
HttpOpenRequestW
HttpEndRequestW
HttpQueryInfoW
InternetCloseHandle
InternetConnectW
InternetSetOptionW
InternetReadFile
InternetSetFilePointer

ws2_32

WSAGetLastError

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

winmm

timeGetTime
timeBeginPeriod

imm32

ImmAssociateContextEx
ImmSetCandidateWindow
ImmAssociateContext
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmNotifyIME

dxgi

CreateDXGIFactory

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 632KB - Virtual size: 636KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a2fbc31f4bf142a983015210bcdab18e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

ws2_32

version

winmm

imm32

dxgi

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 3.3MB - Virtual size: 3.3MB

.data Size: 46KB - Virtual size: 51KB

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 632KB - Virtual size: 636KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 3.3MB - Virtual size: 3.3MB

.data
Size: 46KB - Virtual size: 51KB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 632KB - Virtual size: 636KB