edd62aa11f4de0da3e225971c4a8959124677574ca82064775c4af771c2fac02

Sharing

Copy URL Twitter E-mail

General

Target

edd62aa11f4de0da3e225971c4a8959124677574ca82064775c4af771c2fac02
Size

1.5MB
MD5

4aff611e84ab2997701865649c012424
SHA1

2de0191e0024c3b8279210674d9d69c91e17bef0
SHA256

edd62aa11f4de0da3e225971c4a8959124677574ca82064775c4af771c2fac02
SHA512

eb074c4e4be081dc883169f4ec75137b615c90fda33954c8b793d05fa8f378685ec3a166f233209de2a65369839813f8bce94c2a7c8c120c80777f3e0ee5fc41
SSDEEP

49152:x9fmrVgETWn/9/9kSrXbBFpNQenx6rUKm/cy:x9fcVgETWVaex6rBy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edd62aa11f4de0da3e225971c4a8959124677574ca82064775c4af771c2fac02

Files

edd62aa11f4de0da3e225971c4a8959124677574ca82064775c4af771c2fac02
.exe windows:6 windows x86 arch:x86

292a4082c75022f0be525d1fd3e7acb8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\data\landun\workspace\p-8e18b00276fd470e835a1e79d9eeecd4\src\bin\sogoupdb\sogouinput\crashrpt.pdb

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
VerQueryValueW
VerQueryValueA

kernel32

CreateMutexA
OutputDebugStringA
FreeLibrary
MultiByteToWideChar
GetSystemDirectoryA
Sleep
ReadFile
GetFileSize
CreateFileA
GlobalMemoryStatusEx
IsBadWritePtr
GetCurrentProcess
lstrlenW
WriteFile
TerminateProcess
GetModuleFileNameW
SetFilePointer
CreateFileW
GetCurrentThreadId
FormatMessageW
lstrcatW
LoadLibraryW
GetLocalTime
GetCurrentProcessId
CreateProcessW
GetModuleHandleW
lstrcpyW
GetTickCount
VirtualQuery
IsDebuggerPresent
SetUnhandledExceptionFilter
QueryDosDeviceW
FindFirstFileW
SetLastError
FindNextFileW
RemoveDirectoryW
GetTempPathW
FindClose
GetFileAttributesW
GetSystemDirectoryW
SetFileAttributesW
GetLogicalDriveStringsW
Process32NextW
FileTimeToSystemTime
Process32FirstW
MoveFileExW
GetTempFileNameW
GetCommandLineW
GlobalAlloc
GlobalFree
OpenMutexW
CreateDirectoryW
SetFileTime
GetProcessId
WaitForSingleObject
GetFileAttributesExW
DeleteFileW
SystemTimeToFileTime
CopyFileW
GetFileTime
GetExitCodeProcess
DuplicateHandle
ExitThread
CreateEventW
CreateThread
LocalFree
InitializeCriticalSectionAndSpinCount
GetVersionExW
LoadLibraryExW
GetWindowsDirectoryW
EnterCriticalSection
LeaveCriticalSection
Process32Next
HeapFree
lstrlenA
LocalAlloc
OutputDebugStringW
HeapAlloc
GetProcessHeap
DebugBreak
CreateMutexW
ReleaseMutex
VirtualFree
VirtualAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
SetEvent
OpenFileMappingW
UnmapViewOfFile
FlushViewOfFile
CreateFileMappingW
MapViewOfFile
OpenMutexA
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlCaptureStackBackTrace
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
VirtualProtect
SetProcessAffinityMask
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
WaitForMultipleObjectsEx
RtlUnwind
GetCommandLineA
ResumeThread
GetModuleHandleExW
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
ExitProcess
GetStdHandle
GetACP
HeapSize
GetFileType
GetConsoleCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
SetStdHandle
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
WriteConsoleW
GetTimeZoneInformation
GetDriveTypeW
IsValidCodePage
GetOEMCP
SetConsoleCtrlHandler
FindFirstFileExA
FindFirstFileExW
FindNextFileA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
SetEndOfFile
Process32First
CreateToolhelp32Snapshot
WideCharToMultiByte
CopyFileA
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
ReadProcessMemory
OpenProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
TryEnterCriticalSection
RaiseException
CloseHandle
DecodePointer
GetFileAttributesA
CreateDirectoryA
TerminateThread
FlushFileBuffers
SignalObjectAndWait

user32

GetWindowRect
SendMessageTimeoutW
GetDC
IsWindowVisible
SetWindowPos
MonitorFromRect
MonitorFromWindow
GetSystemMetrics
ShowWindow
GetMonitorInfoW
wsprintfW
GetForegroundWindow
EnumWindows
GetClassNameW
GetDesktopWindow
SystemParametersInfoW
GetParent
SetForegroundWindow
IsIconic
ReleaseDC
wvsprintfW
DispatchMessageW
PeekMessageW
UnregisterClassA
MsgWaitForMultipleObjectsEx
TranslateMessage
LoadStringW
CharNextW
FindWindowExW
WindowFromPoint
UnregisterClassW
GetFocus
SetRectEmpty
MessageBoxW
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
MonitorFromPoint

advapi32

RegEnumKeyW
GetNamedSecurityInfoW
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
EqualSid
GetAce
RegQueryValueExW
RegOpenKeyW
RegSetValueExW
GetTokenInformation
RegOpenKeyExW
OpenProcessToken
RegEnumKeyExW
RegDeleteKeyW
LookupAccountSidW
RegEnumValueW
RegDeleteValueW
RegCreateKeyExW
RegFlushKey
AddAce
RegQueryInfoKeyW
SetSecurityDescriptorSacl
LookupAccountNameW
AddAccessAllowedAce
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
GetFileSecurityW
GetSecurityDescriptorDacl
SetFileSecurityW
GetAclInformation
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

imm32

ImmDisableIME

psapi

GetProcessMemoryInfo
GetModuleInformation
GetModuleFileNameExW

wininet

InternetOpenA
InternetCloseHandle
InternetConnectA
InternetOpenUrlA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpEndRequestA
HttpAddRequestHeadersA
InternetSetOptionA
HttpOpenRequestA

gdi32

DeleteDC
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
StretchBlt
GetDeviceCaps
DeleteObject

shell32

SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW
SHFileOperationW
SHGetFolderPathW

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 20KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

292a4082c75022f0be525d1fd3e7acb8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

kernel32

user32

advapi32

imm32

psapi

wininet

gdi32

shell32

ole32

oleaut32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 216KB - Virtual size: 216KB

.data Size: 20KB - Virtual size: 157KB

.rsrc Size: 76KB - Virtual size: 76KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 216KB - Virtual size: 216KB

.data
Size: 20KB - Virtual size: 157KB

.rsrc
Size: 76KB - Virtual size: 76KB