bbd667e8388a284a3567ab1bb2ccca827ed60519c87bfe5175c3b8c1bb3223fc

Sharing

Copy URL Twitter E-mail

General

Target

bbd667e8388a284a3567ab1bb2ccca827ed60519c87bfe5175c3b8c1bb3223fc
Size

503KB
MD5

49c25842b928779b8db66f963d5f3804
SHA1

7e51ff6563a3869c4bc0cdf0e36fc0dcffc84b7f
SHA256

bbd667e8388a284a3567ab1bb2ccca827ed60519c87bfe5175c3b8c1bb3223fc
SHA512

fe1c16818089b16404210322aaf35810addc58ab6089741de066bb24c4639ae9df8096a561ded63845b2aaedca964b309a15d4d4e89845a16b4297e31f417d79
SSDEEP

12288:lmYrKaeViZ4vK+30HykG32nVEO3LlvGUqHOHTznugUZlZcKMZLUfs:eiqK+SykG32nuMGUAOHnVAXsLU0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bbd667e8388a284a3567ab1bb2ccca827ed60519c87bfe5175c3b8c1bb3223fc

Files

bbd667e8388a284a3567ab1bb2ccca827ed60519c87bfe5175c3b8c1bb3223fc
.exe windows:5 windows x86 arch:x86

5904630d4234b0e82e44508adb8ba4d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\zhanlue\2345uninst\bin\Win32\Release\pdb\2345Uninst.pdb

Imports

kernel32

FindFirstFileW
GetLongPathNameW
CreateFileW
GetFileAttributesExW
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetCurrentProcess
TerminateProcess
OpenProcess
GetCurrentProcessId
LoadLibraryW
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FindNextFileW
FindClose
ReadFile
WriteFile
SetFilePointer
SetEndOfFile
GetFileSize
FormatMessageW
LocalFree
CreateDirectoryW
GetFullPathNameW
lstrlenW
RemoveDirectoryW
GetTempPathW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
MoveFileExW
MoveFileW
HeapFree
GetCurrentThreadId
HeapAlloc
GetProcessHeap
QueryDosDeviceW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
GetLastError
GetLogicalDriveStringsW
GetACP
MultiByteToWideChar
WideCharToMultiByte
ExpandEnvironmentStringsW
LoadLibraryA
lstrcatW
lstrcpyW
GetFileSizeEx
CreateProcessW
GetExitCodeProcess
LoadLibraryExW
GetEnvironmentVariableW
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
Sleep
SearchPathW
lstrcmpiW
GetModuleHandleW
GetProcAddress
FindResourceW
LoadResource
LockResource
GetVersionExW
SetErrorMode
CloseHandle
GetPrivateProfileStringW
LCMapStringW
GetFileType
GetStringTypeW
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlUnwind
SetLastError

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegOpenCurrentUser
RegCloseKey

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
CommandLineToArgvW

ole32

CoTaskMemFree

imm32

ImmDisableIME

shlwapi

SHDeleteKeyW

Exports

Exports

CheckSigner

Sections

.text
Size: 240KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 83KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5904630d4234b0e82e44508adb8ba4d6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

ole32

imm32

shlwapi

Exports

Exports

Sections

.text Size: 240KB - Virtual size: 239KB

.rdata Size: 54KB - Virtual size: 53KB

.data Size: 3KB - Virtual size: 7KB

.rsrc Size: 103KB - Virtual size: 102KB

.reloc Size: 83KB - Virtual size: 84KB

.text
Size: 240KB - Virtual size: 239KB

.rdata
Size: 54KB - Virtual size: 53KB

.data
Size: 3KB - Virtual size: 7KB

.rsrc
Size: 103KB - Virtual size: 102KB

.reloc
Size: 83KB - Virtual size: 84KB