6a1812985c7046d74bad4ce5425b8545e7c25f4ccbae278db7ad1f3d6ed97d84N

Sharing

Copy URL Twitter E-mail

General

Target

6a1812985c7046d74bad4ce5425b8545e7c25f4ccbae278db7ad1f3d6ed97d84N
Size

6.0MB
MD5

2b4ebaa47dcd4c9573554e65ece76e20
SHA1

599170c8f2958939b1df08a605323b85720538d5
SHA256

6a1812985c7046d74bad4ce5425b8545e7c25f4ccbae278db7ad1f3d6ed97d84
SHA512

354666be81d517069da88c24f25448254a2359c712949637fd9a51a296da1559ac9d93bfe5004c7b19c67adf1653ae6499210dc6233c739e819d31d06ca9920c
SSDEEP

768:TdC8dO8Zid4E8jmmSYhavIHo7Wsx2EDgAnUGy8XcuNj:Tdn3ZAtWuoo7W2lMgj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a1812985c7046d74bad4ce5425b8545e7c25f4ccbae278db7ad1f3d6ed97d84N

Files

6a1812985c7046d74bad4ce5425b8545e7c25f4ccbae278db7ad1f3d6ed97d84N
.exe windows:5 windows x86 arch:x86

26fa80116806052f35fe78172330349d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\下载者\下载者_VS2010\下载者\Release\下载者.pdb

Imports

kernel32

MoveFileExW
WaitForSingleObject
GetTickCount
GetPrivateProfileStringW
WriteFile
OpenProcess
LoadLibraryW
Sleep
CopyFileW
TerminateProcess
GetModuleFileNameW
CreateFileW
lstrcatA
lstrlenW
WritePrivateProfileStringW
GetTempPathW
GetPrivateProfileIntW
MoveFileW
Process32FirstW
Process32NextW
lstrcmpiW
lstrcatW
CreateToolhelp32Snapshot
CloseHandle
GetWindowsDirectoryW
DeleteFileW
lstrcpyW
CreateThread
lstrcpyA
MultiByteToWideChar
LCMapStringW
IsProcessorFeaturePresent
HeapReAlloc
HeapAlloc
HeapSize
SetFilePointer
GetProcAddress
ExitProcess
WideCharToMultiByte
RtlUnwind
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
DecodePointer
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW

user32

wsprintfW
EnumChildWindows
SendMessageW
EnumWindows
PostMessageW

advapi32

RegCloseKey
RegCreateKeyW
RegSetValueExW

shell32

ShellExecuteW

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26fa80116806052f35fe78172330349d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

Sections

.text Size: 20KB - Virtual size: 20KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 2KB - Virtual size: 2KB