d69f744fe8d9884ab8b3e3b345f230480e35dce2e96ceab91b5f13192f045610

Sharing

Copy URL

Twitter E-mail

General

Target

d69f744fe8d9884ab8b3e3b345f230480e35dce2e96ceab91b5f13192f045610
Size

1.8MB
MD5

507c2728ba08f885fc759122bec3976f
SHA1

8bb0dafbc7d605672c13b72c8df4996e80457f5b
SHA256

d69f744fe8d9884ab8b3e3b345f230480e35dce2e96ceab91b5f13192f045610
SHA512

20a23708820c677a5d43f25fab9de40f2b501404a05254b51990869d39cf338c82fc7e717a423cdb800b83615b1300c5b6e1471dac376c493e80ccf50e60139d
SSDEEP

49152:2pkodX1G3mDdfGLZy/M/UKzgXadbUfudZYs+r:2pkots3Idf3hXady

Score

1^/10

Malware Config

Signatures

Files

d69f744fe8d9884ab8b3e3b345f230480e35dce2e96ceab91b5f13192f045610
.exe windows:4 windows x86 arch:x86

ec6158bd4c46731e45e42513f74754bf

Code Sign

66:83:3f:6d:ef:63:d5:47:b4:1e:63:76:c0:14:a3:a9
Certificate

Issuer

CN=Matawork,ST=Beijing,C=China

Not Before

19/11/2024, 16:54

Not After

30/12/2099, 16:00

Subject

CN=Matawork,ST=Beijing,C=China

22:86:e9:12:ba:b1:03:4f:d8:e9:9d:70:35:f6:06:ab:f6:df:1c:7e
Signer

Actual PE Digest

22:86:e9:12:ba:b1:03:4f:d8:e9:9d:70:35:f6:06:ab:f6:df:1c:7e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
InterlockedIncrement
InterlockedDecrement
IsBadWritePtr
lstrlenW
FatalAppExitA
DebugBreak
lstrcpyW
FreeResource
FindResourceW
LoadResource
GetCurrentProcess
GetTickCount
SizeofResource
GetConsoleWindow
GetFileAttributesW
GetModuleFileNameW
GetLongPathNameW
LockResource
CloseHandle
GetFileSize
_llseek
WriteFile
ReadFile
CreateFileW
VirtualFree
FreeLibrary
SetDllDirectoryW
WaitForSingleObject
GetDllDirectoryW
CreateRemoteThread
InitializeCriticalSection
OpenProcess
VirtualFreeEx
LoadLibraryW
ReadProcessMemory
LeaveCriticalSection
GetProcAddress
VirtualAlloc
EnterCriticalSection
VirtualAllocEx
OpenThread
GetProcessId
GetExitCodeThread
GetSystemInfo
DeleteCriticalSection
GetCurrentThreadId
GetCurrentProcessId
WriteProcessMemory
SetFilePointer
GetCurrentThread
TerminateThread
Sleep
SuspendThread
ResumeThread
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
GetLocalTime
GetSystemTime
AllocConsole
SetEndOfFile
FlushConsoleInputBuffer
ReadConsoleW
SetConsoleCP
SetConsoleMode
GetConsoleOutputCP
LocalFree
GetFileType
SetConsoleCtrlHandler
SetConsoleOutputCP
SetConsoleWindowInfo
SetConsoleTitleW
GetNativeSystemInfo
HeapAlloc
HeapFree
GetProcessHeap
IsBadReadPtr
SetLastError
LoadLibraryA
VirtualProtect
GetCPInfo
GetOEMCP
IsValidCodePage
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
EncodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetFullPathNameW
HeapReAlloc
InterlockedExchange
GetStringTypeW
ExitThread
CreateThread
RtlUnwind
GetTimeFormatW
GetDateFormatW
DuplicateHandle
CreateProcessA
DeleteFileW
MoveFileW
SetStdHandle
InitializeCriticalSectionAndSpinCount
CreateProcessW
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
FlushFileBuffers
IsProcessorFeaturePresent
CompareStringW
CreateFileA
CreatePipe
GetExitCodeProcess
HeapSize
WriteConsoleW
GetCurrentDirectoryW
GetDriveTypeW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FormatMessageA
GetModuleFileNameA
GetModuleHandleA
SetErrorMode
GetStdHandle
GetACP

user32

GetClientRect
CallWindowProcA
MapWindowPoints
LoadIconA
CopyImage
RegisterClassA
IsWindow
IsWindowVisible
EqualRect
SetWindowPos
GetActiveWindow
ShowWindow
GetSystemMenu
SetActiveWindow
IsIconic
ModifyMenuA
GetWindowThreadProcessId
GetMessageW
TranslateMessage
PeekMessageW
DispatchMessageW
SendMessageA
SetForegroundWindow
MessageBoxW
SetWindowRgn
GetWindowRect
wsprintfA
SetFocus
OffsetRect
IntersectRect
MessageBoxA
GetWindowLongA
CreateWindowExA
DefWindowProcA
WinHelpA

ole32

OleRegGetUserType
CreateOleAdviseHolder
CoTaskMemAlloc
OleCreate
OleSetContainedObject
StringFromIID
CLSIDFromString
CLSIDFromProgID
CoRegisterClassObject
CoRevokeClassObject
MkParseDisplayName
CreateBindCtx
CoCreateInstance
GetRunningObjectTable
CoTaskMemFree
StringFromCLSID
OleInitialize
OleUninitialize
CoLockObjectExternal

shlwapi

SHDeleteKeyA
StrFormatByteSizeW

gdi32

SetViewportOrgEx
SetWindowOrgEx
DeleteObject
CreateRectRgnIndirect
SetViewportExtEx
SetWindowExtEx
SetMapMode

advapi32

RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA

shell32

ord165

oleaut32

SysFreeString
OleSavePictureFile
UnRegisterTypeLi
GetActiveObject
VariantInit
VariantCopyInd
VariantClear
LoadTypeLibEx
SysAllocString
SysAllocStringLen
LoadRegTypeLi
SysStringByteLen
LHashValOfNameSys
SafeArrayCreateVector
VariantTimeToSystemTime
SafeArrayAccessData
VariantCopy
SafeArrayDestroy
SafeArrayCreate
SystemTimeToVariantTime
SafeArrayGetDim
VariantChangeType
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayPutElement
DispGetIDsOfNames
SysStringLen

Sections

.text
Size: 594KB - Virtual size: 593KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec6158bd4c46731e45e42513f74754bf

Code Sign

66:83:3f:6d:ef:63:d5:47:b4:1e:63:76:c0:14:a3:a9Certificate

22:86:e9:12:ba:b1:03:4f:d8:e9:9d:70:35:f6:06:ab:f6:df:1c:7eSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

shlwapi

gdi32

advapi32

shell32

oleaut32

Sections

.text Size: 594KB - Virtual size: 593KB

.rdata Size: 107KB - Virtual size: 106KB

.data Size: 9KB - Virtual size: 18KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

66:83:3f:6d:ef:63:d5:47:b4:1e:63:76:c0:14:a3:a9
Certificate

22:86:e9:12:ba:b1:03:4f:d8:e9:9d:70:35:f6:06:ab:f6:df:1c:7e
Signer

.text
Size: 594KB - Virtual size: 593KB

.rdata
Size: 107KB - Virtual size: 106KB

.data
Size: 9KB - Virtual size: 18KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB