10bb5bd4427c59a3bff714043db05d2bc592fed4411166bf357e720180aa58b4

Sharing

Copy URL

Twitter E-mail

General

Target

10bb5bd4427c59a3bff714043db05d2bc592fed4411166bf357e720180aa58b4
Size

893KB
MD5

38990c0f4da94f31cf3e461805640734
SHA1

8327dd0a1a32b34652153ee518c088ea1e8deaf5
SHA256

10bb5bd4427c59a3bff714043db05d2bc592fed4411166bf357e720180aa58b4
SHA512

0ea51ba8328f30c084d724af2b612282e8e4b94eaf6883e07dc18aaedf7d399c792abd1b86e89300311412f4cd5676e93d90c238d90de1103be09858e9555556
SSDEEP

24576:ZlKZJxp/5Cs7kFuQJ2bk8X0d2TTvIg/CHnUapvd+4L:zKZTp/5Cs7kFuQJ2Ay0d2TTvnCHnUa1/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10bb5bd4427c59a3bff714043db05d2bc592fed4411166bf357e720180aa58b4

Files

10bb5bd4427c59a3bff714043db05d2bc592fed4411166bf357e720180aa58b4
.dll windows:6 windows x86 arch:x86

23c2f9f56503c388567df7b9690537b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesExW
GetFileTime
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
DeviceIoControl
CopyFileW
MoveFileExW
AreFileApisANSI
IsValidCodePage
IsDBCSLeadByteEx
GlobalFree
lstrcpynW
GlobalAlloc
ReadConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
FindNextFileA
GetTimeZoneInformation
ReadFile
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetEnvironmentVariableW
GetACP
ExitProcess
GetStartupInfoW
DeleteFileW
GetCurrentThreadId
OpenMutexA
K32GetModuleFileNameExW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MultiByteToWideChar
WTSGetActiveConsoleSessionId
VerifyVersionInfoW
LoadLibraryW
FormatMessageW
FormatMessageA
LocalFree
LocalAlloc
GetModuleFileNameA
FreeLibrary
VirtualQuery
GetComputerNameExA
OpenProcess
CreateProcessA
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
WaitForSingleObject
TryEnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
GetFileAttributesW
GetFileAttributesA
CreateFileW
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
SetEnvironmentVariableA
VerSetConditionMask
WideCharToMultiByte
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
RtlUnwind
InterlockedFlushSList
InterlockedPushEntrySList
CreateProcessW
CreateDirectoryW
HeapAlloc
RaiseException
DecodePointer
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetNativeSystemInfo
GetSystemDirectoryA
GetLastError
FindFirstFileExA
QueryPerformanceCounter
WaitForSingleObjectEx
GetCurrentThread
EnterCriticalSection
GetCPInfo
EncodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
SetEvent
ResetEvent
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
OutputDebugStringW
CreateThread
GetThreadTimes
GetModuleFileNameW
LoadLibraryExW

user32

LoadImageA
MessageBoxA
IsWindow
SendMessageW
wsprintfW
SwitchToThisWindow
GetForegroundWindow
AttachThreadInput
SetForegroundWindow
ShowWindow
SetWindowPos
GetWindowThreadProcessId
GetWindowLongW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear
VariantChangeType

advapi32

RegEnumValueA
RegOpenKeyExW
CreateProcessAsUserW
OpenProcessToken
AddAce
AdjustTokenPrivileges
DuplicateTokenEx
EqualSid
GetAce
GetAclInformation
RegCreateKeyA
RegEnumKeyExW
RegQueryValueExW
ConvertSidToStringSidW
ConvertSidToStringSidA
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteValueA
CreateProcessWithTokenW
CreateProcessAsUserA
GetUserNameA
LookupPrivilegeValueW
LookupAccountNameW
LookupAccountNameA
SetTokenInformation
SetSecurityDescriptorDacl
SetSecurityDescriptorControl
SetFileSecurityW
RevertToSelf
IsValidSid
InitializeSecurityDescriptor
InitializeAcl
ImpersonateLoggedOnUser
GetTokenInformation
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetFileSecurityW
RegCloseKey

shlwapi

StrStrIA
PathRemoveFileSpecA
PathFindFileNameW
PathAppendA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

wtsapi32

WTSEnumerateSessionsW
WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsExW

iphlpapi

GetAdaptersInfo

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

crypt32

CryptMsgGetParam
CertOpenStore
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CryptMsgClose

imm32

ImmDisableIME

Exports

Exports

GetCurrentUserSid
Log
StartProgramAndWait
StartProgramAsExplorerToken
StartProgramAsUser
addFirewallRule
antiUninstIsEnable
base64Encode
checkPathRight
checkSpaValidity
dirRightsCheck
encryptDefenserTrustedList
filedUninstallLog
getATrustNetFltStatus
getAUVerifyResult
getAntiUninstConfig
getHostName
getPathType
getPhysicalAddress
getServiceStatus
initProcAppdata
isLowerVersionCover
isSupportOS
isSupportSHA2
isWinServer
nsDisableIME
nsEnableEdgeLoopback
nsGetPlatformType
nsIsVnicInstalled
nsMutexIsExist
nsResolveAddr
nsResolveAndCacheAddr
nsRm
nsRmFilterDir
nsRmInvalidInstallLog
nsSetForgrudUiWin
nsSetWndIcon
nsTerminateProc
parentProcIsSangfor
peSignVarify
readJson
removeFirewallRule
saveClientNameInfo
saveInstallErr
saveSpaInfo

Sections

.text
Size: 665KB - Virtual size: 664KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23c2f9f56503c388567df7b9690537b0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

oleaut32

advapi32

shlwapi

version

wtsapi32

iphlpapi

userenv

crypt32

imm32

Exports

Exports

Sections

.text Size: 665KB - Virtual size: 664KB

.rdata Size: 168KB - Virtual size: 167KB

.data Size: 18KB - Virtual size: 23KB

.gfids Size: 2KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 38KB - Virtual size: 37KB

.text
Size: 665KB - Virtual size: 664KB

.rdata
Size: 168KB - Virtual size: 167KB

.data
Size: 18KB - Virtual size: 23KB

.gfids
Size: 2KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 38KB - Virtual size: 37KB