e143b2bb324fad269708bb13f37ff0b18572af371ca35e220e66b28a1f8f64d3

Sharing

Copy URL

Twitter E-mail

General

Target

e143b2bb324fad269708bb13f37ff0b18572af371ca35e220e66b28a1f8f64d3
Size

470KB
MD5

e9f36541d874b91f8179ae0688f8e12d
SHA1

39ab8fd13895d1bdb0ec109975c92f74984a01f0
SHA256

e143b2bb324fad269708bb13f37ff0b18572af371ca35e220e66b28a1f8f64d3
SHA512

fd91bce7001bc8de0c13a66324d5e00f58fda6159c1ee889a624a18b27b8ed2609ce6973c0c679f1be33c7bee20bea76341ff48f8a1aac397d7e4269b23359bb
SSDEEP

6144:OIIIIMyaZdiNeicBi7RF890rdeQBkKTwOUjAOyA1n18CC3TnAiOBCMwFTQW8rKAz:caecBi7RF8mrEAjAomh2TmCVQWCtkK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e143b2bb324fad269708bb13f37ff0b18572af371ca35e220e66b28a1f8f64d3

Files

e143b2bb324fad269708bb13f37ff0b18572af371ca35e220e66b28a1f8f64d3
.exe windows:6 windows x86 arch:x86

ecb4ac395dc92868c8a54e1bc02fdef5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SGWebRender.pdb

Imports

kernel32

GetCurrentProcess
WriteFile
SetFilePointer
CreateEventW
FormatMessageW
LocalFree
GetFileSize
FindNextFileW
FindClose
FlushFileBuffers
HeapFree
LocalAlloc
OutputDebugStringW
HeapAlloc
DecodePointer
GetProcessHeap
CreateMutexW
ReleaseMutex
VirtualFree
VirtualAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
SetEvent
TerminateProcess
lstrcatW
GetLocalTime
lstrcpyW
GetTickCount
VirtualQuery
IsDebuggerPresent
SetUnhandledExceptionFilter
InitializeCriticalSectionEx
EncodePointer
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
ReadFile
GetStringTypeW
GetCPInfo
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RaiseException
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
ExitProcess
GetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
LCMapStringW
GetFileType
HeapReAlloc
SetFilePointerEx
GetConsoleMode
ReadConsoleW
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
HeapSize
GetConsoleOutputCP
SetEndOfFile
WriteConsoleW
GetEnvironmentVariableW
EnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
SetLastError
CreateProcessW
Sleep
SetFileAttributesW
GetCurrentThreadId
GetFileAttributesW
CreateFileW
WaitForSingleObject
OpenMutexW
GetModuleHandleW
GetCurrentProcessId
LoadLibraryW
CloseHandle
GetLastError
GetSystemDirectoryW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
DeleteCriticalSection
LeaveCriticalSection
LoadLibraryExW
DebugBreak
FreeLibrary
GetProcAddress

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetProcessMemoryInfo

user32

GetSystemMetrics
SetRectEmpty
wvsprintfW

advapi32

GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyW
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorSacl

shell32

SHGetFolderPathW

Sections

.text
Size: 210KB - Virtual size: 209KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ecb4ac395dc92868c8a54e1bc02fdef5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

version

psapi

user32

advapi32

shell32

Sections

.text Size: 210KB - Virtual size: 209KB

.rdata Size: 94KB - Virtual size: 93KB

.data Size: 7KB - Virtual size: 60KB

.rsrc Size: 68KB - Virtual size: 68KB

.reloc Size: 80KB - Virtual size: 84KB

.text
Size: 210KB - Virtual size: 209KB

.rdata
Size: 94KB - Virtual size: 93KB

.data
Size: 7KB - Virtual size: 60KB

.rsrc
Size: 68KB - Virtual size: 68KB

.reloc
Size: 80KB - Virtual size: 84KB