a3664b196a6ee8078507aac8aaca317202cec72f35a9f93204651102e1a0d9fe

Sharing

Copy URL

Twitter E-mail

General

Target

a3664b196a6ee8078507aac8aaca317202cec72f35a9f93204651102e1a0d9fe
Size

1.3MB
MD5

1bb87a55cee3bd69bfcdfe6e46cf4b66
SHA1

4d5a66e76c3b9a2093776ee77d46f8a78f8c6391
SHA256

a3664b196a6ee8078507aac8aaca317202cec72f35a9f93204651102e1a0d9fe
SHA512

6bbd7ea1b1ad3576c52f3c428426482e4b08f6494e78582ab9f205a35ade077a3f5a9443709ec2ca64e70261d77bd287b3c339e6dd4bbe9e7abd592766cd53bf
SSDEEP

24576:e4wevST61Eu5VnoRx79BkjprdQjkjHdldLifSgAj8zv:e4cluSx79Bk5dQKHjdLUSgSWv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3664b196a6ee8078507aac8aaca317202cec72f35a9f93204651102e1a0d9fe

Files

a3664b196a6ee8078507aac8aaca317202cec72f35a9f93204651102e1a0d9fe
.exe windows:6 windows x86 arch:x86

36dbbcd26fc562ecb8d80d18243ad0e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\project\wubi\WB_5_5\bin\SogouPdb\SogouWubi\ScdReg.pdb

Imports

imm32

ImmDisableIME

kernel32

GetStartupInfoW
FindFirstFileW
HeapFree
FindNextFileW
GetTempPathW
InitializeCriticalSectionEx
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
GetDriveTypeW
GetCurrentDirectoryW
FindResourceW
LoadResource
FindResourceExW
LockResource
SizeofResource
FindClose
HeapSize
GetLastError
QueryPerformanceFrequency
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
ReadFile
SetLastError
WriteFile
SetFilePointer
CreateFileW
SetFileAttributesW
Sleep
CloseHandle
GetFileSize
FlushFileBuffers
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
GetCurrentProcess
GetModuleFileNameW
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
LoadLibraryW
FreeLibrary
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetCurrentThreadId
ExitThread
CreateEventW
FormatMessageW
GlobalAlloc
GlobalFree
CreateThread
LocalFree
CreateProcessW
RemoveDirectoryW
GetFileAttributesW
GetVersionExW
GetSystemDirectoryW
DeleteFileW
MoveFileExW
CreateDirectoryW
WaitForSingleObject
GetFileAttributesExW
FileTimeToSystemTime
CopyFileW
LocalAlloc
OpenEventW
CreateMutexW
ReleaseMutex
OpenMutexW
QueryPerformanceCounter
SetEvent
IsBadWritePtr
lstrlenW
TerminateProcess
GetProcessHeap
GetLocalTime
lstrcpyW
VirtualQuery
IsDebuggerPresent
SetUnhandledExceptionFilter
HeapCreate
GetStringTypeW
EncodePointer
GetCPInfo
CompareStringW
LCMapStringW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
lstrcatW
InitializeSListHead
RtlUnwind
LoadLibraryExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
GetACP
GetFileType
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetEndOfFile
ReadConsoleW
WriteConsoleW

user32

IsWindowVisible
GetWindowThreadProcessId
CreateWindowExW
wvsprintfW
SetWindowTextW
SetTimer
TrackMouseEvent
IsDlgButtonChecked
SetPropW
GetClientRect
GetDlgItem
DrawTextW
CheckDlgButton
GetParent
DialogBoxParamW
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
GetWindowTextW
RemovePropW
GetWindowLongW
CallWindowProcW
GetWindowRect
GetDC
SetWindowPos
MessageBoxW
GetPropW
ScreenToClient
SendMessageW
EndDialog
GetClassNameW
SetWindowLongW
GetSystemMetrics
GetWindowDC
SetRectEmpty
DefWindowProcW

gdi32

GetObjectW
CreateSolidBrush
DeleteObject
SelectObject
GetStockObject
GetTextExtentPoint32W
SetTextColor
SetBkMode
CreateFontIndirectW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetProcessMemoryInfo

wininet

InternetCloseHandle
HttpQueryInfoW
InternetSetOptionW
InternetOpenUrlW
InternetWriteFile
InternetCrackUrlA
HttpEndRequestW
HttpSendRequestExW
InternetConnectA
HttpAddRequestHeadersW
HttpOpenRequestA
InternetOpenW

advapi32

CryptAcquireContextW
CryptSetKeyParam
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
RegQueryValueExW
RegOpenKeyW
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
InitializeAcl
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
AddAccessAllowedAceEx
GetLengthSid
OpenProcessToken
LookupAccountSidW
GetTokenInformation
RegCloseKey
RegEnumKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW

shell32

SHFileOperationW
ShellExecuteW
SHGetFolderPathW

Sections

.text
Size: 699KB - Virtual size: 698KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 376KB - Virtual size: 375KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 75KB - Virtual size: 425KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

36dbbcd26fc562ecb8d80d18243ad0e6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

imm32

kernel32

user32

gdi32

version

psapi

wininet

advapi32

shell32

Sections

.text Size: 699KB - Virtual size: 698KB

.rdata Size: 376KB - Virtual size: 375KB

.data Size: 75KB - Virtual size: 425KB

.rsrc Size: 100KB - Virtual size: 104KB

.text
Size: 699KB - Virtual size: 698KB

.rdata
Size: 376KB - Virtual size: 375KB

.data
Size: 75KB - Virtual size: 425KB

.rsrc
Size: 100KB - Virtual size: 104KB