2cd0592a39007f38d8a03247af2439724c0ba90856c60eed7e7917f7d5a808a3

Sharing

Copy URL

Twitter E-mail

General

Target

2cd0592a39007f38d8a03247af2439724c0ba90856c60eed7e7917f7d5a808a3
Size

1.4MB
MD5

6596a89e0ace7b3af3529b354cebd23c
SHA1

a1e8100872087ed537b5dc7a9f8dad013c827b99
SHA256

2cd0592a39007f38d8a03247af2439724c0ba90856c60eed7e7917f7d5a808a3
SHA512

745e992b4bdb81a2c07b4ce32152f034a9e6a1c9c4e099ba10744159b5908b3d8b1364bd0005df5ba23a99aa8b7399163cb7aec3020d1ff2f5f97a812870e677
SSDEEP

24576:uBKv2cjlGeai4s5+fGL5H0MOtw0tbp4J6xDkg7zu2beAL8:aLLk8g0oGaJEDkg7zu2beT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cd0592a39007f38d8a03247af2439724c0ba90856c60eed7e7917f7d5a808a3

Files

2cd0592a39007f38d8a03247af2439724c0ba90856c60eed7e7917f7d5a808a3
.exe windows:6 windows x86 arch:x86

f9e82c37570fa18490aaf02a36ef0c96

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Jenkins\.jenkins\workspace\pay_group\cclean\sys_disk_clean\out\Release\cclean.pdb

Imports

kernel32

IsBadReadPtr
SetLastError
SetEvent
CreateEventW
GetPrivateProfileStringW
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
GetLongPathNameW
QueryDosDeviceW
OpenProcess
GetSystemDirectoryW
lstrlenW
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
UnregisterWaitEx
QueryDepthSList
GetModuleHandleA
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
lstrcmpiW
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
DuplicateHandle
TryEnterCriticalSection
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
VirtualProtect
GetCurrentThreadId
GetCurrentProcessId
CreateMutexW
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetUnhandledExceptionFilter
GetCommandLineW
MultiByteToWideChar
FindResourceW
LoadLibraryW
SizeofResource
LockResource
LoadResource
GetProcAddress
FreeLibrary
FindResourceExW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
CloseHandle
WriteConsoleW
ReadConsoleW
SetEndOfFile
SetStdHandle
GetNumaHighestNodeNumber
DecodePointer
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
WideCharToMultiByte
GetStringTypeW
FormatMessageW
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
WriteFile
WritePrivateProfileStringW
CreateFileW
ReleaseSemaphore
DeleteFileW
CopyFileW
GetFileSizeEx
ReadFile
FindClose
FindNextFileW
LocalFree
ReleaseMutex
FlushFileBuffers
GetVersionExW
CreateFileMappingW
UnhandledExceptionFilter
TerminateProcess
WaitForSingleObjectEx
GetStartupInfoW
QueryPerformanceCounter
InterlockedIncrement
InterlockedDecrement
WaitNamedPipeW
WaitForMultipleObjectsEx
CreateSemaphoreW
InterlockedCompareExchange
Sleep
FreeResource
GetSystemWindowsDirectoryW
DeviceIoControl
lstrcmpA
lstrcmpiA
CreateFileA
RtlUnwind
InterlockedFlushSList
GetFileAttributesExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetFileType
SetFilePointerEx
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
ExitProcess
GetStdHandle
GetACP
GetCurrentThread
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW

user32

CharNextW
RegisterClassExW
SendMessageW
LoadCursorW
DestroyWindow
DefWindowProcW
RegisterWindowMessageW
PostMessageW
PostQuitMessage
SetWindowLongW
SendMessageTimeoutW
PeekMessageW
wsprintfW
KillTimer
SetTimer
PostThreadMessageW
FindWindowW
DispatchMessageW
TranslateMessage
GetWindowLongW
ShowWindow
IsWindow
CreateWindowExW
GetMessageW
UnregisterClassW
GetClassInfoExW
FindWindowExW
CallWindowProcW

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
GetTokenInformation
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExW

shell32

SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoCreateGuid
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoInitialize
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VarUI4FromStr
SysFreeString

shlwapi

PathFindFileNameW
PathIsDirectoryW
PathRenameExtensionW
SHGetValueW
PathCombineW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
StrStrIW
StrStrIA
StrCmpNIW
StrTrimA
StrCmpIW
SHGetValueA
SHSetValueA
SHSetValueW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

comctl32

InitCommonControlsEx

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 663KB - Virtual size: 662KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 23KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 424KB - Virtual size: 423KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 110KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f9e82c37570fa18490aaf02a36ef0c96

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

version

comctl32

crypt32

wintrust

wininet

iphlpapi

Sections

.text Size: 663KB - Virtual size: 662KB

.rdata Size: 152KB - Virtual size: 152KB

.data Size: 23KB - Virtual size: 32KB

.rsrc Size: 424KB - Virtual size: 423KB

.reloc Size: 110KB - Virtual size: 112KB

.text
Size: 663KB - Virtual size: 662KB

.rdata
Size: 152KB - Virtual size: 152KB

.data
Size: 23KB - Virtual size: 32KB

.rsrc
Size: 424KB - Virtual size: 423KB

.reloc
Size: 110KB - Virtual size: 112KB