98f9e0f4f76c99930d28db92f4f1ed70a2cb0e973dc3e1b6e8d642546457bc25N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

98f9e0f4f76c99930d28db92f4f1ed70a2cb0e973dc3e1b6e8d642546457bc25N.exe
Size

367KB
MD5

18c6bc212633930dd768853336246780
SHA1

5592d70dacd82421b4dedc15bbc8cac7ce020898
SHA256

98f9e0f4f76c99930d28db92f4f1ed70a2cb0e973dc3e1b6e8d642546457bc25
SHA512

fdda5d05ad44d8bc3fb4555b33aded8e14230aa5d5b6bcdd77583a01106f62500e92b8342c3ce71022170bb543dd45c2e60638025b3dab0d5c24811472d1156d
SSDEEP

6144:ktCG1f7lLw66cfb/PnQXLRYCbE7bV3xA09bM/vOAt9PLCcF7crY2:ktCU7dbVfTPnQXLKWE7bVVFM/fGcF7Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
98f9e0f4f76c99930d28db92f4f1ed70a2cb0e973dc3e1b6e8d642546457bc25N.exe

Files

98f9e0f4f76c99930d28db92f4f1ed70a2cb0e973dc3e1b6e8d642546457bc25N.exe
.exe windows:5 windows x86 arch:x86

709f677cf1da2d69141c81150e58a00a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\views\hummerbuilder_QQProj_int_144\Basic_Hummer5_VOB\Hummer5\Source\Tools\OpenUrl\Release\QQUrlMgr.pdb

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

GetProcessImageFileNameW

kernel32

GetModuleHandleW
SetErrorMode
GetProcAddress
InitializeCriticalSection
WriteProcessMemory
SetUnhandledExceptionFilter
GetCurrentProcess
HeapFree
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OpenThread
SuspendThread
EnterCriticalSection
CreateEventW
DuplicateHandle
SearchPathW
CreateProcessW
WaitForMultipleObjects
TerminateProcess
ReadProcessMemory
VirtualAllocEx
GetTickCount
GetPrivateProfileStringW
lstrlenW
MultiByteToWideChar
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
OpenEventW
SetEvent
FreeLibrary
MoveFileExW
FindFirstFileW
FindNextFileW
GetCurrentThreadId
WaitForSingleObject
ConnectNamedPipe
CreateNamedPipeW
WaitNamedPipeW
TerminateThread
ReadFile
DisconnectNamedPipe
GetLastError
GetLocalTime
LocalFree
CreateThread
GetFileAttributesW
WritePrivateProfileStringW
GetSystemInfo
ExpandEnvironmentStringsW
FindFirstFileA
GetPrivateProfileStringA
GetModuleFileNameA
FindNextFileA
SetHandleInformation
CreateProcessA
CreatePipe
LoadLibraryW
GetTempPathW
GetFileSize
CreateDirectoryW
RemoveDirectoryW
InterlockedIncrement
InterlockedDecrement
DecodePointer
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
GetModuleFileNameW
GetProcessHeap
HeapAlloc
CloseHandle
Sleep
WriteFile
CreateFileW
SetFileAttributesW
DeleteFileW
EncodePointer
DeleteCriticalSection
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
LeaveCriticalSection
FindClose

user32

IsWindow
SendMessageTimeoutW
KillTimer
PostQuitMessage
FindWindowW
GetMessageW
SetTimer
PostThreadMessageW
TranslateMessage

advapi32

RegQueryInfoKeyW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
FreeSid
SetEntriesInAclW
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteKeyW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueA
RegOpenKeyExA

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHGetFolderPathW
SHGetFolderPathA

ole32

CoInitialize
CoUninitialize

shlwapi

wnsprintfA
PathFileExistsA
SHGetValueA
wnsprintfW
PathFindFileNameW
PathFileExistsW

wininet

InternetReadFile
InternetOpenW
InternetOpenUrlW
HttpQueryInfoW
InternetCloseHandle
InternetGetConnectedState

msvcr100

wcsncmp
_controlfp_s
_invoke_watson
_except_handler4_common
__CxxFrameHandler3
memcpy
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_stricmp
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
??3@YAXPAX@Z
malloc
free
memcpy_s
wcscpy_s
wcscat_s
_snwprintf
memmove_s
_wcslwr_s
wcsnlen
wmemcpy_s
_vscwprintf
vswprintf_s
??_U@YAPAXI@Z
wcsncpy_s
_wtol
??_V@YAXPAX@Z
_wcsicmp
wcsstr
fwprintf
calloc
_wfopen
_purecall
fclose
??2@YAPAXI@Z
rand
srand
_wtoi
sscanf_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
memmove
atoi
vsprintf_s
strrchr
_CxxThrowException
strcat_s
_wcslwr
wcsrchr
isspace
tolower
_vsnprintf_s
fprintf
strncmp
strchr
isalnum
isalpha
atol
memset
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__wgetmainargs
_cexit
_exit

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

ws2_32

ntohl
htonl

urlmon

URLDownloadToFileW

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

709f677cf1da2d69141c81150e58a00a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

psapi

kernel32

user32

advapi32

shell32

ole32

shlwapi

wininet

msvcr100

msvcp100

ws2_32

urlmon

Sections

.text Size: 131KB - Virtual size: 131KB

.rdata Size: 38KB - Virtual size: 38KB

.data Size: 5KB - Virtual size: 7KB

.rsrc Size: 47KB - Virtual size: 46KB

.reloc Size: 73KB - Virtual size: 76KB

.text
Size: 131KB - Virtual size: 131KB

.rdata
Size: 38KB - Virtual size: 38KB

.data
Size: 5KB - Virtual size: 7KB

.rsrc
Size: 47KB - Virtual size: 46KB

.reloc
Size: 73KB - Virtual size: 76KB