111ed480357809337c3593e817dd607dec8d6eae59bbacbe368bb6222d292495N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

111ed480357809337c3593e817dd607dec8d6eae59bbacbe368bb6222d292495N.exe
Size

2.1MB
MD5

3ef2f102fe98337baff76cc6f0a7bfe0
SHA1

cdf5d7144af8d1cdf77c259b1dc1dae893356d8e
SHA256

111ed480357809337c3593e817dd607dec8d6eae59bbacbe368bb6222d292495
SHA512

4a3cc8fb49a7c53ecdeb3b58bfa83ce029fd80663bc9d070c583406aac0c7af086316cddacfb154125048c3506b278b27b6bbfdfbcc462b7ce1e07d8d787a36a
SSDEEP

49152:pfRSPMYEbTouSwIbFLOAkGy3zdnErPSCTomFDS+BHEuSlVnPgbQppcf:pMFLOAkGkzdnEVomFHKnP+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
111ed480357809337c3593e817dd607dec8d6eae59bbacbe368bb6222d292495N.exe

Files

111ed480357809337c3593e817dd607dec8d6eae59bbacbe368bb6222d292495N.exe
.exe windows:6 windows x86 arch:x86

176a9f52aeaf9048a972b7570ef11281

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\个人资料\桌面\项目\MainTool\Release\Windows Update Clean Tool.pdb

Imports

kernel32

GlobalHandle
LocalReAlloc
GetFileAttributesExW
GetFileSizeEx
GetFileTime
SetErrorMode
GlobalFlags
InterlockedIncrement
CompareStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetCurrentDirectoryW
GetCommandLineW
GetModuleHandleExW
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
CreateTimerQueueTimer
CreateTimerQueue
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
HeapAlloc
HeapFree
OutputDebugStringW
SwitchToThread
CreateThread
GetThreadTimes
FreeLibraryAndExitThread
HeapReAlloc
RtlUnwind
SetStdHandle
GetFileType
HeapSize
HeapQueryInformation
GetStdHandle
GetProcessHeap
QueryPerformanceCounter
GlobalReAlloc
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
CreateSemaphoreW
IsValidCodePage
GetOEMCP
GetCPInfo
GetTimeZoneInformation
DeleteTimerQueueTimer
GetProcessAffinityMask
SetThreadAffinityMask
GetTickCount
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InitializeSListHead
UnregisterWaitEx
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetStringTypeW
GetThreadPriority
UnregisterWait
GetDriveTypeW
WriteConsoleW
SignalObjectAndWait
SetEnvironmentVariableA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
MulDiv
LocalAlloc
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
SetThreadPriority
CreateEventW
WaitForSingleObject
SetEvent
lstrcmpA
GlobalAlloc
GetCurrentThread
InterlockedExchange
GetCurrentProcessId
InterlockedDecrement
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
FreeLibrary
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
GlobalFree
GlobalUnlock
GlobalLock
FreeResource
LoadLibraryW
LoadLibraryA
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameW
GetVersion
DuplicateHandle
OutputDebugStringA
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetFullPathNameW
GetFileSize
FlushFileBuffers
FileTimeToSystemTime
GetProcAddress
GetModuleHandleW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
SetLastError
InitializeCriticalSectionAndSpinCount
GetACP
WideCharToMultiByte
InitializeCriticalSectionEx
CreateMutexW
GetSystemDefaultLangID
ExitProcess
CreateFileW
GetFileAttributesW
LocalFree
FormatMessageW
GetSystemDirectoryW
GetLogicalDriveStringsW
GetVolumeInformationW
GetDiskFreeSpaceW
ReadFile
CloseHandle
CreateProcessW
GetStartupInfoW
CreatePipe
GetCurrentProcess
GetVersionExW
MultiByteToWideChar
RemoveDirectoryW
SetFileAttributesW
CreateHardLinkW
Sleep
CreateDirectoryW
GetLastError
GetWindowsDirectoryW
MoveFileExW
DeleteFileW
MoveFileW
FindResourceW
LoadResource
LockResource
SizeofResource
Wow64DisableWow64FsRedirection
GetEnvironmentStringsW
RaiseException

user32

InvalidateRect
KillTimer
SetTimer
UnregisterClassW
LoadCursorW
GetSysColorBrush
DestroyMenu
RealChildWindowFromPoint
ClientToScreen
EndPaint
BeginPaint
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
SetCursor
GetCursorPos
TranslateMessage
GetMessageW
PostQuitMessage
GetWindowThreadProcessId
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
IsDialogMessageW
SetWindowTextW
GetMonitorInfoW
MonitorFromWindow
WinHelpW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
GetSysColor
MapWindowPoints
ScreenToClient
MessageBoxW
AdjustWindowRectEx
GetWindowRect
GetWindowTextLengthW
RemovePropW
GetPropW
SetPropW
RedrawWindow
ValidateRect
GetForegroundWindow
UpdateWindow
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
GetCapture
GetKeyState
GetFocus
SetFocus
GetDlgCtrlID
SetWindowPos
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
RegisterWindowMessageW
CopyRect
ReleaseDC
GetDC
GetDesktopWindow
GetWindowLongW
SetActiveWindow
IsWindowEnabled
GetActiveWindow
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
IsWindow
CharUpperW
GetParent
SendDlgItemMessageA
IsWindowVisible
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
LoadIconW
SetForegroundWindow
ShowWindow
FindWindowW
ExitWindowsEx
SendMessageW
EnableWindow
GetWindowTextW

gdi32

SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
SetViewportOrgEx
SetMapMode
SetViewportExtEx
ExtTextOutW
TextOutW
SelectObject
SaveDC
RestoreDC
RectVisible
PtVisible
GetStockObject
GetDeviceCaps
GetClipBox
Escape
DeleteObject
DeleteDC
CreateBitmap
GetObjectW
SetTextColor
SetBkColor

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

OpenProcessToken
RegQueryValueW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
RegOpenKeyW
RegEnumValueW
RegSetValueExW
RegCreateKeyW
RegLoadKeyW
RegUnLoadKeyW
RegCloseKey
RegOpenKeyExW
RegEnumKeyW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathIsDirectoryW
PathFileExistsW
PathIsUNCW
PathStripToRootW
PathFindExtensionW
PathFindFileNameW
UrlUnescapeW
PathRemoveFileSpecW

ole32

CoUninitialize
CoCreateGuid
CoCreateInstance
CoInitialize
CoInitializeEx
CoTaskMemFree

oleaut32

SysFreeString
VariantInit
VariantClear
VariantChangeType
SysAllocString

wimgapi

WIMGetAttributes
WIMCloseHandle
WIMLoadImage
WIMGetImageInformation
WIMRegisterMessageCallback
WIMCaptureImage
WIMSetImageInformation
WIMUnregisterMessageCallback
WIMApplyImage
WIMSetTemporaryPath
WIMCreateFile

oleacc

CreateStdAccessibleObject
LresultFromObject

wininet

InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetCrackUrlW
InternetCanonicalizeUrlW
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetReadFile
InternetSetFilePointer
InternetWriteFile
InternetQueryDataAvailable
InternetQueryOptionW

Sections

.text
Size: 436KB - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

176a9f52aeaf9048a972b7570ef11281

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

wimgapi

oleacc

wininet

Sections

.text Size: 436KB - Virtual size: 436KB

.rdata Size: 111KB - Virtual size: 111KB

.data Size: 26KB - Virtual size: 43KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 116KB - Virtual size: 115KB

.text
Size: 436KB - Virtual size: 436KB

.rdata
Size: 111KB - Virtual size: 111KB

.data
Size: 26KB - Virtual size: 43KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 116KB - Virtual size: 115KB