e56b3ab7686e8e835cc09fdad5b7dd673d604a77d872739fffbaed895d76bff4

Sharing

Copy URL Twitter E-mail

General

Target
e56b3ab7686e8e835cc09fdad5b7dd673d604a77d872739fffbaed895d76bff4
Size 2.7MB
Sample260528-wqa3eah16q
SHA256 e56b3ab7686e8e835cc09fdad5b7dd673d604a77d872739fffbaed895d76bff4
MD5 5639c9c7266876bba1ce4d1275a9299e
SHA1 cb01ab6ea3c9dd0b9eea4dbd4b12fd164d46371c
SHA512 11e1971c9e72f0dfffc38ecfe234c07ec1fe43c8c7e17797721b8981fcdd0ffe9ba5ec743ebb3507c2a4a5a8821c44497314946ee33cf55081817784a46ddfea
SSDEEP 24576:iCXMy8XQvjE/OwT/CdCR5HBEQ798x9T8vbaRBItwMf84WXLu0uJMBt7f84WXOf8O:k/JKkEQ7q9zUtwMEv4qBt7Ev+Ev2B
TLSH
T14BD5F636F0315177EA56053B18217B298CA31ED2420D998BB3BD7CB51F34BE621E367A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e56b3ab7686e8e835cc09fdad5b7dd673d604a77d872739fffbaed895d76bff4

File Explorer

e56b3ab7686e8e835cc09fdad5b7dd673d604a77d872739fffbaed895d76bff4

.exe 2.7MB

e56b3ab7686e8e835cc09fdad5b7dd673d604a77d872739fffbaed895d76bff4

IMPHASH 993339b4f8e119fdb96adbcca85be910
SHA256 e56b3ab7686e8e835cc09fdad5b7dd673d604a77d872739fffbaed895d76bff4
MD5 5639c9c7266876bba1ce4d1275a9299e
SHA1 cb01ab6ea3c9dd0b9eea4dbd4b12fd164d46371c
SHA512 11e1971c9e72f0dfffc38ecfe234c07ec1fe43c8c7e17797721b8981fcdd0ffe9ba5ec743ebb3507c2a4a5a8821c44497314946ee33cf55081817784a46ddfea
SSDEEP 24576:iCXMy8XQvjE/OwT/CdCR5HBEQ798x9T8vbaRBItwMf84WXLu0uJMBt7f84WXOf8O:k/JKkEQ7q9zUtwMEv4qBt7Ev+Ev2B
TLSH
T14BD5F636F0315177EA56053B18217B298CA31ED2420D998BB3BD7CB51F34BE621E367A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

436233

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\codes\压缩\Main_newlcon2026\product\win32\dbginfo\qzipgui.pdb

kernel32

SetEndOfFile WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle GetTimeZoneInformation LCMapStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect ExitProcess GetConsoleOutputCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime GetFileInformationByHandle UnhandledExceptionFilter FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwind GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA MoveFileExA SleepEx GetModuleHandleA GetFullPathNameW InterlockedDecrement GetCPInfo WaitForSingleObjectEx GetModuleHandleExW OutputDebugStringW GetCommandLineW GetDriveTypeW VerifyVersionInfoW GetCurrentThreadId VerSetConditionMask TerminateProcess GetCurrentProcessId GetCurrentDirectoryW CompareStringW InitializeCriticalSectionEx FindNextFileW FindClose DeleteFileW LocalFree WriteFile ReadFile FlushFileBuffers CreateFileW CreateFileA GetProcAddress FreeLibrary WideCharToMultiByte MultiByteToWideChar FindResourceW SizeofResource LockResource LoadResource FindResourceExW WaitForMultipleObjects DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime QueryPerformanceCounter GetStringTypeW FormatMessageA IsProcessorFeaturePresent InitializeSListHead EncodePointer IsDebuggerPresent DecodePointer GetModuleHandleW RaiseException GetModuleFileNameW SetFilePointerEx GetFileSizeEx FileTimeToSystemTime GetCurrentProcess SetLastError CreateThread Sleep CloseHandle

user32

GetDC ReleaseDC

gdi32

EnumFontsW

advapi32

CryptImportKey CryptEncrypt CryptDestroyKey CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash

shell32

SHGetSpecialFolderPathW

ws2_32

send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect getsockopt closesocket htons socket ntohs accept bind connect getpeername getsockname WSAGetLastError recv setsockopt WSASetLastError WSAIoctl select htonl listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname __WSAFDIsSet

crypt32

CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext CertAddCertificateContextToStore CertEnumCertificatesInStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindCertificateInStore CertCloseStore CertFreeCTLContext CertOpenStore

secur32

InitSecurityInterfaceA

bcrypt

BCryptGenRandom

Name

.text

Size

571KB

Virtual Size

571KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

234KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e56b3ab7686e8e835cc09fdad5b7dd673d604a77d872739fffbaed895d76bff4

kernel32

user32

gdi32

advapi32

shell32

ws2_32

crypt32

secur32

bcrypt

generic