c9cbc18d3b1a73048576591ef4a520c5065640742318b8919885b88ae6a2ce38

Sharing

Copy URL Twitter E-mail

General

Target
c9cbc18d3b1a73048576591ef4a520c5065640742318b8919885b88ae6a2ce38
Size 493KB
Sample260529-e41fsacx8r
SHA256 c9cbc18d3b1a73048576591ef4a520c5065640742318b8919885b88ae6a2ce38
MD5 97516c05f98e91a592b199e408cba0c8
SHA1 de7e8c33e606e06e809494c723a37da42f1492d0
SHA512 1740bb8d4a52b83b07487d59bcbff605ca9d4252ea6aff9f66e324c33d475a99f2d48ee8905e4571203ae51f90e26f9ad2808e0c5fe6e9d0f5ded3e517acdd2a
SSDEEP 6144:V/VGa0zY4iKefZNcYWo2SWq4lGJERNURUCt1iTBq5mQ04:nGZYCYNcq2/LjCtcTs5mQ
TLSH
T17AB48C16B7E040B9D067817C89D38A26D7FA78210771D6CF23A4475E2F337D19A3A7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9cbc18d3b1a73048576591ef4a520c5065640742318b8919885b88ae6a2ce38

File Explorer

c9cbc18d3b1a73048576591ef4a520c5065640742318b8919885b88ae6a2ce38

.dll 493KB

c9cbc18d3b1a73048576591ef4a520c5065640742318b8919885b88ae6a2ce38

IMPHASH 30aad800efd6a0c45712247cc115fe3f
SHA256 c9cbc18d3b1a73048576591ef4a520c5065640742318b8919885b88ae6a2ce38
MD5 97516c05f98e91a592b199e408cba0c8
SHA1 de7e8c33e606e06e809494c723a37da42f1492d0
SHA512 1740bb8d4a52b83b07487d59bcbff605ca9d4252ea6aff9f66e324c33d475a99f2d48ee8905e4571203ae51f90e26f9ad2808e0c5fe6e9d0f5ded3e517acdd2a
SSDEEP 6144:V/VGa0zY4iKefZNcYWo2SWq4lGJERNURUCt1iTBq5mQ04:nGZYCYNcq2/LjCtcTs5mQ
TLSH
T17AB48C16B7E040B9D067817C89D38A26D7FA78210771D6CF23A4475E2F337D19A3A7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73180

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\bbqq\Desktop\FixedMaster\SPServer_Master\SP自定义UI64\VC 卡密模式自定义登录界面源码&成品_v3.x.1\Bin\SimpleCard.pdb

kernel32

LockResource SizeofResource CreateFileA WriteFile CloseHandle GetTempPathA GetTempFileNameA TerminateProcess LeaveCriticalSection EnterCriticalSection GetCurrentThreadId DeleteFileA SetLastError DeleteCriticalSection GetLastError InitializeCriticalSectionEx WideCharToMultiByte FindResourceW FindResourceExW LoadLibraryExA GetModuleHandleA MultiByteToWideChar IsDBCSLeadByte DecodePointer GetProcAddress FreeLibrary lstrcmpiA SetEndOfFile WriteConsoleW LoadResource SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FindResourceA RaiseException GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetModuleFileNameA GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW CreateFileW FileTimeToSystemTime ReadFile GetConsoleMode EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache VirtualAlloc VirtualFree IsDebuggerPresent OutputDebugStringW LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwindEx RtlPcToFileHeader InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetSystemInfo VirtualProtect VirtualQuery ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP RtlUnwind

user32

GetDlgItem EnableWindow MessageBoxA ShowWindow IsDialogMessageA SendMessageA SetWindowTextA MessageBoxTimeoutA CharNextA DestroyWindow DefWindowProcA EndDialog SetWindowLongPtrA DialogBoxParamA UnregisterClassA GetWindowTextLengthA GetWindowTextA GetActiveWindow

advapi32

RegCreateKeyExA RegDeleteValueA RegCloseKey RegQueryInfoKeyW RegDeleteKeyA RegEnumKeyExA RegSetValueExA RegOpenKeyExA

shell32

ShellExecuteA

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize CoUninitialize

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

winmm

timeGetTime

Name

.text

Size

204KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c9cbc18d3b1a73048576591ef4a520c5065640742318b8919885b88ae6a2ce38

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

winmm

generic