7d1da76ab5eda574188233384b9e1b6e70bbb040c9f56114c7b7ef0441b0775c

Sharing

Copy URL Twitter E-mail

General

Target
7d1da76ab5eda574188233384b9e1b6e70bbb040c9f56114c7b7ef0441b0775c
Size 9.5MB
Sample260529-hdphdad19l
SHA256 7d1da76ab5eda574188233384b9e1b6e70bbb040c9f56114c7b7ef0441b0775c
MD5 504bdcdabe10164764aacce4eca5d6c3
SHA1 bee02c7b1c5cf92436127c34359250157fc0d5de
SHA512 b6860ab3ad03c26b78cf9c8b5b8d97f3eee387a17b0cdc3ccce971327fc91ef7a7a194abec20cb405eb1a1a2d10dba5886eb7e2a36586e3aa6218d643eed5052
SSDEEP 196608:IcCZEodZZ6MF4po6ITfUGomBwz9EicWJLCT+RVRof/HC4iELKCViGzwRDgjs7ID1:IcCZ/dZZ6MF4po7jmmyz9EickJoSMY
TLSH
T192A6F1207A86C13AD8AF45F1AE7D9A6F584CBEB0076440D7F3D84E6A19748D31B31E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d1da76ab5eda574188233384b9e1b6e70bbb040c9f56114c7b7ef0441b0775c

File Explorer

7d1da76ab5eda574188233384b9e1b6e70bbb040c9f56114c7b7ef0441b0775c

.dll 9.5MB

7d1da76ab5eda574188233384b9e1b6e70bbb040c9f56114c7b7ef0441b0775c

IMPHASH 7178226296dfd064c3b2c4fcadfc1186
SHA256 7d1da76ab5eda574188233384b9e1b6e70bbb040c9f56114c7b7ef0441b0775c
MD5 504bdcdabe10164764aacce4eca5d6c3
SHA1 bee02c7b1c5cf92436127c34359250157fc0d5de
SHA512 b6860ab3ad03c26b78cf9c8b5b8d97f3eee387a17b0cdc3ccce971327fc91ef7a7a194abec20cb405eb1a1a2d10dba5886eb7e2a36586e3aa6218d643eed5052
SSDEEP 196608:IcCZEodZZ6MF4po6ITfUGomBwz9EicWJLCT+RVRof/HC4iELKCViGzwRDgjs7ID1:IcCZ/dZZ6MF4po7jmmyz9EickJoSMY
TLSH
T192A6F1207A86C13AD8AF45F1AE7D9A6F584CBEB0076440D7F3D84E6A19748D31B31E27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1800616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\LDS\BiscuitZip\新建文件夹\zipper-tpi\bin\Release\BoxTool.pdb

kernel32

MoveFileW MoveFileExW WideCharToMultiByte CreateFileA SetFilePointer CreateFileMappingW MapViewOfFile UnmapViewOfFile ResetEvent GetThreadId GetCurrentProcessId MulDiv GetWindowsDirectoryW GetSystemDirectoryW GetStartupInfoW CreateProcessW GetTempPathW SetFileAttributesW RemoveDirectoryW GetLogicalDrives GetFileSizeEx GetFileAttributesW GetDriveTypeW FindNextFileW FindFirstFileW FindClose GetSystemInfo FileTimeToSystemTime K32GetModuleFileNameExW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetLocalTime GetFileAttributesExW GlobalLock GlobalUnlock CreateMutexW ReleaseMutex GetFileType WaitForMultipleObjects ReadDirectoryChangesW CancelIo PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort CreateFileW OpenProcess Sleep SystemTimeToFileTime ResumeThread GetCurrentThreadId WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP lstrlenW GetModuleHandleExW ExitThread RtlUnwind CreateFileMappingA CreateEventW WaitForSingleObjectEx WaitForSingleObject SetEvent InitializeCriticalSectionEx lstrcmpW SetLastError RaiseException DecodePointer LocalFileTimeToFileTime lstrcpyW LoadLibraryW GetModuleFileNameW FreeLibrary GetCurrentProcess GetLastError CloseHandle DeleteFileW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW FindResourceW SizeofResource LockResource UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue lstrcmpiA lstrcmpA GetSystemWindowsDirectoryW InterlockedCompareExchange FlushFileBuffers TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetTempFileNameW GlobalFree GlobalAlloc GetVersion IsBadReadPtr DosDateTimeToFileTime SetEndOfFile GetFileSize FreeResource ExitProcess GetACP WriteFile FindNextFileA FindFirstFileA ReadFile OpenFileMappingW LoadLibraryExW VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList SetFilePointerEx LocalFree InterlockedPopEntrySList InitializeSListHead OutputDebugStringW LoadResource FindResourceExW GetProcAddress GetModuleHandleW GetVersionExW GetProcessHeap IsDebuggerPresent GetLocaleInfoW LCMapStringW CompareStringW QueryPerformanceCounter GetCPInfo GetTickCount HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy MultiByteToWideChar GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetExitCodeThread GetCurrentThread SwitchToThread DuplicateHandle TryEnterCriticalSection AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive DeviceIoControl AreFileApisANSI SetFileTime GetFileInformationByHandle FindFirstFileExW FormatMessageW GetStringTypeW EncodePointer

user32

KillTimer GetWindowDC IsWindowEnabled RemovePropW SetTimer CreateAcceleratorTableW GetWindowTextLengthW SetWindowTextW GetSysColor CloseClipboard SetClipboardData keybd_event PeekMessageW DispatchMessageW GetClipboardData TranslateMessage GetMessageW UnhookWinEvent SetWinEventHook EnumDisplayMonitors GetMonitorInfoW EnumWindows PtInRect CopyRect GetCursorPos GetWindowTextW OpenClipboard IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW ReleaseDC GetDC SetForegroundWindow GetForegroundWindow CallWindowProcW DefWindowProcW GetWindowRect BringWindowToTop AttachThreadInput wsprintfW ChangeWindowMessageFilter GetClassNameW PostThreadMessageW PostMessageW RegisterWindowMessageW DestroyWindow GetWindow GetWindowThreadProcessId FindWindowExW FindWindowW SendMessageW LoadCursorW SetWindowLongW InvalidateRgn GetWindowLongW ClientToScreen DestroyIcon IsIconic SystemParametersInfoW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetClipboardSequenceNumber IsWindowVisible MonitorFromPoint ShowCaret ScreenToClient SetWindowPos PostQuitMessage IsChild UpdateLayeredWindow IsZoomed CharNextW SetFocus GetFocus GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect CreateCaret GetCaretBlinkTime SetCaretPos MapWindowPoints UnionRect IsRectEmpty GetParent MonitorFromWindow wvsprintfW SetCursor InflateRect OffsetRect RegisterClassW ShowWindow EnableWindow SetPropW GetPropW LoadImageW SetWindowRgn MessageBoxW DrawIconEx CharPrevW DrawTextW SetRect GetIconInfo GetMessagePos MoveWindow GetDlgCtrlID DrawFocusRect FillRect HideCaret IntersectRect

gdi32

CreateRoundRectRgn CombineRgn CreateRectRgnIndirect GetCharABCWidthsW GetClipBox SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection SetDIBColorTable TextOutW ExtTextOutW CreateSolidBrush GetTextColor CreateDCW GetDIBits SetDIBitsToDevice SetWindowOrgEx GetObjectW GetTextMetricsW SaveDC RestoreDC Rectangle CreatePen CreateFontIndirectW CreateCompatibleBitmap BitBlt GetDeviceCaps CreateCompatibleDC DeleteDC GetStockObject GetTextExtentPoint32W SelectObject DeleteObject

advapi32

RegQueryValueExA ConvertSidToStringSidW RegGetValueW RegSetValueExW RegCreateKeyExW GetTokenInformation IsValidSid RegOpenKeyW RegEnumValueW RegEnumKeyW RegQueryValueExW RegOpenKeyExW OpenProcessToken RegEnumKeyExW RegCloseKey RegOpenKeyExA RegEnumKeyExA RegCreateKeyW

shell32

ShellExecuteExW SHGetSpecialFolderPathW DragQueryFileW SHGetFileInfoW ord727 SHCreateItemFromParsingName ord155 SHGetPathFromIDListW SHGetFolderLocation SHGetKnownFolderPath SHGetDesktopFolder SHFileOperationW ShellExecuteW ord165

ole32

CLSIDFromString CoUninitialize CoCreateInstance OleInitialize OleUninitialize ReleaseStgMedium StringFromCLSID CoTaskMemFree CoCreateGuid CreateStreamOnHGlobal OleLockRunning CoInitialize CLSIDFromProgID

oleaut32

SafeArrayPutElement VariantInit VariantClear SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayCreate SysAllocString

shlwapi

PathFindFileNameW StrStrIA StrStrIW PathFileExistsW PathIsDirectoryW PathCombineW wnsprintfW PathRemoveFileSpecW PathAppendW StrCmpIW PathAddBackslashW ord176 StrStrW StrCmpW StrRetToStrW SHAutoComplete SHGetValueA StrTrimA StrCmpNIW SHSetValueA

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

comctl32

ImageList_DrawEx ImageList_GetIconSize InitCommonControlsEx ord17 _TrackMouseEvent

msimg32

AlphaBlend GradientFill

msi

ord217 ord173

crypt32

CertGetNameStringW

gdiplus

GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageEncodersSize GdipGetImageEncoders GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCloneBrush GdipDeleteBrush GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipDrawLineI GdipDrawRectangleI GdipDrawPath GdipFillEllipseI GdipAddPathArc GdipDrawEllipseI GdipLoadImageFromFile GdipLoadImageFromFileICM GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipLoadImageFromStreamICM GdipDrawImagePointsI GdipFillPath GdipGraphicsClear GdipCloneBitmapAreaI GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipCreateTexture GdipClosePathFigure GdipDrawImageRectRectI GdipDrawImageRectI GdipSetInterpolationMode GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipCreateSolidFill

generic

count=44, id=259, version=30795,

count=211, id=261, version=30795,

count=11, id=260, version=27054,

count=1, id=263, version=30795,

count=2, id=264, version=27054,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=261, version=27032,

count=2, id=199, version=41118,

count=26, id=259, version=26706,

count=1, id=261, version=27053,

count=10, id=261, version=27051,

count=131, id=261, version=26706,

count=38, id=260, version=26706,

count=52, id=260, version=30795,

count=1, id=262, version=30795,

count=37, id=257, version=30795,

count=614, id=1, productName=Unmarked objects,

count=208, id=261, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,