fc97795cc4b8a39edb4c79f0159aa89eee8cf927cd524e7a6dc53bc82e2deb59

Sharing

Copy URL Twitter E-mail

General

Target
fc97795cc4b8a39edb4c79f0159aa89eee8cf927cd524e7a6dc53bc82e2deb59
Size 9.3MB
Sample260529-hhdxfaev91
SHA256 fc97795cc4b8a39edb4c79f0159aa89eee8cf927cd524e7a6dc53bc82e2deb59
MD5 0fcfafe877e47d6ad9f8e42206decfc7
SHA1 2e5f4fe315171a8fd288b9c69f0b7988c1f35b54
SHA512 0233b070a8d75f8dd939a8804dbf71dec6204f4d39c61b3757117fd6fb4f155cfb9888d3bde0b175d45afdd0a3b357a9d1d25250cff0113d24096b71191c536d
SSDEEP 196608:bQTDQNcFzQTSfmzJQFEYUGomBwz9EicWJLCT+RVRof/HC4iELKCViGzwRDgjs7IR:bQTDXFzQTSfmzJkjmmyz9EickJoSMY
TLSH
T10EA6F1206A42D137D9BA05F2A97C9B6F505C7FA0076444D7B3CC4FBA29B48D35A32B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc97795cc4b8a39edb4c79f0159aa89eee8cf927cd524e7a6dc53bc82e2deb59

File Explorer

fc97795cc4b8a39edb4c79f0159aa89eee8cf927cd524e7a6dc53bc82e2deb59

.dll 9.3MB

fc97795cc4b8a39edb4c79f0159aa89eee8cf927cd524e7a6dc53bc82e2deb59

IMPHASH b99cd5b9da99acccb2c931db311be4cb
SHA256 fc97795cc4b8a39edb4c79f0159aa89eee8cf927cd524e7a6dc53bc82e2deb59
MD5 0fcfafe877e47d6ad9f8e42206decfc7
SHA1 2e5f4fe315171a8fd288b9c69f0b7988c1f35b54
SHA512 0233b070a8d75f8dd939a8804dbf71dec6204f4d39c61b3757117fd6fb4f155cfb9888d3bde0b175d45afdd0a3b357a9d1d25250cff0113d24096b71191c536d
SSDEEP 196608:bQTDQNcFzQTSfmzJQFEYUGomBwz9EicWJLCT+RVRof/HC4iELKCViGzwRDgjs7IR:bQTDXFzQTSfmzJkjmmyz9EickJoSMY
TLSH
T10EA6F1206A42D137D9BA05F2A97C9B6F505C7FA0076444D7B3CC4FBA29B48D35A32B1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1766360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\LDS\BiscuitZip\新建文件夹\zipper-tpi\bin\Release\BoxTool.pdb

kernel32

MoveFileW MoveFileExW WideCharToMultiByte CreateFileA SetFilePointer CreateFileMappingW MapViewOfFile UnmapViewOfFile ResetEvent GetThreadId GetCurrentProcessId MulDiv GetWindowsDirectoryW GetSystemDirectoryW GetStartupInfoW CreateProcessW GetTempPathW SetFileAttributesW RemoveDirectoryW GetFileSizeEx GetFileAttributesW FindNextFileW FindFirstFileW FindClose GetSystemInfo FileTimeToSystemTime K32GetModuleFileNameExW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetLocalTime GetFileAttributesExW GlobalLock GlobalUnlock CreateMutexW ReleaseMutex GetFileType WaitForMultipleObjects ReadDirectoryChangesW CancelIo PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort CreateFileW OpenProcess Sleep SystemTimeToFileTime ResumeThread GetCurrentThreadId WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP lstrlenW GetModuleHandleExW ExitThread RtlUnwind CreateFileMappingA CreateEventW WaitForSingleObjectEx WaitForSingleObject SetEvent InitializeCriticalSectionEx lstrcmpW SetLastError RaiseException DecodePointer lstrcpyW LoadLibraryW GetModuleFileNameW FreeLibrary GetCurrentProcess GetLastError CloseHandle DeleteFileW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW FindResourceW SizeofResource LockResource UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue lstrcmpiA lstrcmpA GetSystemWindowsDirectoryW InterlockedCompareExchange FlushFileBuffers TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetTempFileNameW GlobalFree GlobalAlloc GetVersion IsBadReadPtr SetEndOfFile GetFileSize FreeResource ExitProcess GetACP WriteFile FindNextFileA FindFirstFileA ReadFile OpenFileMappingW LoadLibraryExW VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList SetFilePointerEx LocalFree InterlockedPopEntrySList InitializeSListHead OutputDebugStringW LoadResource FindResourceExW GetProcAddress GetModuleHandleW GetVersionExW GetProcessHeap IsDebuggerPresent GetLocaleInfoW LCMapStringW CompareStringW QueryPerformanceCounter GetCPInfo GetTickCount HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy MultiByteToWideChar GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetExitCodeThread GetCurrentThread SwitchToThread DuplicateHandle TryEnterCriticalSection AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive DeviceIoControl AreFileApisANSI GetFileInformationByHandle FindFirstFileExW FormatMessageW GetStringTypeW EncodePointer

user32

GetWindowLongW InvalidateRgn RemovePropW CreateAcceleratorTableW SetTimer GetSysColor ClientToScreen ShowCaret HideCaret GetWindowTextLengthW IsWindowEnabled GetWindowDC PeekMessageW DispatchMessageW TranslateMessage GetMessageW UnhookWinEvent SetWinEventHook EnumDisplayMonitors GetMonitorInfoW EnumWindows PtInRect CopyRect GetCursorPos GetWindowTextW DestroyWindow IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW ReleaseDC GetDC SetForegroundWindow GetForegroundWindow CallWindowProcW DefWindowProcW GetWindowRect BringWindowToTop AttachThreadInput wsprintfW ChangeWindowMessageFilter GetClassNameW PostThreadMessageW PostMessageW KillTimer RegisterWindowMessageW GetWindow GetWindowThreadProcessId FindWindowExW FindWindowW SendMessageW LoadCursorW SetWindowTextW SetWindowLongW FillRect DestroyIcon IsIconic SystemParametersInfoW IsWindowVisible MonitorFromPoint DrawFocusRect IntersectRect ScreenToClient SetWindowPos PostQuitMessage IsChild UpdateLayeredWindow IsZoomed CharNextW SetFocus GetFocus GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect CreateCaret GetCaretBlinkTime SetCaretPos MapWindowPoints UnionRect IsRectEmpty GetParent MonitorFromWindow wvsprintfW SetCursor InflateRect OffsetRect RegisterClassW ShowWindow EnableWindow SetPropW GetPropW LoadImageW SetWindowRgn MessageBoxW DrawIconEx CharPrevW DrawTextW SetRect GetIconInfo GetMessagePos MoveWindow GetDlgCtrlID

gdi32

CreateRoundRectRgn CombineRgn CreateRectRgnIndirect GetCharABCWidthsW GetClipBox SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection SetDIBColorTable TextOutW ExtTextOutW CreateSolidBrush GetTextColor CreateDCW GetDIBits SetDIBitsToDevice SetWindowOrgEx GetObjectW GetTextMetricsW SaveDC RestoreDC Rectangle CreatePen CreateFontIndirectW CreateCompatibleBitmap BitBlt GetDeviceCaps CreateCompatibleDC DeleteDC GetStockObject GetTextExtentPoint32W SelectObject DeleteObject

advapi32

RegQueryValueExA ConvertSidToStringSidW RegGetValueW RegSetValueExW RegCreateKeyExW GetTokenInformation IsValidSid RegOpenKeyW RegEnumValueW RegEnumKeyW RegQueryValueExW RegOpenKeyExW OpenProcessToken RegEnumKeyExW RegCloseKey RegOpenKeyExA RegEnumKeyExA RegCreateKeyW

shell32

ShellExecuteExW SHGetSpecialFolderPathW DragQueryFileW SHGetFileInfoW ord727 SHCreateItemFromParsingName ord155 SHGetPathFromIDListW SHGetFolderLocation SHGetKnownFolderPath SHGetDesktopFolder ord165

ole32

CLSIDFromString CoUninitialize CoCreateInstance OleInitialize OleUninitialize ReleaseStgMedium StringFromCLSID CoTaskMemFree CoCreateGuid CreateStreamOnHGlobal OleLockRunning CoInitialize CLSIDFromProgID

oleaut32

SafeArrayPutElement VariantInit VariantClear SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayCreate SysAllocString

shlwapi

StrStrIA StrStrIW PathFileExistsW PathIsDirectoryW PathCombineW wnsprintfW PathRemoveFileSpecW PathAppendW StrCmpIW PathAddBackslashW ord176 PathFindFileNameW StrStrW StrCmpW StrRetToStrW SHAutoComplete SHGetValueA StrTrimA StrCmpNIW SHSetValueA

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

comctl32

ImageList_DrawEx ImageList_GetIconSize InitCommonControlsEx ord17 _TrackMouseEvent

msimg32

AlphaBlend GradientFill

msi

ord217 ord173

crypt32

CertGetNameStringW

gdiplus

GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageEncodersSize GdipGetImageEncoders GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipDrawLineI GdipDrawRectangleI GdipDrawPath GdipFillEllipseI GdipAddPathArc GdipDrawEllipseI GdipLoadImageFromFile GdipLoadImageFromFileICM GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipLoadImageFromStreamICM GdipDrawImagePointsI GdipFillPath GdipGraphicsClear GdipCloneBitmapAreaI GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipCreateTexture GdipClosePathFigure GdipDrawImageRectRectI GdipDrawImageRectI GdipSetInterpolationMode GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipCloneBrush

generic

count=44, id=259, version=30795,

count=211, id=261, version=30795,

count=11, id=260, version=27054,

count=1, id=263, version=30795,

count=2, id=264, version=27054,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=261, version=27032,

count=2, id=199, version=41118,

count=26, id=259, version=26706,

count=1, id=261, version=27053,

count=9, id=261, version=27051,

count=131, id=261, version=26706,

count=38, id=260, version=26706,

count=52, id=260, version=30795,

count=1, id=262, version=30795,

count=37, id=257, version=30795,

count=611, id=1, productName=Unmarked objects,

count=196, id=261, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,