374f595bf03cde3b782eb82d60bf1e8899b63b4192c50fae40ef17fab683b3b3

Sharing

Copy URL Twitter E-mail

General

Target
374f595bf03cde3b782eb82d60bf1e8899b63b4192c50fae40ef17fab683b3b3
Size 1.3MB
Sample260602-lhpwgsbs8m
SHA256 374f595bf03cde3b782eb82d60bf1e8899b63b4192c50fae40ef17fab683b3b3
MD5 04550892289a7d83801a80a6a24c481c
SHA1 9f5595530d1efeed7bfa92642be75ba674d6fd42
SHA512 c3cdbfc5d33a346de778eee5f9d95ff51a7f89566332c809fbc9d4d9fd0efa58a6fe5122ff7614c310d8d283a509f67236623f0cd7ab1d1cd70fcbc6fa802c1b
SSDEEP 24576:gJpyrCe+EI5c3agtxX/ZmG3mv/NOFfrjTzzkq1SRfW8U:gJpQNphfBl3mv/QFfrjTzzkq1SRfW8U
TLSH
T144558D203645C537C92D46F0993CAEAF109DBDA10B6594E7B3D86FAA2C745C38732E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
374f595bf03cde3b782eb82d60bf1e8899b63b4192c50fae40ef17fab683b3b3

File Explorer

374f595bf03cde3b782eb82d60bf1e8899b63b4192c50fae40ef17fab683b3b3

.dll 1.3MB

374f595bf03cde3b782eb82d60bf1e8899b63b4192c50fae40ef17fab683b3b3

IMPHASH 9fbafb2cda4f09649db701bfe400805e
SHA256 374f595bf03cde3b782eb82d60bf1e8899b63b4192c50fae40ef17fab683b3b3
MD5 04550892289a7d83801a80a6a24c481c
SHA1 9f5595530d1efeed7bfa92642be75ba674d6fd42
SHA512 c3cdbfc5d33a346de778eee5f9d95ff51a7f89566332c809fbc9d4d9fd0efa58a6fe5122ff7614c310d8d283a509f67236623f0cd7ab1d1cd70fcbc6fa802c1b
SSDEEP 24576:gJpyrCe+EI5c3agtxX/ZmG3mv/NOFfrjTzzkq1SRfW8U:gJpQNphfBl3mv/QFfrjTzzkq1SRfW8U
TLSH
T144558D203645C537C92D46F0993CAEAF109DBDA10B6594E7B3D86FAA2C745C38732E1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

550488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\LDS\BiscuitZip\新建文件夹\zipper-tpi\bin\Release\BoxTool.pdb

kernel32

MoveFileW MoveFileExW WideCharToMultiByte CreateFileMappingW MapViewOfFile UnmapViewOfFile GetCurrentProcessId Sleep GetCurrentThreadId CreateEventW WaitForSingleObjectEx WaitForSingleObject SetEvent InitializeCriticalSectionEx SetLastError GetWindowsDirectoryW GetStartupInfoW CreateProcessW GetTempPathW SetFileAttributesW RemoveDirectoryW GetFileSizeEx GetFileAttributesW FindNextFileW FindClose GlobalLock GlobalUnlock CreateMutexW ReleaseMutex GetFileType WaitForMultipleObjects CancelIo PostQueuedCompletionStatus WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW RaiseException GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP SetFilePointerEx LocalFree ExitThread RtlUnwind CreateFileW DecodePointer lstrcpyW LoadLibraryW GetModuleFileNameW FreeLibrary GetLastError CloseHandle DeleteFileW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue FlushFileBuffers TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent WriteFile SetEndOfFile ReadFile ExitProcess GetACP VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent GetModuleHandleExW GetLocaleInfoW LCMapStringW CompareStringW FindResourceExW GetVersionExW GetCurrentProcess GetProcessHeap HeapSize HeapFree QueryPerformanceCounter GetCPInfo GetTickCount GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetExitCodeThread GetCurrentThread SwitchToThread DuplicateHandle TryEnterCriticalSection FindFirstFileExW FormatMessageW GetStringTypeW EncodePointer HeapReAlloc HeapAlloc HeapDestroy GetCommandLineW MultiByteToWideChar

user32

GetMessageW wsprintfW DefWindowProcW RegisterClassExW CreateWindowExW ChangeWindowMessageFilter GetClassNameW PostThreadMessageW PostMessageW RegisterWindowMessageW SetTimer IsWindow PeekMessageW DispatchMessageW TranslateMessage

advapi32

RegGetValueW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathW SHCreateItemFromParsingName ord165 DragQueryFileW

ole32

ReleaseStgMedium StringFromCLSID CoTaskMemFree OleInitialize CoCreateGuid CoInitialize OleUninitialize CoCreateInstance CoUninitialize

oleaut32

VariantClear VariantInit

shlwapi

StrStrIW PathFileExistsW PathIsDirectoryW PathCombineW wnsprintfW PathRemoveFileSpecW PathAppendW StrCmpIW ord176

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

Sharing

General

Malware Config

Signatures

File Explorer

374f595bf03cde3b782eb82d60bf1e8899b63b4192c50fae40ef17fab683b3b3

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

iphlpapi

urlmon

generic