7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089

Sharing

Copy URL Twitter E-mail

General

Target
7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089
Size 706KB
Sample260702-mshqlags4y
SHA256 7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089
MD5 a5a5d22c4bb58c11bcd765b9a72a6699
SHA1 c01902ea966481b48f337cc7df2c046c8d2c4b78
SHA512 7db4e357533d0348e39e2c44cf832eb699b5cee94e609382727a9412ff05d3aab58cc4012652ae8378b2ef948c5f5ff937253fbf0f3b8460c1f962f1718762c3
SSDEEP 12288:YdVZtMNDJm7P99ZYWJKI2K7X4lnMLcueFvtiou3NG+wO5EXACuTkKQh4dyaxVakF:m3MhkR9ZYWJKI2K7X4lnML2VIU+zEXM8
TLSH
T19FF49D1275E5BCB6C47242312B3BA7E5573EED200B21C9DFA3D406699A7C0C27B32796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089

File Explorer

7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089

.exe 706KB

7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089

IMPHASH a27dd6d6cee2889831cac88d1993d33c
SHA256 7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089
MD5 a5a5d22c4bb58c11bcd765b9a72a6699
SHA1 c01902ea966481b48f337cc7df2c046c8d2c4b78
SHA512 7db4e357533d0348e39e2c44cf832eb699b5cee94e609382727a9412ff05d3aab58cc4012652ae8378b2ef948c5f5ff937253fbf0f3b8460c1f962f1718762c3
SSDEEP 12288:YdVZtMNDJm7P99ZYWJKI2K7X4lnMLcueFvtiou3NG+wO5EXACuTkKQh4dyaxVakF:m3MhkR9ZYWJKI2K7X4lnML2VIU+zEXM8
TLSH
T19FF49D1275E5BCB6C47242312B3BA7E5573EED200B21C9DFA3D406699A7C0C27B32796
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

115329

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

J:\其它杂项目\chrome\老友定制\两个edge导航\myfavoritegui加密发布230109\Release\softloadergui.pdb

kernel32

LocalFree GetStdHandle WriteFile SetFilePointer SetEndOfFile CreateFileW OutputDebugStringW CloseHandle WriteConsoleW GetCurrentProcess WaitForSingleObject GetFileAttributesW GetProcAddress CreateProcessW GetModuleHandleW TerminateProcess Sleep GetVolumeInformationW GetSystemDirectoryW GlobalAlloc ExitProcess GetComputerNameW CreateDirectoryW ReadFile SetFileTime LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime GetTimeZoneInformation SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID LocalAlloc FindClose WideCharToMultiByte GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource SizeofResource FindResourceExW RaiseException HeapReAlloc LockResource GetLastError MultiByteToWideChar HeapSize InitializeCriticalSectionAndSpinCount HeapFree IsValidLocale GetTimeFormatW GetDateFormatW ReadConsoleW GetConsoleMode GetFileType SetFilePointerEx GetACP GetModuleFileNameA GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetStringTypeW FreeLibrary LoadLibraryExW

user32

wsprintfW CreateWindowExW GetMessageW DefWindowProcW MessageBoxW DispatchMessageW RegisterClassW TranslateMessage LoadCursorW GetClientRect PostMessageW

advapi32

RegQueryValueExW GetUserNameW RegCreateKeyExW RegSetValueExW RegCloseKey SetEntriesInAclW ConvertStringSidToSidW InitializeAcl RegOpenKeyExW SetSecurityInfo ConvertSidToStringSidW LookupAccountSidW LookupAccountNameW GetSecurityInfo

shell32

SHCreateDirectoryExW SHGetFolderPathW

ole32

OleInitialize

shlwapi

PathIsDirectoryW PathFileExistsW

Name

.text

Size

343KB

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

214KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089

kernel32

user32

advapi32

shell32

ole32

shlwapi

generic