146dee99bfd70a71bb016f5e92700446d53a8c46df1e7e337a0e092715d1532e

General

Target
146dee99bfd70a71bb016f5e92700446d53a8c46df1e7e337a0e092715d1532e
Size 1.6MB
Sample260703-kdepaady31
SHA256 146dee99bfd70a71bb016f5e92700446d53a8c46df1e7e337a0e092715d1532e
MD5 a35468c1e56c9e164d42ceec1b44a9ac
SHA1 e01260e58470c868318fcbc663c601d976f0eee2
SHA512 d1f4d26b7a3060a7d0f0490b8ce8e224024abd4a7166266e46e62484f8e9d5e315437697c65523246449609cdb1fe90bbcce571babc83e70ed0a4b6ef2206640
SSDEEP 49152:GboYPz6G7B1HnJAT0o9NZiYblz6KFdi2Ga9x3Ek0V:GboYJHJ206xHFdi4VEk0V
TLSH
T12975C0607312D232D56180F20DB9EFAA916CAD296F7206CFA3C42F3E56355D22F31E16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
146dee99bfd70a71bb016f5e92700446d53a8c46df1e7e337a0e092715d1532e

File Explorer

146dee99bfd70a71bb016f5e92700446d53a8c46df1e7e337a0e092715d1532e

.exe 1.6MB

146dee99bfd70a71bb016f5e92700446d53a8c46df1e7e337a0e092715d1532e

IMPHASH f9cddeff2d7a268035cd49ec94eaa573
SHA256 146dee99bfd70a71bb016f5e92700446d53a8c46df1e7e337a0e092715d1532e
MD5 a35468c1e56c9e164d42ceec1b44a9ac
SHA1 e01260e58470c868318fcbc663c601d976f0eee2
SHA512 d1f4d26b7a3060a7d0f0490b8ce8e224024abd4a7166266e46e62484f8e9d5e315437697c65523246449609cdb1fe90bbcce571babc83e70ed0a4b6ef2206640
SSDEEP 49152:GboYPz6G7B1HnJAT0o9NZiYblz6KFdi2Ga9x3Ek0V:GboYJHJ206xHFdi4VEk0V
TLSH
T12975C0607312D232D56180F20DB9EFAA916CAD296F7206CFA3C42F3E56355D22F31E16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

575310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_v12_i18n_202511_branch\Build\Release\WPSOffice\office6\wpscloudsvr.pdb

kernel32

SetCurrentDirectoryW FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW GetCommandLineW CloseHandle GetLastError Sleep GetCurrentProcessId TerminateProcess GetCurrentThreadId OpenProcess GetSystemDirectoryW GetSystemWow64DirectoryW GetModuleHandleW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject WaitForMultipleObjects CreateThread QueueUserWorkItem UnregisterWaitEx LocalFree GetEnvironmentVariableW SetEnvironmentVariableW GetDriveTypeW GetTempPathW GetStartupInfoW GetTickCount SetDllDirectoryW GetDllDirectoryW CopyFileW GetSystemTime SystemTimeToFileTime GetExitCodeProcess VerSetConditionMask GetCurrentProcess LocalAlloc VerifyVersionInfoW FindClose FindFirstFileW FindNextFileW SetEvent CreateEventW CreateFileW ReadFile WriteFile SetNamedPipeHandleState WaitNamedPipeW GetOverlappedResult CancelIo FlushFileBuffers ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateDirectoryW GetFileAttributesW ReadProcessMemory WideCharToMultiByte SetUnhandledExceptionFilter LoadLibraryExW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar GetFileAttributesExW GetModuleHandleExW VirtualAlloc VirtualFree lstrlenW GetPrivateProfileIntW GetPrivateProfileStringW CreateProcessW ExpandEnvironmentStringsW GetLongPathNameW GetCurrentThread ProcessIdToSessionId SetLastError OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency SetStdHandle GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetStringTypeW FindFirstFileExW SetEndOfFile SetFilePointerEx EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetLocaleInfoEx CompareStringEx GetCPInfo ResetEvent WaitForSingleObjectEx InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter OutputDebugStringW RtlUnwind InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree SetConsoleCtrlHandler GetStdHandle ExitProcess GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode GetFileSizeEx ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

146dee99bfd70a71bb016f5e92700446d53a8c46df1e7e337a0e092715d1532e

kernel32

generic