9b1e5ee2cf485bbc62aa9d0e2da357a684d84c16e5e8e3d4249aa21c4576c797

Sharing

Copy URL Twitter E-mail

General

Target
9b1e5ee2cf485bbc62aa9d0e2da357a684d84c16e5e8e3d4249aa21c4576c797
Size 2.3MB
Sample260708-h12ffsct8x
SHA256 9b1e5ee2cf485bbc62aa9d0e2da357a684d84c16e5e8e3d4249aa21c4576c797
MD5 246ddb375ed0b19ea26bd3edd16544b0
SHA1 f2dd50f6665561e2e8c6171dcd973632bfd9a5fc
SHA512 c55d70d8e91a057830d9a278a270c4388f96a974dabddb859f811b07fd785167c394023bbeb438763e9b408068d9f204dc8d70acae303cb94e571e276daa5eaf
SSDEEP 49152:y7SSWMjSDTa8x5TtldaYIr4yoxHoC3mDmg27RnWGj:y7SSWMjSD5xudD527BWG
TLSH
T105B58E21B655C737E5514070472C8E6F9029B9302BA298C7F3C81F6A28F5DE35A36E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b1e5ee2cf485bbc62aa9d0e2da357a684d84c16e5e8e3d4249aa21c4576c797

File Explorer

9b1e5ee2cf485bbc62aa9d0e2da357a684d84c16e5e8e3d4249aa21c4576c797

.exe 2.3MB

9b1e5ee2cf485bbc62aa9d0e2da357a684d84c16e5e8e3d4249aa21c4576c797

IMPHASH ced5068dfe464cb46568d8268fc8149f
SHA256 9b1e5ee2cf485bbc62aa9d0e2da357a684d84c16e5e8e3d4249aa21c4576c797
MD5 246ddb375ed0b19ea26bd3edd16544b0
SHA1 f2dd50f6665561e2e8c6171dcd973632bfd9a5fc
SHA512 c55d70d8e91a057830d9a278a270c4388f96a974dabddb859f811b07fd785167c394023bbeb438763e9b408068d9f204dc8d70acae303cb94e571e276daa5eaf
SSDEEP 49152:y7SSWMjSDTa8x5TtldaYIr4yoxHoC3mDmg27RnWGj:y7SSWMjSD5xudD527BWG
TLSH
T105B58E21B655C737E5514070472C8E6F9029B9302BA298C7F3C81F6A28F5DE35A36E7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

983875

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\zhanlue\rcimage\bin\Win32\Release\pdb\2345PicLoader.pdb

kernel32

SetFilePointer SetEndOfFile DeleteFileW GetFileSizeEx InitializeCriticalSection FindFirstFileW GetLongPathNameW GetShortPathNameW CreateFileW GetFileAttributesExW FindNextFileW FindClose HeapFree OpenProcess GlobalAlloc GlobalFree HeapAlloc GetProcessHeap SetFileTime GetFileSize GetFileTime FormatMessageW CreateEventW SetEvent ResetEvent InterlockedExchangeAdd CreateDirectoryW GetFullPathNameW RemoveDirectoryW GetTempPathW SetFileAttributesW GetCurrentDirectoryW GetWindowsDirectoryW MoveFileExW GetTempFileNameW MoveFileW QueryDosDeviceW GetCurrentProcess GetLogicalDriveStringsW InterlockedExchange SystemTimeToFileTime GlobalMemoryStatusEx LoadLibraryExW GetPrivateProfileStringW GlobalLock GlobalUnlock SizeofResource lstrcpynW TerminateProcess InterlockedDecrement LocalAlloc WriteFile FreeLibraryAndExitThread ExitThread SwitchToThread ReadFile lstrcpyW lstrcatW lstrlenW GetExitCodeProcess CreateProcessW GetCurrentProcessId LocalFree WaitForMultipleObjects WideCharToMultiByte MultiByteToWideChar GetACP CloseHandle Sleep ReleaseMutex WaitForSingleObject CreateMutexW lstrcmpiW DeviceIoControl ResumeThread GetEnvironmentVariableW WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize SetStdHandle CreateThread SetEnvironmentVariableA FreeEnvironmentStringsW FindResourceW LoadResource GetSystemInfo LockResource GetVersionExW GetModuleHandleW LoadLibraryA GetFileAttributesW GetModuleFileNameW ExpandEnvironmentStringsW GetTickCount DeleteCriticalSection DecodePointer RaiseException GetLastError GetCurrentThreadId SetErrorMode LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection SetLastError WritePrivateProfileStringW MulDiv FreeLibrary GetProcAddress GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsBadStringPtrW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeZoneInformation GetStringTypeW GetStdHandle GetModuleHandleExW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc LoadLibraryW RtlUnwind DosDateTimeToFileTime MapViewOfFile CreateFileMappingW GetFileType FileTimeToSystemTime DuplicateHandle UnmapViewOfFile OutputDebugStringW LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList EncodePointer InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter

user32

GetWindow DialogBoxParamW SendMessageTimeoutW SendMessageW EnumWindows GetClassNameW GetWindowLongW GetWindowRect UnregisterClassW DestroyWindow GetDC IsWindowVisible SetWindowPos GetDlgItem GetForegroundWindow DefWindowProcW CreateWindowExW RegisterClassExW ShowWindow IsWindow CopyRect IsWindowEnabled IsRectEmpty LoadCursorW SetWindowLongW GetParent ReleaseDC GetActiveWindow InvalidateRect EndPaint BeginPaint PtInRect OffsetRect GetDesktopWindow WindowFromPoint GetSystemMetrics SetWindowRgn SetTimer EndDialog MoveWindow GetMonitorInfoW MonitorFromWindow SystemParametersInfoW GetWindowThreadProcessId GetClientRect SetWindowTextW

gdi32

CreateRoundRectRgn CreateCompatibleDC DeleteDC DeleteObject BitBlt CreateCompatibleBitmap SetViewportOrgEx SelectObject

advapi32

RegSetValueExW RegEnumKeyExW RegCloseKey GetUserNameW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW LookupAccountNameW GetFileSecurityW GetSecurityDescriptorDacl GetAce GetAclInformation EqualSid RegCreateKeyExW RegQueryValueExW RegDeleteValueW RegDeleteKeyW RegOpenCurrentUser RegOpenKeyExW

shell32

ord190 ShellExecuteW SHChangeNotify SHGetDesktopFolder SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHGetPathFromIDListW ShellExecuteExW ord155 SHGetFolderPathW

ole32

CoCreateInstance CoUninitialize CoInitialize CoInitializeSecurity CreateStreamOnHGlobal CoTaskMemFree

oleaut32

VariantChangeType VariantClear VariantInit SysAllocString SysFreeString

shlwapi

PathRemoveFileSpecW SHDeleteKeyW

imm32

ImmDisableIME

gdiplus

GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipDeleteFont GdipDrawImageRectRectI GdipCreateBitmapFromScan0 GdipGetImageWidth GdipSetCompositingMode GdipDeleteGraphics GdipFillRectangleI GdipGetImageGraphicsContext GdipCloneBrush GdipFree GdipCreateHBITMAPFromBitmap GdipCreateSolidFill GdipDisposeImage GdipAlloc GdipCreateFontFromLogfontW GdipDeleteBrush GdipCloneImage GdipGetImageHeight GdipCreateFromHDC GdipDrawImageRectI GdiplusStartup GdipMeasureString GdiplusShutdown GdipCreateBitmapFromStream GdipSetTextRenderingHint GdipDrawString

Sharing

General

Malware Config

Signatures

File Explorer

9b1e5ee2cf485bbc62aa9d0e2da357a684d84c16e5e8e3d4249aa21c4576c797

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

imm32

gdiplus

generic