aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb

Sharing

Copy URL Twitter E-mail

General

Target
aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb
Size 3.1MB
Sample260709-rm76hsby6j
SHA256 aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb
MD5 f55098e788505b1fedabc82e289f9984
SHA1 7663388a9ad097934e341c9e7ea14787e2211cc9
SHA512 6e3511efd40b3c382495a0a83c5e25973235454104ed7a57caa3811bc8ca912d79dbb7b9b86c55477608d257693d8d5193ae12f14b23f0cefda2de8cf0f60a1b
SSDEEP 49152:RY53BaxSNNIP6o9XD5NDDZIhhid97Mq/ePv4TWC2Px+Y++W965CGSB716Iy:RcRa8he7Mq/OvcG+YII
TLSH
T18FE5AE117A81C432E56201F54929ABFE4479FE202B3181C3B7FDBA5E0B706D2DE3A756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb

File Explorer

aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb

.exe 3.1MB

aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb

IMPHASH c7c1934aed95098347113773880baca5
SHA256 aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb
MD5 f55098e788505b1fedabc82e289f9984
SHA1 7663388a9ad097934e341c9e7ea14787e2211cc9
SHA512 6e3511efd40b3c382495a0a83c5e25973235454104ed7a57caa3811bc8ca912d79dbb7b9b86c55477608d257693d8d5193ae12f14b23f0cefda2de8cf0f60a1b
SSDEEP 49152:RY53BaxSNNIP6o9XD5NDDZIhhid97Mq/ePv4TWC2Px+Y++W965CGSB716Iy:RcRa8he7Mq/OvcG+YII
TLSH
T18FE5AE117A81C432E56201F54929ABFE4479FE202B3181C3B7FDBA5E0B706D2DE3A756
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

709939

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\baidu\netdisk\pc-yunbrowser\output\AutoUpdate\output\pdb\Autoupdate.pdb

kernel32

FlushFileBuffers GetFileInformationByHandle GetLogicalDrives GetVolumeInformationW DuplicateHandle GetExitCodeThread CreateFileMappingW MapViewOfFile UnmapViewOfFile RemoveDirectoryW GetTempFileNameW SetFilePointerEx SetFileTime Sleep TlsAlloc TlsFree TlsSetValue TlsGetValue GetPrivateProfileStringW GetModuleHandleW GetTickCount FreeLibrary GetProcAddress LoadLibraryW WriteFile CreateDirectoryW ReadFile GetFileSize WaitForSingleObject DeleteFileW SetLastError RaiseException LeaveCriticalSection EnterCriticalSection GetCurrentThreadId GetModuleFileNameW Module32NextW Module32FirstW ReadDirectoryChangesW SetConsoleCtrlHandler SetEndOfFile EncodePointer OutputDebugStringW AllocConsole GetStdHandle GetConsoleScreenBufferInfo FreeConsole SetConsoleTextAttribute DeleteCriticalSection InitializeCriticalSectionAndSpinCount CloseHandle DeviceIoControl GetLastError MultiByteToWideChar GetVolumeInformationA FindResourceExW FindResourceW LoadResource LockResource SizeofResource WideCharToMultiByte GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize WriteConsoleW InitializeCriticalSection GetPrivateProfileIntW GetCurrentProcessId CreateMutexW ReleaseMutex VerSetConditionMask VerifyVersionInfoW SetThreadPriority TerminateThread WaitForMultipleObjects Process32NextW Process32FirstW CreateToolhelp32Snapshot LoadLibraryA GetFileAttributesW GetTempPathW IsWow64Process GetCurrentProcess GetACP SetFilePointer OpenEventW ResetEvent ExitProcess GetCommandLineW OpenProcess FindClose FindNextFileW FindFirstFileW DecodePointer LoadLibraryExW lstrcmpiW GetPrivateProfileSectionW GetSystemTime SystemTimeToFileTime WritePrivateProfileStringW MoveFileW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindNextFileA CreateFileW FileTimeToSystemTime FindFirstFileExA GetOEMCP IsValidCodePage GetTimeZoneInformation SetStdHandle GetFullPathNameW GetCurrentDirectoryW GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetModuleFileNameA SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW FreeLibraryAndExitThread ExitThread CreateThread GetFileAttributesExW RtlUnwind GetModuleHandleA GlobalUnlock GlobalLock GlobalAlloc lstrlenW SetEvent CreateEventW GetVersionExW CopyFileW FreeResource MulDiv HeapCreate ReadConsoleW MoveFileExW FormatMessageW LocalFree ReadConsoleA SetConsoleMode GetConsoleMode GetEnvironmentVariableW ConvertFiberToThread DeleteFiber GetFileType GetModuleHandleExW HeapDestroy QueryPerformanceCounter GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetStringTypeW GetSystemTimeAsFileTime IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA

user32

RegisterClassExW UnregisterClassW DestroyWindow IsWindow KillTimer SetTimer CharLowerBuffW PostThreadMessageW MessageBoxW PostMessageW PostQuitMessage GetMessageW PeekMessageW SetForegroundWindow SetWindowPos AttachThreadInput GetWindowThreadProcessId GetProcessWindowStation GetUserObjectInformationW GetDlgItem GetParent TrackMouseEvent AnimateWindow UpdateLayeredWindow PrintWindow SetLayeredWindowAttributes MoveWindow IsWindowVisible IsIconic IsWindowEnabled SetFocus GetActiveWindow SetCapture ReleaseCapture EnableWindow GetSystemMetrics EndMenu UpdateWindow SetActiveWindow GetDC ReleaseDC CharNextW EndPaint InvalidateRect GetClientRect GetWindowRect GetCursorPos CreateCaret GetCaretBlinkTime SetCaretPos ClientToScreen ScreenToClient MapWindowPoints CopyRect InflateRect IntersectRect IsRectEmpty GetDesktopWindow EnumChildWindows GetWindow MonitorFromWindow GetMonitorInfoW GetKeyState SetCursor PtInRect EqualRect LoadBitmapW LoadImageW DrawTextW OffsetRect DestroyIcon DrawIconEx FillRect SetRect MapVirtualKeyA DefWindowProcW GetSysColor FindWindowExW UnionRect SetRectEmpty OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard MessageBeep CreatePopupMenu DestroyMenu AppendMenuW TrackPopupMenu GetMenuItemInfoW GetForegroundWindow ShowWindow SendMessageW LoadIconW SetWindowTextW CallWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW LoadCursorW GetClassInfoExW DispatchMessageW BeginPaint TranslateMessage IsZoomed EnableMenuItem

gdi32

GetTextMetricsW CreateBitmap DeleteObject BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC CreateRectRgnIndirect GetCurrentObject GetObjectType GetRgnBox SelectClipRgn SelectObject SetBkColor SetBkMode StretchBlt SetTextColor GetObjectW ExtTextOutW SetViewportOrgEx CreatePen CreateRectRgn ExcludeClipRect GetClipRgn RectInRegion Rectangle RestoreDC SaveDC ExtSelectClipRgn OffsetViewportOrgEx AddFontMemResourceEx RemoveFontMemResourceEx GetTextExtentPointW GetTextExtentPoint32W GetDeviceCaps CreateFontIndirectW GetObjectA CreateSolidBrush GetStockObject GetTextColor DeleteDC GetViewportOrgEx LineTo RoundRect CreateDIBSection ExtCreatePen MoveToEx TextOutW GetClipBox CreateDIBitmap

advapi32

CryptGetUserKey CreateProcessAsUserW AdjustTokenPrivileges LookupPrivilegeValueW CheckTokenMembership CreateWellKnownSid GetTokenInformation DuplicateTokenEx OpenProcessToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegCloseKey RegQueryValueExA RegOpenKeyExA DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptEnumProvidersW CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW RegQueryValueExW

shell32

SHGetFolderPathW CommandLineToArgvW ord680 ShellExecuteExW ShellExecuteW SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal OleLockRunning CLSIDFromProgID CoCreateInstance CoTaskMemFree CoCreateGuid StringFromCLSID CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoInitializeEx CLSIDFromString CoLoadLibrary StringFromGUID2 StgCreateStorageEx StgOpenStorageEx CreateBindCtx

oleaut32

SysFreeString SysAllocString VariantClear GetErrorInfo SysStringLen VarBstrCmp SysAllocStringByteLen SysStringByteLen VariantInit LoadRegTypeLi LoadTypeLi VarUI4FromStr VariantCopy SafeArrayCreate SafeArrayGetUBound SysAllocStringLen SafeArrayGetLBound SafeArrayLock SafeArrayUnlock VarCmp

shlwapi

StrToIntExA StrToIntW

iphlpapi

GetAdaptersAddresses

wininet

HttpEndRequestA InternetOpenA InternetSetOptionA InternetConnectA HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestExA HttpQueryInfoW HttpEndRequestW HttpSendRequestW HttpAddRequestHeadersW HttpOpenRequestW InternetSetStatusCallbackW InternetSetOptionW InternetWriteFile HttpQueryInfoA InternetQueryDataAvailable InternetReadFile InternetCloseHandle InternetConnectW InternetReadFileExA InternetQueryOptionA

setupapi

SetupIterateCabinetW SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces

cabinet

ord22 ord23 ord20

bcrypt

BCryptGenRandom

imm32

ImmReleaseContext ImmGetContext

dwmapi

DwmGetWindowAttribute

gdiplus

GdipCreateTexture2I GdipDeleteBrush GdipCloneBrush GdipGetImageHeight GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipLoadImageFromStream GdipCreateFromHDC GdipDeleteGraphics GdipFillRectangleI GdipDrawImageRectRectI GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipSetImageAttributesWrapMode GdipLoadImageFromFile GdipLoadImageFromFileICM

msimg32

GradientFill AlphaBlend

ws2_32

closesocket WSAGetLastError WSACleanup recv send WSASetLastError

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

788KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

49KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

270KB

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

aa1e4f65769c77f22f1bbd9581bcfdfda895d59fbec03076b71f4f51b03ff9cb

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

iphlpapi

wininet

setupapi

cabinet

bcrypt

imm32

dwmapi

gdiplus

msimg32

ws2_32

crypt32

generic