d0aeefa0ef431e9fe0e4df8071a0ff487c8d71c1d1c1b1ee24cebc3ff19db804

General

Target
d0aeefa0ef431e9fe0e4df8071a0ff487c8d71c1d1c1b1ee24cebc3ff19db804
Size 808KB
Sample260718-pzphtsfs3x
SHA256 d0aeefa0ef431e9fe0e4df8071a0ff487c8d71c1d1c1b1ee24cebc3ff19db804
MD5 0f9c5bf07d1d12e8f295cca964457f03
SHA1 a38164e5433e3e1cc1909dcd62a46dcc94a3b5a5
SHA512 cc9eed7ecb5ce175cb68ac6926df419f8b64bbdec311e2926839902a0a4f832365a4c1508dbd09f9f73dcad883683b733482a8902b3a5e7d7cc0d9faf56ff38c
SSDEEP 12288:MJPrRsK2SYNPG2Nl4ySBCGdo6hcXBW3CMYxHGALEQ2BjvrEH73:3PNl4yh8DhcXBW3CM41grEH73
TLSH
T17205B01172E182B7D7B205706D69B739A5FEBF3A4939CE8B03541F186968A40CD3CB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d0aeefa0ef431e9fe0e4df8071a0ff487c8d71c1d1c1b1ee24cebc3ff19db804

File Explorer

d0aeefa0ef431e9fe0e4df8071a0ff487c8d71c1d1c1b1ee24cebc3ff19db804

.exe 808KB

d0aeefa0ef431e9fe0e4df8071a0ff487c8d71c1d1c1b1ee24cebc3ff19db804

IMPHASH 361f7e4bd354f199bd8959dc3b1fc9bd
SHA256 d0aeefa0ef431e9fe0e4df8071a0ff487c8d71c1d1c1b1ee24cebc3ff19db804
MD5 0f9c5bf07d1d12e8f295cca964457f03
SHA1 a38164e5433e3e1cc1909dcd62a46dcc94a3b5a5
SHA512 cc9eed7ecb5ce175cb68ac6926df419f8b64bbdec311e2926839902a0a4f832365a4c1508dbd09f9f73dcad883683b733482a8902b3a5e7d7cc0d9faf56ff38c
SSDEEP 12288:MJPrRsK2SYNPG2Nl4ySBCGdo6hcXBW3CMYxHGALEQ2BjvrEH73:3PNl4yh8DhcXBW3CM41grEH73
TLSH
T17205B01172E182B7D7B205706D69B739A5FEBF3A4939CE8B03541F186968A40CD3CB63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

542064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\用户数据\Documents\Visual Studio 2015\Projects\Dism++\Release\Dism++x86.pdb

kernel32

HeapReAlloc HeapFree InitOnceExecuteOnce SetEvent ResetEvent WaitForSingleObject CreateEventW Sleep TerminateProcess GetSystemInfo GetSystemTimeAsFileTime GetSystemDirectoryW GetNativeSystemInfo IsWow64Process FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW GetCurrentThreadId HeapDestroy HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection VerifyVersionInfoW VerSetConditionMask SizeofResource LockResource LoadResource FindResourceW FindResourceExW WritePrivateProfileSectionW GetFileAttributesW DeviceIoControl GetVolumePathNameW GetVolumeInformationByHandleW GetModuleFileNameW GetEnvironmentVariableW UnmapViewOfFile MoveFileExW DeleteFileW GlobalMemoryStatusEx GetUserDefaultLCID LCIDToLocaleName GetThreadLocale GetLocaleInfoEx CreateProcessW GetWindowsDirectoryW FindClose FindFirstFileW FindNextFileW IsValidLocaleName MoveFileW CreateDirectoryW GetVolumeInformationW SetVolumeLabelW RemoveDirectoryW DeleteCriticalSection GetTickCount CreateFileMappingW MapViewOfFile LocalFree GetCurrentProcess ReadFile WriteFile SetFilePointer GetTempPathA GetTempFileNameA DeleteFileA GetFileInformationByHandle FileTimeToLocalFileTime FileTimeToDosDateTime lstrcpyA lstrcpynA ReleaseMutex HeapAlloc ReleaseSRWLockExclusive InitializeCriticalSectionEx InitializeSRWLock AcquireSRWLockExclusive AcquireSRWLockShared VirtualFreeEx VirtualAllocEx DuplicateHandle WaitForMultipleObjects ExpandEnvironmentStringsW SetFilePointerEx GetFileSizeEx SetEnvironmentVariableW GetVolumeNameForVolumeMountPointW CreateMutexW GetFullPathNameW lstrcmpiA CopyFileW GetFileSize GetLocaleInfoW GetExitCodeProcess WideCharToMultiByte lstrcmpA SystemTimeToFileTime GetExitCodeThread EnumUILanguagesW CopyFileExW FreeResource SetThreadUILanguage SetThreadLocale LocaleNameToLCID OpenProcess DecodePointer VirtualProtect GetDiskFreeSpaceExW GetCurrentProcessId VirtualQuery GetProcessId GetSystemTime LoadLibraryW FormatMessageW GetLongPathNameW GetTempPathW MultiByteToWideChar GetDriveTypeW SetFileAttributesW ProcessIdToSessionId GetShortPathNameW GetLocalTime GetStartupInfoW WritePrivateProfileStringW GetModuleHandleExW GetDiskFreeSpaceW GetPrivateProfileSectionW GetVersionExW GetPrivateProfileStringW LocalFileTimeToFileTime GetCurrentDirectoryW DosDateTimeToFileTime MulDiv GetTickCount64 TerminateThread GetQueuedCompletionStatus PostQueuedCompletionStatus GlobalAlloc GlobalLock GlobalUnlock CreateIoCompletionPort EncodePointer SetErrorMode SetLastError GetLastError RaiseException CloseHandle ReleaseSRWLockShared CreateFileW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA IsDebuggerPresent OutputDebugStringW WakeAllConditionVariable ExitProcess QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW AreFileApisANSI

comctl32

ord17 PropertySheetW DestroyPropertySheetPage CreatePropertySheetPageW ord345 InitCommonControlsEx _TrackMouseEvent

ntdll

RtlAdjustPrivilege ZwClose NtCreateFile NtQueryVolumeInformationFile RtlGetLastNtStatus RtlImageNtHeader ZwOpenSymbolicLinkObject RtlInitUnicodeString NtWriteFile ZwQuerySymbolicLinkObject RtlImageRvaToVa NtDeleteKey NtQueryInformationProcess NtShutdownSystem NtReadFile NtQueryInformationFile RtlComputeCrc32 NtSetInformationFile RtlFreeUnicodeString RtlDosPathNameToNtPathName_U NtClose ZwQueryDirectoryFile NtOpenFile NtReadVirtualMemory NtWriteVirtualMemory NtQuerySystemInformation ZwAddBootEntry ZwSetBootEntryOrder NtTranslateFilePath ZwEnumerateBootEntries ZwQueryBootEntryOrder RtlNtStatusToDosError LdrVerifyImageMatchesChecksum

msvcrt

_ftol2_sse _except_handler3 _ftol2 memset ??3@YAXPAX@Z _purecall ??2@YAPAXI@Z wcsnlen memcpy _errno wcstoul wcsncpy_s wcslen memmove memcmp _wcsnicmp wcschr towupper ??_V@YAXPAX@Z ??_U@YAPAXI@Z wcsftime _localtime64_s _time64 _wcstoui64 _wcsicmp _beginthreadex _wcslwr_s bsearch free malloc strlen strnlen _mktime64 wcscpy wcstol _strtoui64 realloc strcmp strtoul strtol _wtoi isdigit ??0exception@@QAE@ABV0@@Z ?what@exception@@UBEPBDXZ ??1exception@@UAE@XZ _wcsupr_s wcsrchr wcsstr _mbschr _mbslwr_s iswspace wcscmp wcscpy_s _mbscmp calloc abs toupper wcsncpy _itow wcstod wcscat _strcmpi qsort_s _lrotl ??0exception@@QAE@XZ ??0exception@@QAE@ABQBD@Z _CxxThrowException __CxxFrameHandler3 _amsg_exit _except_handler4_common __wgetmainargs __setusermatherr _initterm _initterm_e _set_fmode __p__commode _controlfp_s _strlwr __DestructExceptionObject _invalid_parameter _msize __set_app_type _wcmdln abort _XcptFilter ?terminate@@YAXXZ vswprintf_s _vscwprintf swscanf sscanf vsprintf_s _vscprintf swprintf_s

generic

count=1, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=10, id=199, version=41118,

count=3, id=260, version=30034,

count=11, id=259, version=30034,

count=5, id=261, version=27412,

count=13, id=261, version=29912,

count=3, id=253, version=28518,

count=1, id=259, productName=VS2019 v16.10.0 build 30037, version=30037,

count=8, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=1, id=259, version=25508,

count=25, id=261, productName=VS2019 v16.10.3 build 30038, version=30038,

count=6, id=261, version=30034,

count=1, id=260, productName=VS2019 v16.1.2 build 27702, version=27702,

count=2, id=261, productName=VS2019 v16.1.2 build 27702, version=27702,

count=8, id=260, version=27412,

count=2, id=262, version=27412,

count=7, id=257, version=27412,

count=777, id=1, productName=Unmarked objects,

count=1, id=261, version=28106,

count=16, id=265, version=30040,

count=1, id=256, productName=VS2019 v16.10.4 build 30040, version=30040,

count=1, id=255, productName=VS2019 v16.10.4 build 30040, version=30040,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.10.4 build 30040, version=30040,

Sharing

General

Malware Config

Signatures

File Explorer

d0aeefa0ef431e9fe0e4df8071a0ff487c8d71c1d1c1b1ee24cebc3ff19db804

kernel32

comctl32

ntdll

msvcrt

generic