3529658204a0b69beba7da75d34e5ce2aceef7da8d7929439959f625244ae1c2

Sharing

Copy URL Twitter E-mail

General

Target
3529658204a0b69beba7da75d34e5ce2aceef7da8d7929439959f625244ae1c2
Size 652KB
Sample260718-v4592agy8m
SHA256 3529658204a0b69beba7da75d34e5ce2aceef7da8d7929439959f625244ae1c2
MD5 fbbb41e1df3e228bca6e01d15c6a284b
SHA1 8e8d43044e439e0400dace8ea6f45b6ad6697d6e
SHA512 9b29adc6c59a886347185b08b28c320f7bf0b9f85c7085261a4cbe72e34bd4bfad701a818de2ac28b9d0648b75e4d22cc0fd6d78778c3fe4458272389bedcd7e
SSDEEP 6144:/IkhLxwoksag0+JVYkqKmlHA5W8SW9zEwbrwJawK3wXAuUUpDSmm7Iu:/ZwSagukqL6NT9zEwbgawo0pD2Iu
TLSH
T1A2E48E6177E412E6D0B7D13E8AD68F6AF6B2B8150720D7C701D442992F1BAE84E3F325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3529658204a0b69beba7da75d34e5ce2aceef7da8d7929439959f625244ae1c2

File Explorer

3529658204a0b69beba7da75d34e5ce2aceef7da8d7929439959f625244ae1c2

.exe 652KB

3529658204a0b69beba7da75d34e5ce2aceef7da8d7929439959f625244ae1c2

IMPHASH 00b31acffb84da09b28c903cbc3b3815
SHA256 3529658204a0b69beba7da75d34e5ce2aceef7da8d7929439959f625244ae1c2
MD5 fbbb41e1df3e228bca6e01d15c6a284b
SHA1 8e8d43044e439e0400dace8ea6f45b6ad6697d6e
SHA512 9b29adc6c59a886347185b08b28c320f7bf0b9f85c7085261a4cbe72e34bd4bfad701a818de2ac28b9d0648b75e4d22cc0fd6d78778c3fe4458272389bedcd7e
SSDEEP 6144:/IkhLxwoksag0+JVYkqKmlHA5W8SW9zEwbrwJawK3wXAuUUpDSmm7Iu:/ZwSagukqL6NT9zEwbgawo0pD2Iu
TLSH
T1A2E48E6177E412E6D0B7D13E8AD68F6AF6B2B8150720D7C701D442992F1BAE84E3F325
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11841

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\15201\OneDrive\桌面\MalwareAnalysis实验\01_static\static.pdb

user32

MessageBoxA

kernel32

HeapAlloc WriteConsoleW WinExec QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW CloseHandle RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread OutputDebugStringW RtlUnwind HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber InitializeCriticalSectionEx VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetProcessHeap SetConsoleCtrlHandler HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW CreateFileW

Name

.text

Size

524KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3529658204a0b69beba7da75d34e5ce2aceef7da8d7929439959f625244ae1c2

user32

kernel32

generic