dcbbf777800e95b6abe44b74a6c9ac6f30e43c860fc03efe9148168519dde25a

Sharing

Copy URL Twitter E-mail

General

Target
dcbbf777800e95b6abe44b74a6c9ac6f30e43c860fc03efe9148168519dde25a
Size 560KB
Sample260723-nbwfsshq9w
SHA256 dcbbf777800e95b6abe44b74a6c9ac6f30e43c860fc03efe9148168519dde25a
MD5 51a1c042715cb7ea866d7f56fb0eda39
SHA1 8e6e4392512c88e13746d7cfebc8fba64e4bcc55
SHA512 578049bd5787b1b6651b752ac25174351b8afc9fef17a000a8161cf5ea2c3433f5be2fc8a8508804d4fa94cfd1691d01bee25b81d285bf3829686fc95a971919
SSDEEP 12288:yez4c4uhr93vXGlctFIjek3xoGB4/Eh+56V2bOo8yOgLtB9YTcwtpp5ZjoGI:75G6tRMmBBOTcwTp5V2
TLSH
T133C48D20B511D13AE8E340F18EBE976E952CAD600B2555CBF3C819AD4A759E07F3273B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dcbbf777800e95b6abe44b74a6c9ac6f30e43c860fc03efe9148168519dde25a

File Explorer

dcbbf777800e95b6abe44b74a6c9ac6f30e43c860fc03efe9148168519dde25a

.exe 560KB

dcbbf777800e95b6abe44b74a6c9ac6f30e43c860fc03efe9148168519dde25a

IMPHASH ec17f8f0a66c575b5bcb396dfdbf5815
SHA256 dcbbf777800e95b6abe44b74a6c9ac6f30e43c860fc03efe9148168519dde25a
MD5 51a1c042715cb7ea866d7f56fb0eda39
SHA1 8e6e4392512c88e13746d7cfebc8fba64e4bcc55
SHA512 578049bd5787b1b6651b752ac25174351b8afc9fef17a000a8161cf5ea2c3433f5be2fc8a8508804d4fa94cfd1691d01bee25b81d285bf3829686fc95a971919
SSDEEP 12288:yez4c4uhr93vXGlctFIjek3xoGB4/Eh+56V2bOo8yOgLtB9YTcwtpp5ZjoGI:75G6tRMmBBOTcwTp5V2
TLSH
T133C48D20B511D13AE8E340F18EBE976E952CAD600B2555CBF3C819AD4A759E07F3273B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

186304

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Phuong Vien\NomIME\output\Win32\NomIMEDeployer.pdb

rime

rime_get_api

kernel32

FindResourceExW GetThreadUILanguage SetLastError EnterCriticalSection LeaveCriticalSection GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionEx OutputDebugStringW CreateDirectoryW DecodePointer GetSystemWow64DirectoryW ExitProcess WaitForSingleObject FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW LoadLibraryExW SetThreadUILanguage SetThreadLocale FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FindResourceW GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetConsoleMode GetConsoleOutputCP SetFilePointerEx CreateMutexW GetFileType GetStdHandle VirtualQuery GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetCommandLineA CloseHandle GetFileAttributesW GetUserDefaultUILanguage GetLastError WideCharToMultiByte MultiByteToWideChar RaiseException SizeofResource LockResource LoadResource GetModuleFileNameW ExpandEnvironmentStringsW VirtualProtect TerminateProcess UnhandledExceptionFilter FlsFree FlsSetValue AcquireSRWLockExclusive ReleaseSRWLockExclusive WakeAllConditionVariable FlsGetValue SetEndOfFile WriteConsoleW ReadConsoleW SetStdHandle FlsAlloc RtlUnwind GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc OpenEventA WaitForSingleObjectEx ReleaseSemaphore ResetEvent GetSystemTimeAsFileTime GetCurrentProcessId GetFileSizeEx SleepConditionVariableSRW FormatMessageA FormatMessageW LocalFree CreateEventA SetEvent GetModuleHandleExW WaitNamedPipeW SetNamedPipeHandleState CreateFileW WriteFile FlushFileBuffers DisconnectNamedPipe ReadFile IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx GetStringTypeW LCMapStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter

user32

MapWindowPoints GetClientRect GetParent GetWindowRect GetMonitorInfoW EnableWindow GetWindowLongW GetWindow BringWindowToTop EndDialog GetDlgItem SetWindowLongW DialogBoxParamW SetWindowPos UnregisterClassW MessageBoxExW GetActiveWindow MonitorFromWindow MessageBoxW SendMessageW LoadStringW DestroyWindow CharNextW GetKeyState CallWindowProcW DefWindowProcW SetWindowTextW

gdi32

GetObjectW CreateCompatibleDC SetDIBColorTable SelectObject DeleteObject DeleteDC CreateDIBSection

advapi32

RegEnumKeyExW GetUserNameW RegQueryValueExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegDeleteKeyW RegGetValueW RegCloseKey

shell32

ShellExecuteExW ord155 SHOpenFolderAndSelectItems ord190

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize CoInitialize

oleaut32

VarUI4FromStr

gdiplus

GdiplusShutdown GdipDrawImageI GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipFree GdipAlloc GdipCloneImage GdipCreateBitmapFromScan0 GdipBitmapUnlockBits GdipBitmapLockBits GdipGetImagePalette GdipGetImagePaletteSize GdipGetImageWidth GdipGetImagePixelFormat GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdiplusStartup GdipGetImageHeight

comctl32

InitCommonControlsEx

??0?$codecvt_null@_W@archive@boost@@QAE@I@Z ??0?$singleton@V?$extended_type_info_typeid@UCandidateInfo@nomime@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UText@nomime@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UTextAttribute@nomime@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UTextRange@nomime@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@V?$vector@UText@nomime@@V?$allocator@UText@nomime@@@std@@@std@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@nomime@@V?$allocator@UTextAttribute@nomime@@@std@@@std@@@serialization@boost@@@serialization@boost@@IAE@XZ ??1?$codecvt_null@_W@archive@boost@@UAE@XZ ??_F?$codecvt_null@_W@archive@boost@@QAEXXZ ?do_always_noconv@?$codecvt_null@_W@archive@boost@@EBE_NXZ ?do_encoding@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_in@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?do_max_length@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_out@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCandidateInfo@nomime@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UCandidateInfo@nomime@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UText@nomime@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UText@nomime@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextAttribute@nomime@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UTextAttribute@nomime@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextRange@nomime@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UTextRange@nomime@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UText@nomime@@V?$allocator@UText@nomime@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$vector@UText@nomime@@V?$allocator@UText@nomime@@@std@@@std@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@nomime@@V?$allocator@UTextAttribute@nomime@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$vector@UTextAttribute@nomime@@V?$allocator@UTextAttribute@nomime@@@std@@@std@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@nomime@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@nomime@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UText@nomime@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UText@nomime@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@nomime@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@nomime@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@nomime@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@nomime@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@nomime@@V?$allocator@UText@nomime@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@nomime@@V?$allocator@UText@nomime@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@nomime@@V?$allocator@UTextAttribute@nomime@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@nomime@@V?$allocator@UTextAttribute@nomime@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_lock@singleton_module@serialization@boost@@AAEAA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@QAE_NXZ ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@nomime@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UText@nomime@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@nomime@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@nomime@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@nomime@@V?$allocator@UText@nomime@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@nomime@@V?$allocator@UTextAttribute@nomime@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@AAEAA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@QAEXXZ ?unlock@singleton_module@serialization@boost@@QAEXXZ

Name

.text

Size

399KB

Virtual Size

399KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dcbbf777800e95b6abe44b74a6c9ac6f30e43c860fc03efe9148168519dde25a

rime

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

comctl32

generic