e6bf5eb3de0ca0d6d4602544e4fefa6dc91387b3cd70efb423484f5f32ee8686

Sharing

Copy URL Twitter E-mail

General

Target
e6bf5eb3de0ca0d6d4602544e4fefa6dc91387b3cd70efb423484f5f32ee8686
Size 1.6MB
Sample260724-evtxmsscrb
SHA256 e6bf5eb3de0ca0d6d4602544e4fefa6dc91387b3cd70efb423484f5f32ee8686
MD5 810000d159470ffe873e45abea22d502
SHA1 1eb64cee775736881955396ebd8aa64ade48c9f3
SHA512 21ba6b286566c509710453a027d7a10e08b0e295bd8db7a0e4325735746c02f9e1b986a64b7ba0909c0684501d3585ab93ce6ff45e7213e82c67e2c203dcb963
SSDEEP 49152:4C6sgixdOKjU0co6OTMSq20iGaPcoWGrWNtmr7e:4C6mxdOKjD6IMz20DO
TLSH
T19085AF13B9808032E9EA0272D27A6F7A4D7EE934136D81E7A7D0289D5D705D2B73E353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e6bf5eb3de0ca0d6d4602544e4fefa6dc91387b3cd70efb423484f5f32ee8686

File Explorer

e6bf5eb3de0ca0d6d4602544e4fefa6dc91387b3cd70efb423484f5f32ee8686

.dll 1.6MB

e6bf5eb3de0ca0d6d4602544e4fefa6dc91387b3cd70efb423484f5f32ee8686

IMPHASH 81857dbcbd88cf2c1e04148d0803cb16
SHA256 e6bf5eb3de0ca0d6d4602544e4fefa6dc91387b3cd70efb423484f5f32ee8686
MD5 810000d159470ffe873e45abea22d502
SHA1 1eb64cee775736881955396ebd8aa64ade48c9f3
SHA512 21ba6b286566c509710453a027d7a10e08b0e295bd8db7a0e4325735746c02f9e1b986a64b7ba0909c0684501d3585ab93ce6ff45e7213e82c67e2c203dcb963
SSDEEP 49152:4C6sgixdOKjU0co6OTMSq20iGaPcoWGrWNtmr7e:4C6mxdOKjD6IMz20DO
TLSH
T19085AF13B9808032E9EA0272D27A6F7A4D7EE934136D81E7A7D0289D5D705D2B73E353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

388308

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\buildbot\build1\kugou_installer\build\Release\isx.pdb

kernel32

GetCurrentProcess MultiByteToWideChar WideCharToMultiByte lstrlenA SetFilePointer CreatePipe SetHandleInformation SetLastError CreateProcessW WaitForSingleObject GetExitCodeProcess GetTickCount PeekNamedPipe Sleep CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId OpenProcess TerminateProcess InterlockedDecrement GetPrivateProfileSectionW GetPrivateProfileSectionNamesW FindFirstFileW FindNextFileW FindClose GetLogicalDriveStringsW GetDriveTypeW RemoveDirectoryW WaitForMultipleObjects GetModuleFileNameW MoveFileW LoadLibraryExW EnumResourceNamesW FindResourceW SizeofResource LoadResource LockResource GetDiskFreeSpaceW GetProcessAffinityMask SetProcessAffinityMask LocalAlloc LocalFree SetEvent SetCurrentDirectoryW GetCommandLineW CreateEventW OpenFileMappingW OpenEventW GetFileAttributesW GetTimeZoneInformation GetNativeSystemInfo VerLanguageNameW GetFileSizeEx GetSystemInfo GetProcAddress GetModuleHandleW GetPrivateProfileIntW GetLocalTime GetPrivateProfileStringW lstrcatW GetCurrentThreadId GetVersionExW lstrcmpiW GlobalAlloc lstrcpynW SetConsoleMode ReadConsoleInputA FlushConsoleInputBuffer GetVersionExA GlobalMemoryStatus SetEndOfFile GetCurrentDirectoryW GetFullPathNameW SetEnvironmentVariableA WriteConsoleW GlobalFree FreeLibrary LoadLibraryW DeleteFileW DeviceIoControl UnmapViewOfFile MapViewOfFile CreateFileMappingW lstrcpyW GetLastError CreateThread WriteFile CreateDirectoryW ReadFile CloseHandle GetFileSize CreateFileW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount SetConsoleCtrlHandler SystemTimeToTzSpecificLocalTime FindFirstFileExW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetModuleFileNameA FlushFileBuffers GetConsoleCP ReadConsoleW GetConsoleMode VirtualProtect VirtualFree VirtualAlloc UnregisterWaitEx InitializeSListHead ReleaseSemaphore QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList HeapSize AreFileApisANSI GetModuleHandleExW ExitProcess GetOEMCP GetACP IsValidCodePage GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID GetSystemDefaultLangID lstrlenW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx CreateTimerQueue CreateSemaphoreW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind RaiseException ExitThread FileTimeToSystemTime GetFileInformationByHandle FileTimeToLocalFileTime SetFilePointerEx HeapAlloc GetCommandLineA IsProcessorFeaturePresent IsDebuggerPresent GetCPInfo GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes OutputDebugStringW HeapReAlloc SleepEx InitializeCriticalSection GetStdHandle LoadLibraryA GetFileType ExpandEnvironmentStringsA FormatMessageA InterlockedIncrement GetStringTypeW DuplicateHandle GetCurrentThread GetExitCodeThread EncodePointer DecodePointer GetSystemTimeAsFileTime HeapFree

user32

GetDesktopWindow GetWindowThreadProcessId SetForegroundWindow SystemParametersInfoW GetSystemMetrics MsgWaitForMultipleObjects GetDC ReleaseDC MessageBoxA UnhookWindowsHookEx CallNextHookEx SendMessageW GetDlgItem GetClassNameW SetWindowsHookExW wsprintfW PeekMessageW TranslateMessage GetUserObjectInformationW BringWindowToTop AttachThreadInput GetForegroundWindow FindWindowExW DestroyMenu CreatePopupMenu LoadStringW AllowSetForegroundWindow GetProcessWindowStation DispatchMessageW PostMessageW CharNextW

gdi32

GetDeviceCaps

advapi32

RegQueryInfoKeyW CloseServiceHandle QueryServiceStatus OpenServiceW OpenSCManagerW EqualSid GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCreateKeyExW AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW RegSetValueExW RegDeleteValueW RegEnumValueW ReportEventA RegQueryValueExW RegCloseKey RegOpenKeyExW RegisterEventSourceA DeregisterEventSource

shell32

SHGetDesktopFolder SHGetSpecialFolderPathW SHCreateDirectoryExW CommandLineToArgvW ShellExecuteExW SHChangeNotify SHGetSpecialFolderLocation

ole32

CoCreateGuid CoUninitialize CoInitialize CoCreateInstance CoTaskMemFree PropVariantClear

oleaut32

VariantInit VariantClear SysAllocString SysFreeString

shlwapi

PathFileExistsW PathIsDirectoryEmptyW ord176 PathFindExtensionW PathRemoveFileSpecW PathAppendW PathIsDirectoryW SHStrDupW PathFindFileNameW StrToIntW PathCombineW

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ws2_32

ntohs htons WSAGetLastError connect getpeername getsockname sendto recvfrom accept listen __WSAFDIsSet select ioctlsocket freeaddrinfo getaddrinfo gethostname setsockopt recv bind socket WSASetLastError closesocket getsockopt WSAStartup WSACleanup shutdown send

wldap32

ord46 ord30 ord211 ord301 ord27 ord33 ord60 ord26 ord41 ord143 ord50 ord22 ord35 ord32 ord200 ord79

generic

count=7, id=199, version=41118,

count=38, id=223, productName=VS2013 build 21005, version=21005,

count=4, id=225, version=20806,

count=133, id=225, productName=VS2013 build 21005, version=21005,

count=262, id=224, productName=VS2013 build 21005, version=21005,

count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,

count=483, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=346, id=1, productName=Unmarked objects,

count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=107, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,