7ddb3979160eb92c464d00e199ab2c8904d669aed9470fc069e98b9384b05dea

Sharing

Copy URL Twitter E-mail

General

Target
7ddb3979160eb92c464d00e199ab2c8904d669aed9470fc069e98b9384b05dea
Size 1.9MB
Sample260730-dvc4fsssas
SHA256 7ddb3979160eb92c464d00e199ab2c8904d669aed9470fc069e98b9384b05dea
MD5 c78499ca71349fb78f9736949434351a
SHA1 4eaac121d63ea398b253656609518c35607e48f3
SHA512 16e88fbcc24bacd8a11844a92d0f393b6f395a1cb74d225fa8781ab7456adcfd6c8c6839f2d0a6e73a79f6682dbd96ff7e18fec6b217245947cc509bafb54d97
SSDEEP 49152:bnGddef8mJpipnj3qTufHCH6XM1wf3+cGy:bUKDpipo6XMU
TLSH
T138954A307202C13BC56201B0996CDEAF5059BE242B65E4D7A3E43F7AD4715F35A32EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ddb3979160eb92c464d00e199ab2c8904d669aed9470fc069e98b9384b05dea

File Explorer

7ddb3979160eb92c464d00e199ab2c8904d669aed9470fc069e98b9384b05dea

.exe 1.9MB

7ddb3979160eb92c464d00e199ab2c8904d669aed9470fc069e98b9384b05dea

IMPHASH 4c051bade5eebbd46e8c500f5501bb86
SHA256 7ddb3979160eb92c464d00e199ab2c8904d669aed9470fc069e98b9384b05dea
MD5 c78499ca71349fb78f9736949434351a
SHA1 4eaac121d63ea398b253656609518c35607e48f3
SHA512 16e88fbcc24bacd8a11844a92d0f393b6f395a1cb74d225fa8781ab7456adcfd6c8c6839f2d0a6e73a79f6682dbd96ff7e18fec6b217245947cc509bafb54d97
SSDEEP 49152:bnGddef8mJpipnj3qTufHCH6XM1wf3+cGy:bUKDpipo6XMU
TLSH
T138954A307202C13BC56201B0996CDEAF5059BE242B65E4D7A3E43F7AD4715F35A32EAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1075257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\Work\new\2345Pinyin\bin\Win32\Release\pdb\2345PinyinTool.pdb

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetCompositionStringW ImmAssociateContextEx ImmNotifyIME ImmDisableIME ImmGetContext

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

shlwapi

PathFindFileNameW PathAppendW StrDupW ord12 StrToIntA

kernel32

FileTimeToSystemTime SetLastError MultiByteToWideChar WideCharToMultiByte CreateMutexW ReleaseMutex GetVersionExW GetSystemInfo lstrcmpiW QueryDosDeviceW HeapFree HeapAlloc GetProcessHeap GetACP GetEnvironmentVariableW ResumeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ReadFile WriteFile SetFileTime GetFileTime FindFirstFileW GetLongPathNameW GetFileAttributesExW LoadLibraryExW GetFileAttributesW lstrcatW lstrcpyW UnmapViewOfFile CreateFileMappingW CreateProcessW GetLogicalDriveStringsW FindNextFileW FindClose DeleteFileW InterlockedExchange InterlockedExchangeAdd CreateDirectoryW GetFullPathNameW GetTempPathW SetFileAttributesW GetCurrentDirectoryW GetWindowsDirectoryW CopyFileW FormatMessageW QueryPerformanceFrequency QueryPerformanceCounter lstrcmpW InterlockedIncrement MulDiv SetWaitableTimer CreateWaitableTimerW FreeResource MapViewOfFileEx TlsSetValue GetModuleHandleA DisableThreadLibraryCalls TlsAlloc CreateThread TlsGetValue VirtualProtect GetModuleHandleExW OutputDebugStringA HeapCreate HeapDestroy FlushInstructionCache VirtualFree LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess InterlockedCompareExchange Thread32Next Thread32First SuspendThread CreateToolhelp32Snapshot HeapReAlloc GetThreadContext SetThreadContext OpenThread RtlUnwind ExitThread FreeLibraryAndExitThread ExitProcess GetStdHandle IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType HeapSize FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW lstrlenW ExpandEnvironmentStringsW VirtualQuery DeviceIoControl GetModuleFileNameW LocalFree LocalAlloc GetFileSize CreateFileW SetEndOfFile SetFilePointer GetCurrentProcess InterlockedDecrement GetModuleHandleW FreeLibrary lstrcpynW GlobalMemoryStatusEx ResetEvent SetEvent CreateEventW WaitForSingleObject WaitForMultipleObjects GetTickCount GetProcAddress LoadLibraryW CloseHandle OpenProcess GetCurrentThreadId GetStartupInfoW LCMapStringW GlobalUnlock GlobalLock FindResourceW LoadResource GlobalFree GlobalAlloc LockResource SizeofResource GetCurrentProcessId SetErrorMode Sleep DeleteCriticalSection DecodePointer RaiseException GetLastError InitializeCriticalSectionAndSpinCount TlsFree SwitchToThread VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent EncodePointer GetCPInfo GetStringTypeW GetTempFileNameW GetLocaleInfoW GetFileSizeEx CompareStringW GetSystemTimeAsFileTime

user32

FillRect MsgWaitForMultipleObjects SetRectEmpty GetClassLongW SetCaretPos LoadImageW ValidateRect DrawIconEx GetIconInfo ToAscii GetCaretBlinkTime GetKeyboardState GetSysColor IsClipboardFormatAvailable GetClipboardData CloseClipboard SetClipboardData EmptyClipboard GetAncestor RegisterWindowMessageW EnumThreadWindows CreateAcceleratorTableW DestroyAcceleratorTable GetFocus GetAsyncKeyState SetFocus SetParent KillTimer BeginPaint EndPaint DestroyWindow GetKeyState ScreenToClient TrackMouseEvent SetCapture ReleaseCapture GetMessageW PeekMessageW TranslateMessage PostQuitMessage AdjustWindowRectEx ShowWindowAsync IsWindowVisible UnionRect PtInRect PostMessageW EqualRect EnumChildWindows OffsetRect RedrawWindow ClientToScreen IntersectRect GetWindowDC SetCursor IsZoomed GetPropW RemovePropW SetPropW InvalidateRgn OpenClipboard InvalidateRect GetDCEx GetCursorPos CreateWindowExW RegisterClassExW LoadCursorW IsChild GetActiveWindow GetClassInfoExW GetWindowTextLengthW GetWindow GetWindowRect MonitorFromWindow SetWindowTextW GetMonitorInfoW CopyRect MapWindowPoints GetClassNameW GetClientRect GetDlgItem EnableWindow GetWindowTextW LoadStringW MessageBoxW SetWindowPos ShowWindow IsWindow AttachThreadInput SystemParametersInfoW SetForegroundWindow IsIconic GetDC ReleaseDC GetWindowThreadProcessId GetSystemMetrics WindowFromPoint GetForegroundWindow GetDesktopWindow GetParent GetWindowLongW DefWindowProcW CallWindowProcW SendMessageW SetTimer MoveWindow IsRectEmpty SetWindowLongW UnregisterClassW UpdateLayeredWindow SetRect CharNextW SetWindowRgn DispatchMessageW LoadBitmapW

gdi32

CreateFontIndirectW CreateDCW GetDIBits CreateDIBSection CreateRoundRectRgn PtInRegion EnumFontsW GetClipBox SetTextColor CreateSolidBrush SetGraphicsMode SetWorldTransform CreateRectRgnIndirect CreatePolygonRgn SetViewportOrgEx GetRgnBox GetStockObject GetDeviceCaps DeleteDC BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetObjectW SetBkColor DeleteObject ExtTextOutW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegEnumKeyExW RegDeleteValueW RegQueryInfoKeyW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW

shell32

ShellExecuteExW SHGetSpecialFolderPathW DragFinish DragQueryFileW SHGetFolderPathW

ole32

CoTaskMemRealloc CreateStreamOnHGlobal OleLockRunning CLSIDFromString OleInitialize CLSIDFromProgID StringFromGUID2 CoCreateInstance CoGetClassObject OleUninitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

LoadRegTypeLi LoadTypeLi OleCreateFontIndirect DispCallFunc SysStringLen SysAllocStringLen VarUI4FromStr VariantInit SysAllocString VariantClear SysFreeString

comctl32

_TrackMouseEvent InitCommonControlsEx

msimg32

AlphaBlend

urlmon

CoInternetCreateSecurityManager CoInternetCreateZoneManager

gdiplus

GdipCreateSolidFill GdipCloneBitmapArea GdipGetCellDescent GdipSetInterpolationMode GdipSetLinePresetBlend GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipEndContainer GdipSetSmoothingMode GdipCreateMatrix GdipGetStringFormatAlign GdipDeletePath GdipDisposeImageAttributes GdipCreateMatrix2 GdipDeleteBrush GdipGetLineSpacing GdipSetLineWrapMode GdipCreateLineBrushI GdipDrawImageRectRect GdipSaveGraphics GdipCreateFontFamilyFromName GdipGetEmHeight GdipGetStringFormatLineAlign GdipAddPathString GdipGetTextRenderingHint GdipGetFamily GdipSetCompositingQuality GdipSetImageAttributesColorMatrix GdipGetLineTransform GdipDeleteFontFamily GdipGetInterpolationMode GdipGetPropertyItemSize GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageSelectActiveFrame GdipGetPropertyItem GdipImageGetFrameDimensionsCount GdipCreateRegionPath GdipAddPathLineI GdipAddPathBezierI GdipCombineRegionPath GdipAddPathEllipseI GdipAddPathArcI GdipAddPathRectangleI GdipCombineRegionRegion GdipGetBrushType GdipSetLineTransform GdipSetTextureTransform GdipGetFontStyle GdipSetStringFormatTrimming GdipTransformRegion GdipFillPath GdipGetPathWorldBounds GdipMultiplyWorldTransform GdipGraphicsClear GdipGetImageWidth GdipFree GdipCreateHBITMAPFromBitmap GdipSetPenDashStyle GdipDrawLine GdipDrawRectangle GdipSetPixelOffsetMode GdipScaleWorldTransform GdipSetClipRectI GdipClosePathFigure GdipGetSmoothingMode GdipDrawArcI GdipCreateImageAttributes GdipSetClipRegion GdipDrawPath GdipDrawString GdipSetImageAttributesWrapMode GdipGetClipBoundsI GdipCreateFromHDC GdipFillEllipse GdipBeginContainer2 GdipCreateTexture GdipGetTextureTransform GdipGetMatrixElements GdipCloneStringFormat GdipSetTextRenderingHint GdipGetCellAscent GdipStringFormatGetGenericTypographic GdipRotateWorldTransform GdipRestoreGraphics GdipCloneBrush GdipMeasureString GdipDeleteRegion GdipGetImageGraphicsContext GdipFillRectangleI ord1 GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipGetFontSize GdipTranslateWorldTransform GdipDeletePen GdipCreatePen1 GdipSetStringFormatAlign GdipDrawImageRectRectI GdipDeleteMatrix GdipGetFamilyName GdipCloneRegion GdipSetStringFormatFlags GdipBitmapUnlockBits GdipGetImagePixelFormat GdipCloneBitmapAreaI GdipBitmapLockBits GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipCloneImage GdipCreateBitmapFromStream GdipAlloc GdipDisposeImage GdipSetCompositingMode

winmm

timeGetTime

psapi

GetMappedFileNameW

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

17KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

139KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

146KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=24, id=241, version=40116,

count=166, id=243, version=40116,

count=34, id=242, version=40116,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=30, id=259, version=26706,

count=80, id=261, version=26706,

count=35, id=260, version=26706,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=261, version=27032,

count=1, productName=Unmarked objects (old),

count=1, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,

count=1, id=259, productName=VS2017 v15.9.5 build 27026, version=27026,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=645, id=1, productName=Unmarked objects,

count=346, id=265, version=27026,

count=1, id=255, productName=VS2017 v15.9.5 build 27026, version=27026,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.9.5 build 27026, version=27026,