曼象学员端_17[.]0[.]0_x64-绿色版[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
曼象学员端_17.0.0_x64-绿色版.zip
Size 4.1MB
Sample260730-tp24dsca87
SHA256 6f27d4511b2092381ddf93163dd0eb2f184b5a69119f68f8f4c6fc0d02ef7bd7
MD5 8c98431fd24eef0276f66094bdc0f2c6
SHA1 27d0b7433daaed73f5230855865be0e01134b58c
SHA512 8d0c56ff6e555577a617e523ef4d619f7de8832193e7761841286183390c31f54d7a643ee9683da38a687c52a6804175382045c79726a26c8e17355567ef0892
SSDEEP 98304:ymwJHjR3F8dXT4wWXX8iWKJgfmZiUsOsGVziGjW9PwLBozAYA:yLHwalJgf2sOs+zxjWNxA
TLSH
T1D51633F1C5F19A167187842EFE713DA9DCF7B54522B7E1BE012198830AE934B1274E8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/曼象学员端.exe

File Explorer

曼象学员端_17.0.0_x64-绿色版.zip

.zip 4.1MB
曼象学员端.exe

.exe 11.8MB

曼象学员端_17.0.0_x64-绿色版.zip

SHA256 6f27d4511b2092381ddf93163dd0eb2f184b5a69119f68f8f4c6fc0d02ef7bd7
MD5 8c98431fd24eef0276f66094bdc0f2c6
SHA1 27d0b7433daaed73f5230855865be0e01134b58c
SHA512 8d0c56ff6e555577a617e523ef4d619f7de8832193e7761841286183390c31f54d7a643ee9683da38a687c52a6804175382045c79726a26c8e17355567ef0892
SSDEEP 98304:ymwJHjR3F8dXT4wWXX8iWKJgfmZiUsOsGVziGjW9PwLBozAYA:yLHwalJgf2sOs+zxjWNxA
TLSH
T1D51633F1C5F19A167187842EFE713DA9DCF7B54522B7E1BE012198830AE934B1274E8B
MD5 SHA1 SHA512 SSDEEP TLSH

曼象学员端.exe

IMPHASH c150ae56fd99005d43b99bc8e6f83f45
SHA256 da73fb9be9b7d28c26983ee6d71d9e4930ed920aceef51c3a1d04e6feb25f0ac
MD5 07bb068452e5b517f0e213832fce04c3
SHA1 ecd7b87d1219f6357bdc00871505cc72fab17172
SHA512 707604b5ccf3b8b6d3d7d829915ae37b00e99ccd4d04e9c02e508f2d5b0c7ed170403e987807fa9216f7028013c00989601398c5595f1c59635ad88351d6d018
SSDEEP 98304:ilBlF4XgmUH7z0KypbTrZMOPRYoN9ZX4Xm/IeNM6K31boM38Hnx0lJmp:2BlF4QmUH7z0KypbTrZMIJM6KmYJmp
TLSH
T15CC6F6207A5A996CD19BC47483478AB2097130DB0B35B9FF4498963C2F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8066576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

student_client.pdb

bcryptprimitives

ProcessPrng

advapi32

RegGetValueW RegOpenKeyExW RegOpenKeyTransactedW RegQueryValueExW RegCloseKey RegCreateKeyExW RegCreateKeyTransactedW EventRegister EventSetInformation EventWriteTransfer EventUnregister

ntdll

RtlGetVersion NtCreateNamedPipeFile NtDeviceIoControlFile NtCreateFile NtWriteFile NtCancelIoFileEx RtlNtStatusToDosError NtOpenFile NtReadFile

kernel32

SetEnvironmentVariableW DeviceIoControl GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetStdHandle CreateProcessW GetWindowsDirectoryW MultiByteToWideChar WriteConsoleW GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx GetFileAttributesW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetLastError GetProcessHeap HeapFree LoadLibraryExW GetSystemTimePreciseAsFileTime RtlVirtualUnwind FreeLibrary GetConsoleOutputCP RtlCaptureContext InitializeCriticalSectionEx ReadFileEx GetCurrentProcessId GetCurrentThreadId CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc CreateWaitableTimerExW SetFileTime SetFileInformationByHandle SetLastError LoadLibraryExA SleepEx HeapAlloc WriteFileEx WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW SetWaitableTimer FormatMessageW GetModuleHandleA Sleep GetUserDefaultUILanguage SetFileCompletionNotificationModes CancelIoEx GetTempPathW CreateFileW GetFileInformationByHandle GetConsoleMode WriteFile SetNamedPipeHandleState ReadFile GetOverlappedResult GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort FindNextFileW CloseHandle ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetModuleHandleW RtlPcToFileHeader RaiseException LCIDToLocaleName FlsAlloc SetHandleInformation LoadLibraryW RtlLookupFunctionEntry FlsGetValue GetProcAddress LoadLibraryA lstrlenW FlsSetValue FlsFree GetFullPathNameW EncodePointer InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx DuplicateHandle GetCurrentProcess DeleteCriticalSection

user32

IsProcessDPIAware IsWindowEnabled MapWindowPoints UpdateWindow GetDC MapVirtualKeyW GetActiveWindow AdjustWindowRectEx IsWindow RegisterTouchWindow GetWindow SetParent RegisterWindowMessageA SetFocus EnableWindow ShowWindow TranslateAcceleratorW ReleaseDC DestroyWindow MsgWaitForMultipleObjectsEx SetWindowRgn VkKeyScanW DrawTextW FindWindowExW OffsetRect GetMenuBarInfo DestroyMenu CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu SetMenu DrawMenuBar SetMenuItemInfoW GetWindowLongPtrW InsertMenuW TrackPopupMenu PostQuitMessage GetMessageW TranslateMessage CreateAcceleratorTableW DestroyAcceleratorTable DrawIconEx GetMenuItemInfoW CreateIcon GetAsyncKeyState GetKeyboardState GetMenu IsWindowVisible MapVirtualKeyExW ToUnicodeEx GetKeyState EnumDisplayMonitors MonitorFromPoint SetWindowTextW GetWindowTextW GetParent GetWindowTextLengthW SendInput SetForegroundWindow DestroyIcon DispatchMessageA SetWindowDisplayAffinity SystemParametersInfoA SetCapture SetPropW SetWindowLongW DispatchMessageW PostMessageW EnableMenuItem GetSystemMenu PostThreadMessageW ClipCursor GetClipCursor ShowCursor RedrawWindow GetMessageA InvalidateRect SetCursorPos SetWindowLongPtrW GetUpdateRect ValidateRect CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetRawInputData GetSystemMetrics GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient IsIconic SendMessageW AdjustWindowRect ReleaseCapture GetForegroundWindow AppendMenuW EnumChildWindows GetKeyboardLayout GetWindowRect CreateWindowExW RegisterClassExW RegisterRawInputDevices GetWindowDC SetCursor LoadCursorW InvalidateRgn SetWindowPos GetWindowPlacement SetWindowPlacement PeekMessageW ChangeDisplaySettingsExW FlashWindowEx DefWindowProcW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

comctl32

SetWindowSubclass RemoveWindowSubclass DefSubclassProc TaskDialogIndirect

ole32

CoCreateFreeThreadedMarshaler CoInitialize CoTaskMemAlloc CoInitializeEx CoUninitialize CoCreateInstance RegisterDragDrop RevokeDragDrop CoTaskMemFree OleInitialize

shlwapi

SHCreateMemStream

gdi32

DeleteObject BitBlt CombineRgn CreateDIBSection SelectObject DeleteDC CreateCompatibleDC CreateRectRgn CreateSolidBrush GetDeviceCaps SetTextColor SetBkMode

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

shell32

SHGetKnownFolderPath ShellExecuteExW SHOpenFolderAndSelectItems DragQueryFileW ShellExecuteW ILFree DragFinish ILCreateFromPathW SHAppBarMessage

oleaut32

SetErrorInfo SysStringLen SysFreeString GetErrorInfo

secur32

ApplyControlToken FreeCredentialsHandle InitializeSecurityContextW AcceptSecurityContext EncryptMessage DeleteSecurityContext DecryptMessage AcquireCredentialsHandleA QueryContextAttributesW FreeContextBuffer

ws2_32

WSACleanup freeaddrinfo getaddrinfo WSAStartup WSAGetLastError bind WSASocketW WSAIoctl connect ioctlsocket setsockopt send WSASend recv getsockname getpeername getsockopt closesocket shutdown

crypt32

CertCloseStore CertDuplicateStore CertFreeCertificateContext CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore CertDuplicateCertificateChain CertFreeCertificateChain CertEnumCertificatesInStore CertOpenStore

api-ms-win-crt-math-l1-1-0

roundf trunc floor round pow __setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen strcpy_s _wcsicmp wcscmp

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _set_app_type _seh_filter_exe _get_initial_narrow_environment _initterm exit _crt_atexit _configure_narrow_argv terminate _register_onexit_function __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _initterm_e abort _exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc _callnewh _set_new_mode malloc free