cc41432c6239381fc17165e6b941c8cb9bde77a114cf3d3f207f416fbca11638

Sharing

Copy URL Twitter E-mail

General

Target
cc41432c6239381fc17165e6b941c8cb9bde77a114cf3d3f207f416fbca11638
Size 4.4MB
Sample260731-mk8l2sgf85
SHA256 cc41432c6239381fc17165e6b941c8cb9bde77a114cf3d3f207f416fbca11638
MD5 6c404e39c0d19b3d071ca0af74019621
SHA1 3f22b318ee16ff093b8a8076c8bcd01509a8737b
SHA512 26abe3ee13e3ddddaa82bb1810009736345e2bcb68417cb48850055bc9f9f927b96f0b3d32a027bdeb086f70cf91084c63042104762f6e128abec96271da2874
SSDEEP 49152:/sliNpLLckWhm/fvle4Et7OYPE6kgsZsBLnPkVTrm5u6GIoRvN6:pkkWHxBL+rhIoRvN6
TLSH
T1CC266B0D66A80CE1C1AFD17C8A5285B7E6B17C064B349EDF35BCB22A1F379E0553E621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cc41432c6239381fc17165e6b941c8cb9bde77a114cf3d3f207f416fbca11638

File Explorer

cc41432c6239381fc17165e6b941c8cb9bde77a114cf3d3f207f416fbca11638

.dll 4.4MB

cc41432c6239381fc17165e6b941c8cb9bde77a114cf3d3f207f416fbca11638

IMPHASH f273bafedfd9362be9aef99a256bfd95
SHA256 cc41432c6239381fc17165e6b941c8cb9bde77a114cf3d3f207f416fbca11638
MD5 6c404e39c0d19b3d071ca0af74019621
SHA1 3f22b318ee16ff093b8a8076c8bcd01509a8737b
SHA512 26abe3ee13e3ddddaa82bb1810009736345e2bcb68417cb48850055bc9f9f927b96f0b3d32a027bdeb086f70cf91084c63042104762f6e128abec96271da2874
SSDEEP 49152:/sliNpLLckWhm/fvle4Et7OYPE6kgsZsBLnPkVTrm5u6GIoRvN6:pkkWHxBL+rhIoRvN6
TLSH
T1CC266B0D66A80CE1C1AFD17C8A5285B7E6B17C064B349EDF35BCB22A1F379E0553E621
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2196828

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\WorkSpace\shurufa\src\ImeWB\Bundles\WanNengWB\Bin\pdbmap\MainDll64.pdb

imm32

ImmUnlockIMC ImmCreateIMCC ImmLockIMCC ImmUnlockIMCC ImmReSizeIMCC ImmGenerateMessage ImmLockIMC

shlwapi

PathFileExistsW PathAddBackslashW PathFileExistsA

kernel32

GetExitCodeProcess SystemTimeToTzSpecificLocalTime lstrcmpiW CreateProcessW GetWindowsDirectoryW CreateToolhelp32Snapshot Process32FirstW Process32NextW SetUnhandledExceptionFilter MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW LockResource LoadResource SizeofResource SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime TlsGetValue TlsSetValue FindResourceW MulDiv LCMapStringW RtlCaptureContext GetCurrentThread GetThreadContext SuspendThread ResumeThread GetModuleFileNameA GetPrivateProfileStringA SetEndOfFile SetFilePointerEx DeleteFileA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetStdHandle FormatMessageA LoadLibraryA GetTempPathA GetFileAttributesA UnlockFile LockFileEx LockFile SetFilePointer AreFileApisANSI GetPrivateProfileStringW lstrlenW GetModuleFileNameW GetPrivateProfileIntW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetCurrentDirectoryW WriteConsoleW SetStdHandle GetTimeZoneInformation FlushFileBuffers GetACP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale PeekNamedPipe GetConsoleCP ReadConsoleW GetConsoleMode GetFileType GetFullPathNameA GetFullPathNameW GetModuleHandleExW RtlUnwindEx RtlPcToFileHeader CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualProtect LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait ExitProcess FindResourceExW WinExec ReadProcessMemory VirtualFree VirtualAlloc OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry WaitForSingleObjectEx ResetEvent SetEvent GetCPInfo GetStringTypeW GetLocaleInfoW CompareStringW GetSystemTimeAsFileTime TlsFree TlsAlloc CreateEventW SetLastError EncodePointer TryEnterCriticalSection WritePrivateProfileStringW DecodePointer HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetSystemTime RaiseException GetLastError InitializeCriticalSectionAndSpinCount OpenProcess LocalAlloc GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetLocalTime Sleep TerminateThread CreateThread QueryPerformanceFrequency QueryPerformanceCounter GetVersionExW GetModuleHandleW GetTickCount GetSystemInfo WaitForSingleObject GetCurrentThreadId GetCurrentProcess LocalFree WTSGetActiveConsoleSessionId CreateFileA RemoveDirectoryW CreateDirectoryW GetSystemDirectoryW GetDriveTypeW GetEnvironmentVariableW GetLongPathNameW GetProcAddress FreeLibrary LoadLibraryW GetCurrentProcessId MoveFileExW CopyFileW FindNextFileW FindFirstFileW DeleteFileW GetFileAttributesExW GetFileAttributesW SetFileAttributesW CreateFileW GetTempPathW lstrcpyW FileTimeToSystemTime CloseHandle FindClose ReadFile WriteFile GetFileSize WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection

user32

FindWindowW SystemParametersInfoW GetParent GetDesktopWindow PtInRect ScreenToClient ClientToScreen GetWindowRect GetSystemMetrics IsWindow LoadStringW GetMonitorInfoW EnumDisplayMonitors SetWindowPos BringWindowToTop GetLastInputInfo GetForegroundWindow GetWindowThreadProcessId PostMessageW IsWindowVisible OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyState CharLowerW GetFocus keybd_event FindWindowExW GetClassNameW SetTimer KillTimer SetRect SendMessageW DestroyWindow RegisterWindowMessageW DefWindowProcW RegisterClassExW CreateWindowExW LoadCursorW GetDC ReleaseDC MonitorFromPoint WindowFromPoint SendMessageTimeoutW ShowWindow CreateDialogParamW DialogBoxParamW EndDialog GetDlgItem SetDlgItemTextW SetWindowTextW SetCursor GetWindowLongPtrW SetWindowLongPtrW IsIconic InvalidateRect CallWindowProcW MoveWindow GetDlgItemTextW SetFocus GetCapture GetCaretPos MessageBoxW SetDlgItemInt GetDlgItemInt GetAsyncKeyState ReleaseCapture MessageBeep ToAscii SetCapture OffsetRect DrawTextW CharNextW GetGUIThreadInfo IsClipboardFormatAvailable SetMenuInfo TrackPopupMenu DeleteMenu RemoveMenu ModifyMenuW InsertMenuW EnableMenuItem DestroyMenu CreatePopupMenu CreateMenu GetCursorPos FillRect GetClientRect UnionRect SetRectEmpty EndPaint BeginPaint UpdateLayeredWindow

gdi32

GetDeviceCaps SetBkMode SetTextColor CreateDIBSection BitBlt CreateCompatibleBitmap MoveToEx LineTo CreatePen TextOutW GetTextExtentPoint32W GetTextExtentPointW ExcludeClipRect CreateSolidBrush CreateFontW EnumFontsW CreateICW GetPixel SelectObject DeleteObject DeleteDC CreateCompatibleDC GetStockObject

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RevertToSelf ImpersonateLoggedOnUser GetFileSecurityW SetFileSecurityW RegSetValueW RegCreateKeyW RegDeleteKeyW RegDeleteValueW OpenProcessToken GetTokenInformation EqualSid GetLengthSid InitializeAcl GetAclInformation AddAce SetSecurityInfo SetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateTokenEx CreateProcessAsUserW LookupAccountSidW GetSecurityDescriptorSacl SetTokenInformation LookupAccountNameW GetSecurityDescriptorDacl SetSecurityDescriptorDacl GetSecurityDescriptorControl InitializeSecurityDescriptor AddAccessAllowedAce GetAce

shell32

SHGetSpecialFolderPathA SHGetFolderPathW ShellExecuteExW ShellExecuteW SHAppBarMessage SHFileOperationW SHGetSpecialFolderPathW

ole32

CoCreateInstance CoUninitialize CoInitialize CreateStreamOnHGlobal

gdiplus

GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipCreateStringFormat GdipDrawImageRectI GdipCloneFont GdipGetFontCollectionFamilyList GdipCloneFontFamily GdipFillRectangleI GdipGetGenericFontFamilySansSerif GdipCloneBitmapAreaI GdipCreateBitmapFromStream GdipGetImageRawFormat GdipDisposeImage GdipCloneImage GdipFillPath GdipDrawPath GdipDrawLineI GdipSetImageAttributesColorKeys GdipBitmapSetPixel GdipBitmapGetPixel GdipSetPenDashStyle GdipAddPathArcI GdipAddPathLineI GdipDeleteFont GdipCreateFont GdipCreateFontFamilyFromName GdipDrawString GdipDrawImageRectRectI GdipSetImageAttributesColorMatrix GdipCreateImageAttributes GdipGetImageWidth GdipDrawLine GdipDeleteGraphics GdipCreateFromHDC GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipAlloc GdipDisposeImageAttributes GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipPrivateAddFontFile GdipGetFontCollectionFamilyCount GdipDeletePrivateFontCollection GdipNewPrivateFontCollection GdipNewInstalledFontCollection GdipFree GdipSetStringFormatFlags GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipMeasureString GdipGetFontSize GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipGetFamily GdipDeleteFontFamily GdipDeletePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipGetImageHeight

wtsapi32

WTSQueryUserToken

psapi

GetModuleFileNameExW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

dbghelp

SymGetModuleBase64 SymFunctionTableAccess64 StackWalk64 EnumerateLoadedModules64 SymInitialize

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

766KB

Virtual Size

766KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

62KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

138KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

816KB

Virtual Size

815KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=26, id=241, version=40116,

count=195, id=243, version=40116,

count=37, id=242, version=40116,

count=102, id=265, version=24215,

count=48, id=109, productName=VS2005 build 50727, version=50727,

count=2, id=261, version=23013,

count=5, id=199, version=41118,

count=10, id=259, version=24123,

count=1, id=136, version=30729,

count=117, id=261, version=24123,

count=41, id=260, version=24123,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=135, version=30729,

count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=558, id=1, productName=Unmarked objects,

count=260, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,