80c9f70034f26d7420a92e9037952f8cd885c15725ceec3ab05d18b8678e4128

Sharing

Copy URL Twitter E-mail

General

Target
80c9f70034f26d7420a92e9037952f8cd885c15725ceec3ab05d18b8678e4128
Size 1.7MB
Sample260804-l8vveshd49
SHA256 80c9f70034f26d7420a92e9037952f8cd885c15725ceec3ab05d18b8678e4128
MD5 a0ca5196aebefa2de987b99c52fca82f
SHA1 e6e7e5b3c02501a5887a4cbe829f32dd774b1715
SHA512 7846b101275913a4f02f112cf93376f34e2e568df05ef7314a688158b2791dcb340ca969c1a3c2d2f0f096f0cdcd7553cad989873783693ff046d1544313fda5
SSDEEP 49152:NtfMdS9MLkiC0ywmqFA7ST7SGTG3Saza6T:NtfMJE5wmVYL
TLSH
T1FF85AE5074918036E51F83305D39F2D8A6AEFE211AB4C54B7FA9B66F5F368C1D722223
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
80c9f70034f26d7420a92e9037952f8cd885c15725ceec3ab05d18b8678e4128

File Explorer

80c9f70034f26d7420a92e9037952f8cd885c15725ceec3ab05d18b8678e4128

.dll 1.7MB

80c9f70034f26d7420a92e9037952f8cd885c15725ceec3ab05d18b8678e4128

IMPHASH 01e5abb83562a48454fb11404706bf9b
SHA256 80c9f70034f26d7420a92e9037952f8cd885c15725ceec3ab05d18b8678e4128
MD5 a0ca5196aebefa2de987b99c52fca82f
SHA1 e6e7e5b3c02501a5887a4cbe829f32dd774b1715
SHA512 7846b101275913a4f02f112cf93376f34e2e568df05ef7314a688158b2791dcb340ca969c1a3c2d2f0f096f0cdcd7553cad989873783693ff046d1544313fda5
SSDEEP 49152:NtfMdS9MLkiC0ywmqFA7ST7SGTG3Saza6T:NtfMJE5wmVYL
TLSH
T1FF85AE5074918036E51F83305D39F2D8A6AEFE211AB4C54B7FA9B66F5F368C1D722223
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

539007

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\golink\golink\InstallPackage\正常版nsis3.11\setupdll\bin\golink.pdb

kernel32

LoadLibraryW GetLocalTime GetVersionExA GetModuleHandleA LoadLibraryA FreeResource SetLastError GetFullPathNameW FlushInstructionCache HeapFree HeapAlloc HeapDestroy HeapCreate MulDiv DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetCurrentDirectoryW lstrcpyW lstrcpynA GlobalFree lstrcpynW OutputDebugStringA GetNativeSystemInfo MultiByteToWideChar TerminateProcess OpenProcess OutputDebugStringW ExitProcess Sleep CreateThread SetEndOfFile WriteConsoleW CloseHandle CreateFileW FlushFileBuffers GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetVersionExW SetStdHandle ReadConsoleW HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP WriteFile GetFileType GetStdHandle GetModuleHandleExW ReadFile LoadLibraryExW InterlockedFlushSList RaiseException RtlUnwind InitializeSListHead GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx ResetEvent SetEvent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter LocalFree GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread CreateEventW InitializeCriticalSectionAndSpinCount DecodePointer EncodePointer GetStringTypeW GetTickCount FindResourceW SizeofResource LockResource FreeLibrary GetTimeZoneInformation LoadResource Process32NextW Process32FirstW CreateToolhelp32Snapshot WaitForSingleObject WideCharToMultiByte CopyFileW MoveFileExW FindFirstFileW FindClose GetCurrentProcess GetModuleHandleW GetProcAddress WritePrivateProfileStringW GetPrivateProfileStringW GetModuleFileNameW GetLastError GlobalUnlock GlobalAlloc GlobalLock HeapSize lstrlenA

user32

PtInRect CopyRect InflateRect IsRectEmpty MessageBoxW SendMessageW MsgWaitForMultipleObjects UpdateLayeredWindow IsIconic ShowWindow PostMessageW OffsetRect GetCursorPos GetActiveWindow CallWindowProcW SetWindowLongW FindWindowExW SetTimer KillTimer SetCursor IntersectRect UnionRect EqualRect IsWindow DestroyWindow LoadCursorW DestroyCursor CharNextW DestroyIcon DrawIconEx InvertRect FillRect GetIconInfo DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW SetWindowPos GetDlgItem GetClientRect GetWindowRect MapWindowPoints GetDesktopWindow SetActiveWindow EnableWindow MapVirtualKeyA SetRect GetForegroundWindow wsprintfW CharLowerBuffW SystemParametersInfoA DrawTextW IsWindowVisible GetSystemMetrics EnableMenuItem ClientToScreen PeekMessageW DispatchMessageW TranslateMessage GetMessageW LoadIconW LoadImageW CreateIconFromResource LoadBitmapW GetKeyState GetFocus GetSysColor SetMenuContextHelpId SetForegroundWindow GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenu AppendMenuW GetMenuItemCount DestroyMenu CreatePopupMenu IsWindowEnabled IsMenu GetClassNameW ScreenToClient SetCaretPos HideCaret GetCaretBlinkTime CreateCaret SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC UpdateWindow ReleaseCapture SetCapture GetCapture SetFocus IsZoomed SetLayeredWindowAttributes AnimateWindow PostQuitMessage TrackMouseEvent GetMonitorInfoW MonitorFromWindow GetWindow GetParent GetWindowLongW

gdi32

StretchBlt GetObjectW SetBkMode Rectangle GetStockObject GetClipBox CreateSolidBrush CreateFontIndirectW SetGraphicsMode GetDeviceCaps SelectObject DeleteDC CreateCompatibleDC CreateBitmap EnumFontsW BitBlt CreateRoundRectRgn DeleteObject SetViewportOrgEx CreateCompatibleBitmap Arc CombineRgn CreateEllipticRgnIndirect CreatePen CreatePatternBrush CreateRectRgn CreateRectRgnIndirect Ellipse ExcludeClipRect GetClipRgn GetRgnBox GetTextColor GetTextExtentPoint32W IntersectClipRect OffsetRgn Pie PtInRegion RectInRegion RestoreDC RoundRect SaveDC ExtSelectClipRgn SetRectRgn SetTextColor GetWorldTransform SetWorldTransform CreateDIBSection Polyline GetCurrentObject GetViewportOrgEx

shell32

ShellExecuteExW Shell_NotifyIconW SHGetPathFromIDListW SHBrowseForFolderW SHFileOperationW SHGetSpecialFolderPathW ShellExecuteW

ole32

CreateBindCtx CLSIDFromProgID CLSIDFromString OleLockRunning OleInitialize CoTaskMemFree OleUninitialize OleRun IIDFromString CoCreateInstance CoUninitialize CoInitialize CreateStreamOnHGlobal

oleaut32

SysFreeString VariantClear VariantInit GetErrorInfo SysAllocString

shlwapi

StrToIntExW

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipGetPropertyItem GdipGetPropertyItemSize GdipDrawImageRectI GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDrawImageI GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipAlloc GdipFree GdipGraphicsClear GdipGetImageEncodersSize GdipGetImageEncoders GdipImageSelectActiveFrame

imm32

ImmReleaseContext ImmAssociateContext ImmGetContext

msimg32

AlphaBlend GradientFill

Sharing

General

Malware Config

Signatures

File Explorer

80c9f70034f26d7420a92e9037952f8cd885c15725ceec3ab05d18b8678e4128

kernel32

user32

gdi32

shell32

ole32

oleaut32

shlwapi

iphlpapi

version

gdiplus

imm32

msimg32

generic