cb05c85a23c6014cd28f060a9569ad8ac628f2462e147c47d80c361a35732625

General

Target
cb05c85a23c6014cd28f060a9569ad8ac628f2462e147c47d80c361a35732625
Size 1.6MB
Sample260807-lbcyca1frd
SHA256 cb05c85a23c6014cd28f060a9569ad8ac628f2462e147c47d80c361a35732625
MD5 10706a5b76f9da01348dafe716060de9
SHA1 61634e7f9245e1fa0f921165a69b4e4f9a70a0d0
SHA512 b702f97f399409bb33bb78c3fa693f651828143b17f695ca8e9f64e70505eec2fa4cec187f7d37018d9a337dae6c20637b8877185c9eafe335bf03e1278f3e04
SSDEEP 24576:nCdjxKrbdlKy+IW15z9LbBNL86TJmw24rRnZo4gv/:RbH+nz9LbBN46TP24rhZo4K
TLSH
T1F8758E607356D232D46180B20DB9EFAA916CAD396F720ACFA3C42F3D56355D22B31E17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb05c85a23c6014cd28f060a9569ad8ac628f2462e147c47d80c361a35732625

File Explorer

cb05c85a23c6014cd28f060a9569ad8ac628f2462e147c47d80c361a35732625

.exe 1.6MB

cb05c85a23c6014cd28f060a9569ad8ac628f2462e147c47d80c361a35732625

IMPHASH f9cddeff2d7a268035cd49ec94eaa573
SHA256 cb05c85a23c6014cd28f060a9569ad8ac628f2462e147c47d80c361a35732625
MD5 10706a5b76f9da01348dafe716060de9
SHA1 61634e7f9245e1fa0f921165a69b4e4f9a70a0d0
SHA512 b702f97f399409bb33bb78c3fa693f651828143b17f695ca8e9f64e70505eec2fa4cec187f7d37018d9a337dae6c20637b8877185c9eafe335bf03e1278f3e04
SSDEEP 24576:nCdjxKrbdlKy+IW15z9LbBNL86TJmw24rRnZo4gv/:RbH+nz9LbBN46TP24rhZo4K
TLSH
T1F8758E607356D232D46180B20DB9EFAA916CAD396F720ACFA3C42F3D56355D22B31E17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

575310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_r79o\master_kso_v12\Build\Release\WPSOffice\office6\wpscloudsvr.pdb

kernel32

SetCurrentDirectoryW FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW GetCommandLineW CloseHandle GetLastError Sleep GetCurrentProcessId TerminateProcess GetCurrentThreadId OpenProcess GetSystemDirectoryW GetSystemWow64DirectoryW GetModuleHandleW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject WaitForMultipleObjects CreateThread QueueUserWorkItem UnregisterWaitEx LocalFree GetEnvironmentVariableW SetEnvironmentVariableW GetDriveTypeW GetTempPathW GetStartupInfoW GetTickCount SetDllDirectoryW GetDllDirectoryW CopyFileW GetSystemTime SystemTimeToFileTime GetExitCodeProcess VerSetConditionMask GetCurrentProcess LocalAlloc VerifyVersionInfoW FindClose FindFirstFileW FindNextFileW SetEvent CreateEventW CreateFileW ReadFile WriteFile SetNamedPipeHandleState WaitNamedPipeW GetOverlappedResult CancelIo FlushFileBuffers ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateDirectoryW GetFileAttributesW ReadProcessMemory WideCharToMultiByte SetUnhandledExceptionFilter LoadLibraryExW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar GetFileAttributesExW GetModuleHandleExW VirtualAlloc VirtualFree lstrlenW GetPrivateProfileIntW GetPrivateProfileStringW CreateProcessW ExpandEnvironmentStringsW GetLongPathNameW GetCurrentThread ProcessIdToSessionId SetLastError OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency SetStdHandle GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetStringTypeW FindFirstFileExW SetEndOfFile SetFilePointerEx EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetLocaleInfoEx CompareStringEx GetCPInfo ResetEvent WaitForSingleObjectEx InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter OutputDebugStringW RtlUnwind InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree SetConsoleCtrlHandler GetStdHandle ExitProcess GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode GetFileSizeEx ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

cb05c85a23c6014cd28f060a9569ad8ac628f2462e147c47d80c361a35732625

kernel32

generic