de865cc2859cb2963ab541d90719aa16e5861b4b6a50390277fc99622750c6d7

Sharing

Copy URL Twitter E-mail

General

Target
de865cc2859cb2963ab541d90719aa16e5861b4b6a50390277fc99622750c6d7
Size 6.0MB
Sample260807-v6mkpszhph
SHA256 de865cc2859cb2963ab541d90719aa16e5861b4b6a50390277fc99622750c6d7
MD5 8b3c28fad2db6a2f2e12241e0057e363
SHA1 93aab2ea760119214940413e83b90929823910d0
SHA512 e958f9910f1f2096faf2f19d81f031c8749b959aeba991b0e325e12241ad8bc82b6f14287fab1dca628b15bcd34d3677c935925d8cc00633940a80a52c962c77
SSDEEP 98304:doSfVdOUwTG1Q0G7KSIy4ljjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjP:ldOqFyYBLyyyyyyyyyyyyyyyyyyyyyyN
TLSH
T19C56120036C64579F23B1A305991D14F869AFAA08BF1819FF1ECB30E7BA5EE08777915
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de865cc2859cb2963ab541d90719aa16e5861b4b6a50390277fc99622750c6d7

File Explorer

de865cc2859cb2963ab541d90719aa16e5861b4b6a50390277fc99622750c6d7

.dll 6.0MB

de865cc2859cb2963ab541d90719aa16e5861b4b6a50390277fc99622750c6d7

IMPHASH 90f349c9076cad53180aded86ea5efda
SHA256 de865cc2859cb2963ab541d90719aa16e5861b4b6a50390277fc99622750c6d7
MD5 8b3c28fad2db6a2f2e12241e0057e363
SHA1 93aab2ea760119214940413e83b90929823910d0
SHA512 e958f9910f1f2096faf2f19d81f031c8749b959aeba991b0e325e12241ad8bc82b6f14287fab1dca628b15bcd34d3677c935925d8cc00633940a80a52c962c77
SSDEEP 98304:doSfVdOUwTG1Q0G7KSIy4ljjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjP:ldOqFyYBLyyyyyyyyyyyyyyyyyyyyyyN
TLSH
T19C56120036C64579F23B1A305991D14F869AFAA08BF1819FF1ECB30E7BA5EE08777915
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

443897

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\yl_soui_build\YuelunSetup\pluginsRelease\setupdll.pdb

kernel32

HeapDestroy HeapAlloc HeapFree GetCurrentProcess FlushInstructionCache Sleep FindClose FindFirstFileW GetFullPathNameW SetLastError FreeResource LoadResource LockResource SizeofResource FindResourceW MulDiv GetTickCount GetVersionExW GetLocalTime GetVersionExA GetModuleHandleA LoadLibraryA GetModuleFileNameW TerminateProcess OpenProcess CloseHandle Process32NextW Process32FirstW WriteConsoleW SetEndOfFile HeapSize CreateFileW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW CreateToolhelp32Snapshot GetUserDefaultLCID IsValidLocale GetLocaleInfoW DeleteCriticalSection CompareStringW GetTimeZoneInformation SetStdHandle GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers HeapReAlloc GetFileType GetStdHandle GetModuleHandleExW ReadFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedFlushSList RaiseException RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent CreateEventW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx LocalFree GetStringTypeW HeapCreate LeaveCriticalSection EnterCriticalSection LCMapStringW lstrcpyW LoadLibraryW GetLastError SetDllDirectoryW SetCurrentDirectoryW GetModuleHandleW InitializeCriticalSection GetProcAddress lstrcpynW MultiByteToWideChar lstrcpynA GlobalFree lstrcpyA GlobalAlloc OutputDebugStringA WideCharToMultiByte FreeLibrary EnumSystemLocalesW ExitProcess

user32

DrawTextW IsWindowVisible GetSystemMetrics EnableMenuItem PeekMessageW DispatchMessageW TranslateMessage GetMessageW GetIconInfo SystemParametersInfoA EnableWindow SetActiveWindow GetDesktopWindow CharLowerBuffW MapVirtualKeyA UpdateLayeredWindow PostMessageW SendMessageW GetCursorPos IsIconic ShowWindow MessageBoxW GetActiveWindow CallWindowProcW SetWindowLongW CharNextW LoadImageW MsgWaitForMultipleObjects GetForegroundWindow EqualRect CreateIconFromResource LoadBitmapW GetKeyState GetFocus LoadIconW OffsetRect GetSysColor SetMenuContextHelpId SetForegroundWindow GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenu AppendMenuW GetMenuItemCount DestroyMenu CreatePopupMenu IsWindowEnabled IsMenu PtInRect ClientToScreen SetRect SetCursor DestroyIcon GetClassNameW IsRectEmpty UnionRect IntersectRect InflateRect CopyRect ScreenToClient SetCaretPos HideCaret GetCaretBlinkTime CreateCaret SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC UpdateWindow KillTimer SetTimer ReleaseCapture SetCapture GetCapture SetFocus IsZoomed SetLayeredWindowAttributes AnimateWindow PostQuitMessage TrackMouseEvent GetMonitorInfoW MonitorFromWindow GetWindow GetParent GetWindowLongW MapWindowPoints GetWindowRect GetClientRect GetDlgItem SetWindowPos CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW DestroyCursor LoadCursorW DestroyWindow IsWindow FindWindowExW

gdi32

SetBkMode GetObjectW Rectangle SetViewportOrgEx SetGraphicsMode GetStockObject CreateSolidBrush StretchBlt DeleteDC GetDeviceCaps SelectObject CreateFontIndirectW GetCurrentObject GetViewportOrgEx CreateRoundRectRgn DeleteObject BitBlt EnumFontsW CreateBitmap CreateCompatibleDC

advapi32

RegOpenKeyExW RegEnumKeyExW RegOpenKeyW RegQueryValueExW

shell32

SHGetPathFromIDListW ShellExecuteW Shell_NotifyIconW SHBrowseForFolderW

ole32

CreateBindCtx CoCreateInstance CLSIDFromProgID CLSIDFromString OleLockRunning OleInitialize CoTaskMemFree OleUninitialize

oleaut32

SysAllocString SysFreeString

shlwapi

StrToIntExW

imm32

ImmReleaseContext ImmAssociateContext ImmGetContext

Sharing

General

Malware Config

Signatures

File Explorer

de865cc2859cb2963ab541d90719aa16e5861b4b6a50390277fc99622750c6d7

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

imm32

generic