7c7574c73e024b4f801b62dab5f600173e0cb3d64332b65330a2b7baad93e2e9

Sharing

Copy URL Twitter E-mail

General

Target
7c7574c73e024b4f801b62dab5f600173e0cb3d64332b65330a2b7baad93e2e9
Size 3.3MB
Sample260808-jgxtlabn9z
SHA256 7c7574c73e024b4f801b62dab5f600173e0cb3d64332b65330a2b7baad93e2e9
MD5 cef06f3ec801be4b2561e53abd390a4f
SHA1 73ec42241995f60c093576e78769a5b8d2f297c8
SHA512 38a18749975f134216dc4b6bceb24411c9379cd88623afc6be169d7708f710056e2e6ef0a045fb242e9c5485c5a73e77bf4aec3b51d653fad79111fe9a176f25
SSDEEP 49152:0Th2dssoUoQdeNJ6QoldganXSeu2QXWhZiAMNELTdHKezIZ34Nht:Ih2dssoUohXolKESerOWzFMb/Z34Nh
TLSH
T1C8F5BF127DA18479C33303318D9CB25EA1FEB9B02E74924B769C270D5FB05D2A9DB663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7c7574c73e024b4f801b62dab5f600173e0cb3d64332b65330a2b7baad93e2e9

File Explorer

7c7574c73e024b4f801b62dab5f600173e0cb3d64332b65330a2b7baad93e2e9

.exe 3.3MB

7c7574c73e024b4f801b62dab5f600173e0cb3d64332b65330a2b7baad93e2e9

IMPHASH b00f04f89305e21c7357f29039a662c1
SHA256 7c7574c73e024b4f801b62dab5f600173e0cb3d64332b65330a2b7baad93e2e9
MD5 cef06f3ec801be4b2561e53abd390a4f
SHA1 73ec42241995f60c093576e78769a5b8d2f297c8
SHA512 38a18749975f134216dc4b6bceb24411c9379cd88623afc6be169d7708f710056e2e6ef0a045fb242e9c5485c5a73e77bf4aec3b51d653fad79111fe9a176f25
SSDEEP 49152:0Th2dssoUoQdeNJ6QoldganXSeu2QXWhZiAMNELTdHKezIZ34Nht:Ih2dssoUohXolKESerOWzFMb/Z34Nh
TLSH
T1C8F5BF127DA18479C33303318D9CB25EA1FEB9B02E74924B769C270D5FB05D2A9DB663
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

782639

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\new_soui3\yuelun_online_4.0\Release\YLToolHelper.pdb

kernel32

LoadResource FreeResource SetLastError GetFullPathNameW FindNextFileW FindFirstFileW FindClose GetModuleHandleW GetVersionExA GetLocalTime GetProcAddress GetVersionExW GetTickCount GetSystemTime lstrlenA ExitProcess TlsSetValue TlsGetValue TlsAlloc UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSizeEx SizeofResource OutputDebugStringA FlushInstructionCache GetCurrentProcess DeleteCriticalSection GetModuleHandleA EnterCriticalSection InitializeCriticalSection HeapFree InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount CloseHandle LockResource FindResourceW EnumResourceTypesW EnumResourceNamesW GetFileInformationByHandle LoadLibraryA HeapAlloc HeapDestroy HeapCreate Sleep GetFileAttributesW GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetLastError SetCurrentDirectoryW LeaveCriticalSection GetModuleFileNameW FreeLibrary LoadLibraryW GlobalUnlock GlobalLock GlobalAlloc IsBadReadPtr MulDiv

user32

CreateIconFromResource LoadImageW SetCaretPos CharLowerBuffW MapVirtualKeyA IsMenu CreatePopupMenu DestroyMenu CheckMenuItem GetSubMenu GetMenuItemCount InsertMenuW AppendMenuW DeleteMenu TrackPopupMenu GetMenuInfo SetMenuInfo GetMenuItemInfoW SetForegroundWindow SetMenuContextHelpId GetMenuContextHelpId CheckMenuRadioItem EnableWindow SetActiveWindow GetDesktopWindow CallMsgFilterW GetForegroundWindow IsIconic MonitorFromRect CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetSystemMetrics GetSysColor EnableMenuItem SetRect WaitMessage PostThreadMessageW PeekMessageW DispatchMessageW TranslateMessage GetIconInfo CharNextW GetKeyState GetFocus WindowFromPoint GetWindow SetParent GetParent SetWindowLongW GetWindowLongW LoadBitmapW SystemParametersInfoA OffsetRect IsRectEmpty IsZoomed GetDlgItem GetDlgCtrlID MoveWindow GetActiveWindow MessageBoxW LoadStringW LoadStringA MapWindowPoints ScreenToClient ClientToScreen ShowCaret HideCaret CreateCaret GetWindowRect GetWindowTextW SetWindowTextW UpdateLayeredWindow ShowWindow CreateWindowExW RegisterClassExW GetDC ReleaseDC SetTimer KillTimer SetCursor CopyRect InflateRect IntersectRect UnionRect EqualRect PtInRect PostQuitMessage SystemParametersInfoW IsWindow DestroyWindow LoadCursorW DestroyCursor TrackMouseEvent AnimateWindow SetLayeredWindowAttributes SetWindowPos SetFocus UpdateWindow UnregisterClassW CallWindowProcW DefWindowProcW InvalidateRect PostMessageW SendNotifyMessageW SendMessageW DrawTextW GetWindowPlacement SetWindowRgn GetWindowDC IsWindowEnabled ReleaseCapture SetCapture GetCapture DrawIconEx GetMonitorInfoW MonitorFromWindow DestroyIcon GetClassNameW GetCursorPos GetClientRect EndPaint BeginPaint IsWindowVisible

gdi32

GetDeviceCaps SetBkMode GetObjectW GetDCOrgEx StretchBlt CreateCompatibleBitmap SetViewportOrgEx GetStockObject CreateSolidBrush CreateFontIndirectW SetGraphicsMode SelectObject DeleteDC CreateCompatibleDC CreateBitmap EnumFontsW DeleteObject ExtCreateRegion IntersectClipRect SelectClipRgn SetWorldTransform CreateDIBSection GetCurrentObject GetViewportOrgEx RectInRegion EnumFontFamiliesExW GetCharABCWidthsW GetFontData GetGlyphOutlineW GetOutlineTextMetricsW GetFontUnicodeRanges GetGlyphIndicesW GetTextExtentPointI AddFontMemResourceEx RemoveFontMemResourceEx SetTextColor SetTextAlign GetTextMetricsW ExtTextOutW GetTextFaceW GdiFlush ExcludeClipRect BitBlt GetClipBox Rectangle

shell32

ShellExecuteW

ole32

CreateBindCtx CoCreateInstance CLSIDFromProgID CoCreateGuid CLSIDFromString OleLockRunning RegisterDragDrop OleUninitialize OleInitialize CreateStreamOnHGlobal

msvcp140

?_W_Getdays@_Locinfo@std@@QBEPBGXZ ?_Xbad_alloc@std@@YAXXZ ?_Getdays@_Locinfo@std@@QBEPBDXZ ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ?_Xbad_function_call@std@@YAXXZ ?_Getmonths@_Locinfo@std@@QBEPBDXZ ?_W_Getmonths@_Locinfo@std@@QBEPBGXZ ?_Xlength_error@std@@YAXPBD@Z _Mbrtowc

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

gdiplus

GdipGetImageEncodersSize GdipGetImageEncoders GdipDrawImageRectI GdipGraphicsClear GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipGetPropertyItem GdipGetPropertyItemSize GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipBitmapUnlockBits GdipBitmapLockBits GdipDrawImageI GdipDeleteGraphics GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromScan0 GdipImageSelectActiveFrame GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipCloneImage GdipAlloc GdipDisposeImage GdipFree

shlwapi

StrToIntExW

imm32

ImmCreateContext ImmGetContext ImmAssociateContext ImmReleaseContext ImmDestroyContext

vcruntime140

memcmp _CxxThrowException __current_exception _setjmp3 _except_handler4_common __current_exception_context longjmp __CxxFrameHandler3 __std_terminate _purecall wcsrchr memcpy memmove wcschr wcsstr memset strstr strchr __std_type_info_destroy_list

api-ms-win-crt-convert-l1-1-0

_itow _wtof strtol atoi _wtoi atof wcstod

api-ms-win-crt-runtime-l1-1-0

abort _errno _register_thread_local_exe_atexit_callback _c_exit _exit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _controlfp_s _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn _crt_at_quick_exit _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit terminate _cexit _invalid_parameter_noinfo

api-ms-win-crt-stdio-l1-1-0

ungetc ftell fseek fgetc feof fopen_s fclose ferror _wfopen_s _set_fmode fread _fseeki64 fgets _ftelli64 __p__commode _fileno __stdio_common_vsscanf _wfopen fflush fwrite __stdio_common_vswscanf __stdio_common_vsnprintf_s __acrt_iob_func __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vfprintf __stdio_common_vswprintf_s __stdio_common_vswprintf _get_osfhandle fopen _filelength rewind

api-ms-win-crt-heap-l1-1-0

free malloc calloc realloc _set_new_mode

api-ms-win-crt-string-l1-1-0

strspn iswspace _wcsupr towupper strncmp strcmp _wcsnicmp wcstok isprint isdigit towlower _wcsdup wcscmp wcscpy strcspn tolower strlen wcsncpy wcscpy_s strcpy wcsncmp toupper wcslen _wcsicmp _wcslwr

api-ms-win-crt-multibyte-l1-1-0

_mbsstr _ismbcspace _mbsrchr _mbslwr _mbschr _mbscmp _mbsicmp _mbsinc _mbsupr

api-ms-win-crt-math-l1-1-0

_except1 __setusermatherr tan ceil floor ldexp modf exp pow acos fabs fmod copysign atan2 _finite sqrt cos sin log frexp

api-ms-win-crt-utility-l1-1-0

qsort bsearch abs qsort_s div _lrotl labs

api-ms-win-crt-time-l1-1-0

_mkgmtime64 _time64 _localtime64_s _mktime64 wcsftime _gmtime64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_stat64i32 _mkdir _access remove

usp10

ScriptShape ScriptFreeCache ScriptItemize

opengl32

wglGetProcAddress wglGetCurrentContext

Sharing

General

Malware Config

Signatures

File Explorer

7c7574c73e024b4f801b62dab5f600173e0cb3d64332b65330a2b7baad93e2e9

kernel32

user32

gdi32

shell32

ole32

msvcp140

version

gdiplus

shlwapi

imm32

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

usp10

opengl32

generic