shoujoramune[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
shoujoramune.exe
Size 3.9MB
Sample260809-g24frssbqe
SHA256 923bcb530cfe6bde0c135e94b2761bb63e736f6f39445993a0e4b7f221f90596
MD5 ea7769bd7eb56e81946d08c06ed194e8
SHA1 4db3375451e84f5fdcfc56fc7c80a92511893267
SHA512 a2fccf3de5bdab75fcd1ef88956194ca12873862600e2254f3e46ee7b39f25fe194fa17684c95ff51e4e603be15a9cbee654c3cecb37ef3f330618f1f66f465c
SSDEEP 49152:+U6aYo/IJ4dhKfwTEcjQbKdKTMCCKKaAMQedG2XUVKTtVrp60dDgw5nPM/ihcyK9:+Dp+IJ4qKE/oKHCKKuhhrMWgw5
TLSH
T18A167DC27701D066E88281B1552DFA5A911CFFB80761C8E793C87EAA95399D33F31A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
shoujoramune.exe

File Explorer

shoujoramune.exe

.exe 3.9MB

shoujoramune.exe

IMPHASH 6054b61cca928e298c9af83dad18e3dc
SHA256 923bcb530cfe6bde0c135e94b2761bb63e736f6f39445993a0e4b7f221f90596
MD5 ea7769bd7eb56e81946d08c06ed194e8
SHA1 4db3375451e84f5fdcfc56fc7c80a92511893267
SHA512 a2fccf3de5bdab75fcd1ef88956194ca12873862600e2254f3e46ee7b39f25fe194fa17684c95ff51e4e603be15a9cbee654c3cecb37ef3f330618f1f66f465c
SSDEEP 49152:+U6aYo/IJ4dhKfwTEcjQbKdKTMCCKKaAMQedG2XUVKTtVrp60dDgw5nPM/ihcyK9:+Dp+IJ4qKE/oKHCKKuhhrMWgw5
TLSH
T18A167DC27701D066E88281B1552DFA5A911CFFB80761C8E793C87EAA95399D33F31A1F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2573179

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\doc\Programs\20141021 T07\Project\T07\App\Release\shoujoramune.pdb

kernel32

VirtualAlloc VirtualFree GetFileSize ReadFile SetFilePointer FreeLibrary GetProcAddress CreateMailslotA GetMailslotInfo LoadLibraryA GetModuleFileNameA GetCurrentDirectoryA GetLastError GetTickCount GetDriveTypeA RemoveDirectoryA DeleteFileA DeleteFileW lstrcmpA FindNextFileA FindFirstFileA CreateDirectoryA GetDiskFreeSpaceExA lstrlenA CompareFileTime FileTimeToSystemTime LocalFileTimeToFileTime FileTimeToLocalFileTime GetLocalTime GetFileTime SetEndOfFile CreateFileW SetEnvironmentVariableA WriteConsoleW SetStdHandle GetTimeZoneInformation SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers VirtualProtect GetVersionExW UnregisterWaitEx InitializeSListHead ReleaseSemaphore FindClose GetFileAttributesA WritePrivateProfileStringA GetPrivateProfileStringA GetModuleHandleA FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId GetFileType GetStdHandle GetProcessHeap LCMapStringW CompareStringW GetStringTypeW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale lstrcpyA SystemTimeToFileTime GetSystemTime CreateFileA GetLocaleInfoW GetCPInfo OpenMutexA CreateMutexA CloseHandle WriteFile GetOEMCP IsValidCodePage HeapSize UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation OutputDebugStringA WideCharToMultiByte SearchPathA SetEvent ResetEvent CreateEventA Sleep CopyFileA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection lstrcmpiA QueryPerformanceCounter QueryPerformanceFrequency DebugBreak GetVersionExA SwitchToFiber DeleteFiber CreateFiber ConvertThreadToFiber ReleaseMutex WaitForSingleObject MultiByteToWideChar SetFileTime MoveFileA DuplicateHandle GetCurrentProcess GetCurrentThread GetCurrentThreadId GetExitCodeThread GetSystemTimeAsFileTime EncodePointer DecodePointer RaiseException RtlUnwind IsProcessorFeaturePresent GetACP GetCommandLineA ExitProcess GetModuleHandleExW AreFileApisANSI HeapFree HeapAlloc OutputDebugStringW GetThreadTimes FreeLibraryAndExitThread GetModuleFileNameW LoadLibraryExW InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList SetLastError LoadLibraryW HeapReAlloc IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount CreateEventW TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW CreateSemaphoreW CreateThread ExitThread CreateTimerQueue WaitForSingleObjectEx SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetFileAttributesExW

user32

OffsetRect SetWindowPos ShowWindow IsWindow SendMessageA IsIconic SetRect EndMenu IntersectRect GetWindowTextA SetFocus GetParent SetWindowLongA MessageBoxA SetWindowTextA EnableWindow GetKeyboardType SendDlgItemMessageA GetDlgItemTextA SetDlgItemTextA PostMessageA DispatchMessageA TranslateMessage GetMessageA GetWindowLongA GetWindowRect PeekMessageA IsZoomed GetAsyncKeyState MsgWaitForMultipleObjects CreateAcceleratorTableA DestroyAcceleratorTable CopyAcceleratorTableA TranslateAcceleratorA GetForegroundWindow LoadIconA SetMenu DrawMenuBar CreateMenu CreatePopupMenu DestroyMenu GetMenuItemCount GetMenu InsertMenuItemA GetMenuItemInfoA GetMenuItemRect GetClientRect GetCursorPos ScreenToClient GetSystemMetrics DefWindowProcA CallWindowProcA RegisterClassExA IsWindowVisible UpdateWindow SetCursor LoadCursorA GetMessageExtraInfo SetCapture ReleaseCapture SetTimer KillTimer ShowCursor SetCursorPos ClientToScreen VkKeyScanA GetDC ReleaseDC BeginPaint EndPaint FillRect ChangeDisplaySettingsA EnumDisplaySettingsA EnumDisplayDevicesA SetRectEmpty SetForegroundWindow GetDlgItem CreateDialogParamA DestroyWindow CreateWindowExA IsDialogMessageA

gdi32

StretchBlt SetStretchBltMode DeleteDC BitBlt SetTextColor GetStockObject DeleteObject CreateCompatibleDC CreateFontIndirectA EnumFontFamiliesExA GetGlyphOutlineA SelectObject GetTextMetricsA CreateDIBSection

advapi32

GetUserNameA

shell32

SHGetMalloc SHBrowseForFolderA SHGetSpecialFolderPathA ShellExecuteExA SHFileOperationA ShellExecuteA SHGetPathFromIDListA

ole32

CoTaskMemFree CoInitialize CoCreateInstance

winmm

timeSetEvent timeKillEvent timeGetTime timeBeginPeriod

comctl32

ord17 CreatePropertySheetPageA PropertySheetA

msi

ord112 ord67

imm32

ImmReleaseContext ImmSetOpenStatus ImmGetContext

msacm32

acmStreamUnprepareHeader acmStreamPrepareHeader acmStreamConvert acmStreamSize acmStreamClose acmStreamOpen acmFormatSuggest acmDriverClose acmDriverOpen acmDriverRemove acmDriverAddA

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.adata

Size

1024B

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

546KB

Virtual Size

545KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

78KB

Virtual Size

748KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

296KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=207, version=65501,

count=4, id=199, version=41118,

count=66, id=223, productName=VS2013 build 21005, version=21005,

count=131, id=225, productName=VS2013 build 21005, version=21005,

count=193, id=224, productName=VS2013 build 21005, version=21005,

count=65, id=109, productName=VS2005 build 50727, version=50727,

count=20, id=228, version=31101,

count=1, id=206, productName=VS2012 UPD3 build 60610, version=60610,

count=2, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=22, productName=Unmarked objects (old),

count=1, id=209, version=65501,

count=2, id=206, version=65501,

count=1, id=208, version=65501,

count=23, id=203, version=65501,

count=300, id=1, productName=Unmarked objects,

count=137, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,