5ce55e448de5c599036ce4a6b361aa98a90cdfd5d31e8a16b7f0b92f5c01641d

Sharing

Copy URL Twitter E-mail

General

Target
5ce55e448de5c599036ce4a6b361aa98a90cdfd5d31e8a16b7f0b92f5c01641d
Size 1.2MB
Sample260809-q4nb1assbt
SHA256 5ce55e448de5c599036ce4a6b361aa98a90cdfd5d31e8a16b7f0b92f5c01641d
MD5 ca0c39c95e7c5f77da47524652a88bc0
SHA1 b08f0f8240262d495522512f82150555b670796d
SHA512 66736679be25fac90abeff29079b0ecdd49e9f2ea7e5e46eb25e27bdccef43649ba338e12b48f6c7e16069a58374a185743fec0aefb2031797649db8a01aa247
SSDEEP 24576:rzthfI+KvAftHdjF8P5K9567hrQh0lhSMXlciGnP/dLIBOhH:rzthfBWAtd58hKT2hlJGnPKGH
TLSH
T1EB45BE45B6F840F8D0ABC178CA929A0FE772385807202AEF57E466556F67AE01F7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ce55e448de5c599036ce4a6b361aa98a90cdfd5d31e8a16b7f0b92f5c01641d

File Explorer

5ce55e448de5c599036ce4a6b361aa98a90cdfd5d31e8a16b7f0b92f5c01641d

.exe 1.2MB

5ce55e448de5c599036ce4a6b361aa98a90cdfd5d31e8a16b7f0b92f5c01641d

IMPHASH 4a4d853f567611a37871271a064b60e8
SHA256 5ce55e448de5c599036ce4a6b361aa98a90cdfd5d31e8a16b7f0b92f5c01641d
MD5 ca0c39c95e7c5f77da47524652a88bc0
SHA1 b08f0f8240262d495522512f82150555b670796d
SHA512 66736679be25fac90abeff29079b0ecdd49e9f2ea7e5e46eb25e27bdccef43649ba338e12b48f6c7e16069a58374a185743fec0aefb2031797649db8a01aa247
SSDEEP 24576:rzthfI+KvAftHdjF8P5K9567hrQh0lhSMXlciGnP/dLIBOhH:rzthfBWAtd58hKT2hlJGnPKGH
TLSH
T1EB45BE45B6F840F8D0ABC178CA929A0FE772385807202AEF57E466556F67AE01F7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

567472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\23626\Desktop\ShenYingLoader\64\ShenYingLoader.pdb

kernel32

IsWow64Process GetCurrentProcess LoadLibraryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter Sleep AddVectoredExceptionHandler ExitProcess SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter CreateFileW RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent WriteFile GetStdHandle TerminateProcess ReadFile FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetCPInfo GetStringTypeW LCMapStringEx DecodePointer GetModuleHandleW GetCurrentProcessId LocalFree DebugActiveProcess Process32FirstW Process32NextW FormatMessageW WaitForSingleObject GetProcessId GetModuleFileNameW GetModuleHandleExW CloseHandle WideCharToMultiByte MultiByteToWideChar LoadLibraryExW GetProcAddress EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RtlUnwind GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA InitializeSListHead CreateToolhelp32Snapshot GetModuleHandleA DebugActiveProcessStop FlsFree IsDebuggerPresent GetLastError GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

user32

GetForegroundWindow GetKeyboardLayout TrackMouseEvent IsChild GetDC SetClipboardData GetClipboardData CloseClipboard OpenClipboard GetCursorPos SetCursorPos IsIconic SetForegroundWindow ReleaseCapture IsWindowUnicode GetClientRect SetWindowLongW SetCursor SetCapture LoadCursorW BringWindowToTop SetFocus GetMessageExtraInfo ReleaseDC GetPropA EmptyClipboard ClientToScreen MessageBoxW DispatchMessageW PeekMessageW TranslateMessage PostQuitMessage UpdateWindow GetWindowLongW DefWindowProcW AdjustWindowRectEx GetKeyState GetMonitorInfoW SetPropA DestroyWindow SetWindowPos MonitorFromWindow SetWindowLongPtrW EnumDisplayMonitors CreateWindowExW ScreenToClient UnregisterClassW RegisterClassExW WindowFromPoint ShowWindow GetCapture SetLayeredWindowAttributes

gdi32

GetDeviceCaps CreateRectRgn DeleteObject

advapi32

OpenProcessToken GetTokenInformation

shell32

ShellExecuteW

freetype

FT_New_Size FT_Done_Library FT_Get_Char_Index FT_Add_Default_Modules FT_Property_Set FT_Done_Face FT_GlyphSlot_Embolden FT_Render_Glyph FT_New_Library FT_Done_Size FT_New_Memory_Face FT_Load_Glyph FT_Activate_Size FT_Request_Size FT_Select_Charmap FT_GlyphSlot_Oblique

plutosvg

plutosvg_ft_svg_hooks

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

d3d11

D3D11CreateDeviceAndSwapChain

Name

.text

Size

750KB

Virtual Size

750KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

304KB

Virtual Size

303KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5ce55e448de5c599036ce4a6b361aa98a90cdfd5d31e8a16b7f0b92f5c01641d

kernel32

user32

gdi32

advapi32

shell32

freetype

plutosvg

imm32

d3dcompiler_47

dwmapi

d3d11

generic