613bbaefa7b7370884f3198d4f7361547e66cea471090e439962c4bfc03fcb87

Sharing

Copy URL Twitter E-mail

General

Target
613bbaefa7b7370884f3198d4f7361547e66cea471090e439962c4bfc03fcb87
Size 9.8MB
Sample260811-e8bm8agj3v
SHA256 613bbaefa7b7370884f3198d4f7361547e66cea471090e439962c4bfc03fcb87
MD5 3bbbeed3921ae01a058d2fa85f8517dc
SHA1 259b36fbffbd7c16bbddc51532cb981ffa4dad1c
SHA512 abd5012ee94fbf83d886ac538847e65d8390ccfae81bd83c8cb44e9cf2512fc3414b9ce1f3e58013722efae7c0c02d59d6925f06c45ffa1cdbdd75f8e1aacdff
SSDEEP 98304:m0T4dUFyDq2rZ0+vOXQL152Gls5uo9bp1849hmKFgXAOHkTmGfr/gjy:m0cq82QeuE849MlzSmG
TLSH
T14EA68C0039809463CD55A03821FEAE75497F1E502F39ACD7979474AF0E31BD22EB66AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
613bbaefa7b7370884f3198d4f7361547e66cea471090e439962c4bfc03fcb87

File Explorer

613bbaefa7b7370884f3198d4f7361547e66cea471090e439962c4bfc03fcb87

.exe 9.8MB

613bbaefa7b7370884f3198d4f7361547e66cea471090e439962c4bfc03fcb87

IMPHASH 5a7b4c4aeb61f216c07f777af27fa7cf
SHA256 613bbaefa7b7370884f3198d4f7361547e66cea471090e439962c4bfc03fcb87
MD5 3bbbeed3921ae01a058d2fa85f8517dc
SHA1 259b36fbffbd7c16bbddc51532cb981ffa4dad1c
SHA512 abd5012ee94fbf83d886ac538847e65d8390ccfae81bd83c8cb44e9cf2512fc3414b9ce1f3e58013722efae7c0c02d59d6925f06c45ffa1cdbdd75f8e1aacdff
SSDEEP 98304:m0T4dUFyDq2rZ0+vOXQL152Gls5uo9bp1849hmKFgXAOHkTmGfr/gjy:m0cq82QeuE849MlzSmG
TLSH
T14EA68C0039809463CD55A03821FEAE75497F1E502F39ACD7979474AF0E31BD22EB66AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

455962

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Q:\vc\project\云小记\release\NotesSetup.pdb

wininet

HttpOpenRequestW InternetReadFile InternetConnectW InternetOpenW InternetCloseHandle HttpSendRequestW HttpQueryInfoA

kernel32

GetWindowsDirectoryW CreateDirectoryW RemoveDirectoryW CreateFileW GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MulDiv lstrlenW DecodePointer InterlockedIncrement InterlockedDecrement FreeLibrary GetProcAddress lstrcmpiW LoadLibraryExW GetTempPathW MoveFileW lstrcpyW lstrcatW LoadLibraryW QueryDosDeviceW SetFilePointer SetFileTime SystemTimeToFileTime LocalFileTimeToFileTime GetCurrentDirectoryW GetFileInformationByHandle FileTimeToSystemTime WriteConsoleW GetConsoleCP FlushFileBuffers SetStdHandle OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA GetTimeZoneInformation SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetLogicalDriveStringsW SetFilePointerEx ReadConsoleW GetConsoleMode GetFileType GetCurrentThread GetACP GetStdHandle GetModuleHandleExW ExitProcess InterlockedFlushSList RtlUnwind LocalFree GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SetEvent GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread CreateEventW FormatMessageW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent GetDriveTypeW SetEndOfFile FindClose ReadFile InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection WriteFile GetFileSize Sleep InitializeCriticalSectionAndSpinCount SetLastError GetLastError GetCurrentThreadId CreateThread GetModuleHandleW GetTickCount LockResource GetLocalTime GlobalUnlock GlobalLock GlobalAlloc FreeResource WideCharToMultiByte MultiByteToWideChar GetVersionExW GetModuleFileNameW GetModuleFileNameA FindResourceExW FindResourceW OpenFileMappingW CreateFileMappingW UnmapViewOfFile MapViewOfFile CloseHandle SizeofResource LoadResource RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetDateFormatW

user32

GetScrollInfo CreateDialogParamW SetScrollInfo DestroyCursor TrackMouseEvent SendMessageW DefWindowProcW CallWindowProcW IsWindow SetTimer KillTimer GetClientRect FillRect SetCaretPos DestroyCaret CreateCaret GetCursorPos CharNextW SetCursor SetScrollPos GetKeyboardState GetKeyState IsRectEmpty GetWindowLongW SetWindowLongW GetDC ReleaseDC GetDesktopWindow PostMessageW PostQuitMessage UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW DestroyWindow ShowWindow UpdateLayeredWindow SetWindowPos IsWindowVisible GetActiveWindow GetSystemMetrics DrawTextW SetForegroundWindow GetWindowDC InvalidateRect SetWindowTextW GetWindowRect ScreenToClient IsClipboardFormatAvailable EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard wsprintfW ClientToScreen GetFocus InvertRect FrameRect PeekMessageW DispatchMessageW TranslateMessage GetMessageW PtInRect GetWindowTextLengthW GetWindowTextW EndPaint BeginPaint EnableWindow SetFocus MoveWindow GetMonitorInfoW MonitorFromWindow LoadImageW LoadCursorW GetWindow FindWindowW GetParent OffsetRect SetRect MapWindowPoints

gdi32

SetMapMode SaveDC RestoreDC Rectangle LineTo GetTextExtentPointW GetTextColor GetObjectType GetBkMode GetBkColor CreatePen SetViewportOrgEx SetTextCharacterExtra CreateRectRgn DPtoLP TextOutW SetBkMode GetDeviceCaps CreateFontIndirectW ExtTextOutW SetTextColor SetBkColor CreateSolidBrush BitBlt StretchBlt DeleteDC CreateCompatibleBitmap GetObjectW SetStretchBltMode SelectObject DeleteObject GetTextMetricsW BeginPath EndPath SelectClipPath MoveToEx CreateDIBSection SelectClipRgn CreateCompatibleDC

advapi32

RegCreateKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyW RegDeleteValueW RegCreateKeyW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegDeleteKeyW

shell32

SHFileOperationW SHBrowseForFolderW SHGetSpecialFolderPathW SHGetPathFromIDListW ShellExecuteW

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CreateStreamOnHGlobal

oleaut32

SysAllocStringLen VarBstrCmp SysAllocString SysFreeString VarUI4FromStr VariantClear GetErrorInfo VariantInit VariantChangeType SetErrorInfo CreateErrorInfo

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

version

VerQueryValueA VerQueryValueW GetFileVersionInfoW GetFileVersionInfoA GetFileVersionInfoSizeW GetFileVersionInfoSizeA

gdiplus

GdipCloneImage GdipFree GdipAlloc GdipCreateHBITMAPFromBitmap GdipSaveImageToFile GdipGetImageFlags GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreateBitmapFromHBITMAP GdiplusShutdown GdiplusStartup GdipGetImageEncodersSize GdipGetImageHeight GdipGetImageWidth GdipGetImageEncoders GdipDisposeImage

Sharing

General

Malware Config

Signatures

File Explorer

613bbaefa7b7370884f3198d4f7361547e66cea471090e439962c4bfc03fcb87

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

msimg32

version

gdiplus

generic