31bd69197a14fc7a6d8b7672e884cd2c58a535123739832b5fc3feb9e474fd51

Sharing

Copy URL Twitter E-mail

General

Target
31bd69197a14fc7a6d8b7672e884cd2c58a535123739832b5fc3feb9e474fd51
Size 878KB
Sample260819-eexzcscg95
SHA256 31bd69197a14fc7a6d8b7672e884cd2c58a535123739832b5fc3feb9e474fd51
MD5 912cfc273c58113bd15d4c2f6539e915
SHA1 d1590702dbc66c6676f188d996e6cd98a290e877
SHA512 db93657ef2275d8ec094c06480dfa17ab15b3e0984ec57d733dcdc2da84039ac86a24a5484bccf0025795565aba048acdcfff4754439aafb60764bbb883a1ed5
SSDEEP 12288:kvKfTu9++tFNCHEn+Ys9mwr6Cv2g6HV8uw4xS7l9gi3ahjIm+I4gSUvVTEinM:uKG+QTFs9mwr6Ii/i3a1Im+I
TLSH
T11C157C217DC0C073DEE211BA86FCF975116DB8B00B2956CB11D467EFD6682D22E32AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31bd69197a14fc7a6d8b7672e884cd2c58a535123739832b5fc3feb9e474fd51

File Explorer

31bd69197a14fc7a6d8b7672e884cd2c58a535123739832b5fc3feb9e474fd51

.exe 878KB

31bd69197a14fc7a6d8b7672e884cd2c58a535123739832b5fc3feb9e474fd51

IMPHASH affbbe3675add261d81f793963b0f015
SHA256 31bd69197a14fc7a6d8b7672e884cd2c58a535123739832b5fc3feb9e474fd51
MD5 912cfc273c58113bd15d4c2f6539e915
SHA1 d1590702dbc66c6676f188d996e6cd98a290e877
SHA512 db93657ef2275d8ec094c06480dfa17ab15b3e0984ec57d733dcdc2da84039ac86a24a5484bccf0025795565aba048acdcfff4754439aafb60764bbb883a1ed5
SSDEEP 12288:kvKfTu9++tFNCHEn+Ys9mwr6Cv2g6HV8uw4xS7l9gi3ahjIm+I4gSUvVTEinM:uKG+QTFs9mwr6Ii/i3a1Im+I
TLSH
T11C157C217DC0C073DEE211BA86FCF975116DB8B00B2956CB11D467EFD6682D22E32AD6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18141

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\PY\迷你老版本加密V3\_项目文件\micromini\Release\MicroMini.pdb

kernel32

LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetFileSize ReadFile FindClose CloseHandle GetTickCount LoadLibraryExW GetModuleFileNameW CreateProcessW SetCurrentDirectoryW SetDllDirectoryW RemoveDirectoryW CreateFileW SetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileW MultiByteToWideChar WideCharToMultiByte HeapSize EnterCriticalSection GetTimeZoneInformation HeapReAlloc SetStdHandle OutputDebugStringW OutputDebugStringA SetConsoleCtrlHandler GetProcessHeap SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID InitializeCriticalSection SetErrorMode CreateThread GetCurrentProcessId WriteConsoleW GetProcAddress IsValidLocale GetTimeFormatW GetDateFormatW HeapAlloc HeapFree GetCurrentThread GetACP WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleExW ExitProcess GetFileAttributesExW FreeLibrary InterlockedFlushSList InterlockedPushEntrySList RtlUnwind RaiseException GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SetEndOfFile SwitchToThread SetLastError DecodePointer EncodePointer FormatMessageW GetLastError InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent

user32

SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW IsWindow ShowWindow UpdateLayeredWindow IsWindowVisible ReleaseCapture SetTimer KillTimer GetSystemMetrics GetDC ReleaseDC GetClientRect GetWindowRect MessageBoxW EnumWindows GetWindowThreadProcessId LoadCursorW GetMessageW wsprintfW TranslateMessage DispatchMessageW

gdi32

DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap SelectObject

ole32

CoUninitialize CoInitialize

gdiplus

GdipAddPathArcI GdipClosePathFigure GdipDeletePath GdipDeleteBrush GdiplusShutdown GdiplusStartup GdipFillPath GdipAlloc GdipCreateTexture GdipCreateSolidFill GdipLoadImageFromFile GdipCloneBrush GdipLoadImageFromFileICM GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetTextRenderingHint GdipDrawImageRectI GdipDrawImagePointRectI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipCreatePath GdipFree

Name

.text

Size

640KB

Virtual Size

639KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

31bd69197a14fc7a6d8b7672e884cd2c58a535123739832b5fc3feb9e474fd51

kernel32

user32

gdi32

ole32

gdiplus

generic