d94f19a8cf46ffde03b5a21bbb446d0e96403878d6f0c568a12816dc19407646

Sharing

Copy URL Twitter E-mail

General

Target
d94f19a8cf46ffde03b5a21bbb446d0e96403878d6f0c568a12816dc19407646
Size 2.8MB
Sample260820-ndfhcsch62
SHA256 d94f19a8cf46ffde03b5a21bbb446d0e96403878d6f0c568a12816dc19407646
MD5 b476cd7880cd454751aa0555103a55e3
SHA1 d285db212a8fd8a9022f3c391f98575abca8d23f
SHA512 6907676f7b41a2f383484f89114f249fce79c88c460adfbd4e11e69ec048883bc74370cd3c415ea4f54cae651eb173ca35e5ca4eff8fa9f82af928f8b03a81ec
SSDEEP 49152:DOiMHPChovEtN+rgFQrykErkuFRsyPcOsVUISYQrJGK9uGZgG5j:FyXORs+cLbxQ1GK9
TLSH
T1BBD5BE307741C035DAD114718A6EEAAA509DBF341B6146EBE7982B2F5E700C37E3792B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d94f19a8cf46ffde03b5a21bbb446d0e96403878d6f0c568a12816dc19407646

File Explorer

d94f19a8cf46ffde03b5a21bbb446d0e96403878d6f0c568a12816dc19407646

.exe 2.8MB

d94f19a8cf46ffde03b5a21bbb446d0e96403878d6f0c568a12816dc19407646

IMPHASH aba73dbdbbcf8b926d6a5f6cde967355
SHA256 d94f19a8cf46ffde03b5a21bbb446d0e96403878d6f0c568a12816dc19407646
MD5 b476cd7880cd454751aa0555103a55e3
SHA1 d285db212a8fd8a9022f3c391f98575abca8d23f
SHA512 6907676f7b41a2f383484f89114f249fce79c88c460adfbd4e11e69ec048883bc74370cd3c415ea4f54cae651eb173ca35e5ca4eff8fa9f82af928f8b03a81ec
SSDEEP 49152:DOiMHPChovEtN+rgFQrykErkuFRsyPcOsVUISYQrJGK9uGZgG5j:FyXORs+cLbxQ1GK9
TLSH
T1BBD5BE307741C035DAD114718A6EEAAA509DBF341B6146EBE7982B2F5E700C37E3792B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

953218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Jenkins\.jenkins\workspace\clean_master\fresh_home_support\xing_ju_shi_dai\hover_zoom\install_uninstall\install_uninstall\Release\Install.pdb

kernel32

GetModuleHandleW LoadLibraryExW lstrcmpiW SetEvent CreateEventW GetDriveTypeW VerSetConditionMask VerifyVersionInfoW InitializeCriticalSectionEx GetTickCount64 FreeLibrary GetCurrentThreadId GetCurrentProcess Sleep InitializeCriticalSectionAndSpinCount RaiseException DecodePointer MultiByteToWideChar DeleteCriticalSection CreateDirectoryW WideCharToMultiByte LoadLibraryW GetProcAddress GetStartupInfoW CreateProcessW WaitForSingleObject UnlockFile ReadFile LockFile GetFileSize CreateFileW GetModuleFileNameW CreateMutexW LeaveCriticalSection SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler ReadConsoleW FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetConsoleMode EnterCriticalSection SetFilePointerEx GetACP ExitProcess WriteConsoleW GetModuleFileNameA GetFileType GetModuleHandleExW ResumeThread ExitThread InitializeCriticalSection GetLastError MoveFileExW MoveFileW FindResourceW lstrlenW SizeofResource LockResource LoadResource FindResourceExW GetWindowsDirectoryW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetTempPathW SetFileAttributesW RemoveDirectoryW GetFullPathNameW GetFileAttributesW FindNextFileW RtlUnwind WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList SetProcessAffinityMask VirtualProtect GetVersionExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue lstrcmpA DeviceIoControl ReleaseMutex SetUnhandledExceptionFilter UnhandledExceptionFilter FindNextFileA FindFirstFileA GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetCPInfo FindFirstFileW FindClose DeleteFileW GetLocaleInfoW LCMapStringW CompareStringW GetNativeSystemInfo GetExitCodeThread GetCurrentThread WaitForSingleObjectEx DuplicateHandle GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter TryEnterCriticalSection GetStringTypeW LoadLibraryExA IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent Process32NextW Process32FirstW CreateToolhelp32Snapshot GetProcessId GetFileAttributesExW GetTempFileNameA GetTempPathA CloseHandle WriteFile DeleteFileA GetPrivateProfileStringW LocalAlloc GetConsoleCP CreateFileA SearchPathW GetShortPathNameW SetFileTime GetSystemDirectoryW GetCurrentDirectoryW GetTempFileNameW FindFirstChangeNotificationW GetLogicalDriveStringsW FindCloseChangeNotification CompareFileTime SetFilePointer SetEndOfFile GetFileInformationByHandle GetStdHandle VirtualFree VirtualAlloc GetSystemInfo GlobalMemoryStatus ReleaseSemaphore ResetEvent CreateSemaphoreW WaitForMultipleObjects GetFileSizeEx GetLocalTime GetCurrentProcessId LocalFree FormatMessageW WritePrivateProfileStringW CopyFileW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetLongPathNameW QueryDosDeviceW TerminateProcess GetExitCodeProcess OpenProcess GetDiskFreeSpaceExW OutputDebugStringA OutputDebugStringW GetTickCount RtlCaptureStackBackTrace

user32

TranslateMessage MonitorFromWindow PeekMessageW DefWindowProcW PostMessageW ReleaseDC DispatchMessageW GetMessageW GetDC GetWindowThreadProcessId FindWindowExW UnregisterClassW IsDialogMessageW GetActiveWindow EndDialog DialogBoxParamW GetMonitorInfoW LoadImageW GetWindow GetParent GetWindowLongW MapWindowPoints ScreenToClient GetWindowRect GetClientRect SetWindowTextW InvalidateRect EndPaint BeginPaint SetForegroundWindow GetSystemMetrics KillTimer SetTimer ReleaseCapture SetCapture GetAsyncKeyState IsIconic IsWindowVisible UpdateLayeredWindow IsWindow CallWindowProcW PostQuitMessage CharUpperW CharPrevExA CharLowerW RegisterWindowMessageW SendMessageTimeoutW SendNotifyMessageW FindWindowW wsprintfW DestroyCursor CopyRect OffsetRect UnionRect EqualRect PtInRect DrawFocusRect SetCursor MoveWindow SendMessageW LoadCursorW SetWindowLongW CharNextW BringWindowToTop SetWindowPos ShowWindow DestroyWindow CreateWindowExW GetClassInfoExW RegisterClassExW

gdi32

OffsetViewportOrgEx RestoreDC SaveDC RectVisible SelectObject CreateDIBSection GetObjectW SetViewportOrgEx EnumFontFamiliesW CreateFontW DeleteObject GetDeviceCaps BitBlt CreateCompatibleBitmap CreateCompatibleDC SelectClipRgn CreateRectRgnIndirect DeleteDC

advapi32

GetTokenInformation SetNamedSecurityInfoW GetNamedSecurityInfoW GetExplicitEntriesFromAclW SetEntriesInAclW LookupAccountNameW LookupAccountSidW EqualSid DeleteAce RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegGetValueW FreeSid CheckTokenMembership AllocateAndInitializeSid LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetUserNameW GetTrusteeNameW BuildExplicitAccessWithNameW

shell32

SHCreateDirectoryExW SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW SHChangeNotify ShellExecuteExW SHGetSpecialFolderPathW ord165 SHFileOperationW

ole32

CoUninitialize CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize CreateStreamOnHGlobal CoCreateGuid CoInitializeSecurity OleRun

oleaut32

VariantInit SysAllocString VariantClear VariantCopy SysAllocStringByteLen SysAllocStringLen VarUI4FromStr SysFreeString GetErrorInfo SysStringLen CreateErrorInfo SetErrorInfo VariantChangeType

shlwapi

StrTrimA PathIsPrefixW StrStrIA PathRenameExtensionA SHDeleteValueW SHSetValueW PathIsRelativeW PathIsDirectoryW PathRemoveFileSpecW SHCreateStreamOnFileEx SHGetValueW StrCmpIW StrToInt64ExW PathFindFileNameW PathFindExtensionW PathFileExistsW PathCombineW PathAppendW wnsprintfW PathFindFileNameA PathAppendA PathIsRootW StrStrIW StrCmpNIW

comctl32

_TrackMouseEvent InitCommonControlsEx

gdiplus

GdipCreateImageAttributes GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipDisposeImage GdiplusShutdown GdiplusStartup GdipCloneImage GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipAlloc GdipFree GdipMeasureString GdipDeleteFontFamily GdipCreateFont GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipGetImageWidth GdipGetImageHeight GdipCreateFontFamilyFromName GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateFromHDC GdipDeleteGraphics GdipSetTextRenderingHint GdipDrawRectangleI GdipFillRectangleI GdipDrawImagePointRectI GdipDrawImageRectRect GdipDrawImageRectRectI GdipDeleteFont GdipDrawString

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

psapi

GetModuleFileNameExW GetProcessImageFileNameW EnumProcesses

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winhttp

WinHttpReceiveResponse WinHttpSetCredentials WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryHeaders WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpSetTimeouts

secur32

GetUserNameExW

setupapi

SetupIterateCabinetW

crypt32

CryptStringToBinaryA CryptStringToBinaryW CryptBinaryToStringA CryptBinaryToStringW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

d94f19a8cf46ffde03b5a21bbb446d0e96403878d6f0c568a12816dc19407646

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

urlmon

psapi

version

winhttp

secur32

setupapi

crypt32

wininet

iphlpapi

generic