3a4db1857d3436983584cf82a296bd35d90fdd67830d93fc3f63b797c09beb1c

Sharing

Copy URL Twitter E-mail

General

Target
3a4db1857d3436983584cf82a296bd35d90fdd67830d93fc3f63b797c09beb1c
Size 901KB
Sample260820-p4n3vsde26
SHA256 3a4db1857d3436983584cf82a296bd35d90fdd67830d93fc3f63b797c09beb1c
MD5 f25c31bb9be454cf81c43e8327374a70
SHA1 7c0155e7fac6feb5a8efc2623680dd8eb25fd632
SHA512 bea3b42f475a40f7a6d2e7b6b84cb4de93a6c52004da29d3f51492a696a6d69dfb9cc7f991042a36ee3014b9b7ca3dc01f76a1361ccb18289c0d7f709d215a00
SSDEEP 12288:sb1prUClSXmSaP0XE59QciGC3g5o7ECTF7vVsZxGvmMw1tEOBbdj89biBFq27Ubf:srloygG17CTlvpw1tEOH6r
TLSH
T1CD158E213541C073E5B150F1DD38EF7A806CBD341B7598D767E86B2A2A381E35E32A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a4db1857d3436983584cf82a296bd35d90fdd67830d93fc3f63b797c09beb1c

File Explorer

3a4db1857d3436983584cf82a296bd35d90fdd67830d93fc3f63b797c09beb1c

.exe 901KB

3a4db1857d3436983584cf82a296bd35d90fdd67830d93fc3f63b797c09beb1c

IMPHASH 29b2ee11586675376589c59a7a629187
SHA256 3a4db1857d3436983584cf82a296bd35d90fdd67830d93fc3f63b797c09beb1c
MD5 f25c31bb9be454cf81c43e8327374a70
SHA1 7c0155e7fac6feb5a8efc2623680dd8eb25fd632
SHA512 bea3b42f475a40f7a6d2e7b6b84cb4de93a6c52004da29d3f51492a696a6d69dfb9cc7f991042a36ee3014b9b7ca3dc01f76a1361ccb18289c0d7f709d215a00
SSDEEP 12288:sb1prUClSXmSaP0XE59QciGC3g5o7ECTF7vVsZxGvmMw1tEOBbdj89biBFq27Ubf:srloygG17CTlvpw1tEOH6r
TLSH
T1CD158E213541C073E5B150F1DD38EF7A806CBD341B7598D767E86B2A2A381E35E32A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

308270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\clean_master\fresh_home\xing_ju_shi_dai\surf_guard\tray\Release\SurfGuardTray.pdb

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

DeleteCriticalSection WaitForSingleObject GetCurrentProcessId GetCurrentThreadId FindResourceExW GetModuleFileNameW GetProcAddress LoadResource LockResource SizeofResource LoadLibraryW FindResourceW MultiByteToWideChar GetFileAttributesW FreeLibrary GetCommandLineW SetEvent CreateEventW GetCurrentProcess GetLocalTime GetModuleHandleW WaitForMultipleObjects GetPrivateProfileIntW WritePrivateProfileStringW WideCharToMultiByte GetPrivateProfileStringW CopyFileW DeleteAtom AddAtomW FindAtomW CreateProcessW GetStartupInfoW DeleteFileW GetTempPathW CreateMutexW lstrlenW LoadLibraryExW Sleep SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW InitializeCriticalSectionEx WriteConsoleW ReadConsoleW SetEndOfFile SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP GetStdHandle ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleCP SetFilePointerEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection HeapSetInformation UnmapViewOfFile MapViewOfFileEx CreateFileMappingW LocalFree CreateThread RtlUnwind GetTickCount64 FlushFileBuffers ReleaseMutex GetCPInfo GetLocaleInfoW TerminateProcess UnhandledExceptionFilter WriteFile ReadFile FindNextFileW FindFirstFileW FindClose GetFileType GetProcessHeap HeapSize MapViewOfFile GetFileSizeEx CreateFileW LCMapStringW CompareStringW HeapFree HeapReAlloc HeapAlloc HeapDestroy SetErrorMode SetLastError GetLastError GetModuleHandleExW SetUnhandledExceptionFilter RaiseException FreeLibraryAndExitThread CloseHandle DecodePointer ExitThread DeviceIoControl lstrcmpA IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetStringTypeW FormatMessageW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime lstrcmpiW

user32

PostThreadMessageW FindWindowW LoadIconW GetParent GetCursorPos SetForegroundWindow TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu IsWindow GetWindowLongW KillTimer SetTimer ShowWindow DestroyWindow CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW LoadCursorW SetWindowLongW CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW PeekMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW SendMessageTimeoutW wsprintfW SendMessageW CharNextW

advapi32

RegEnumKeyExW RegOpenKeyExW RegQueryValueExW GetTokenInformation OpenProcessToken RegSetValueExW RegGetValueW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegCloseKey RegQueryInfoKeyW

shell32

SHCreateDirectoryExW ShellExecuteExW ShellExecuteW Shell_NotifyIconW SHGetSpecialFolderPathW

ole32

CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoCreateGuid CreateStreamOnHGlobal CoInitialize CoUninitialize CoTaskMemRealloc

oleaut32

SysStringLen SysAllocStringLen SysFreeString VarUI4FromStr

shlwapi

PathIsRelativeW PathIsRootW SHCreateStreamOnFileEx ord158 StrToInt64ExW SHSetValueW SHGetValueW PathRemoveFileSpecW PathFileExistsW PathCombineW PathAppendW PathIsDirectoryW PathFindFileNameW StrCmpNIW StrTrimA StrStrIW StrStrIA StrCmpIW

comctl32

InitCommonControlsEx

gdiplus

GdiplusShutdown GdiplusStartup

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpSetCredentials WinHttpOpen WinHttpCloseHandle

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

3a4db1857d3436983584cf82a296bd35d90fdd67830d93fc3f63b797c09beb1c

version

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

winhttp

iphlpapi

generic