d1152f9fb5034866f923f5b6299a3f38196d95444a0a0eb3ac4fbe62d67a11ac

Sharing

Copy URL Twitter E-mail

General

Target
d1152f9fb5034866f923f5b6299a3f38196d95444a0a0eb3ac4fbe62d67a11ac
Size 662KB
Sample260821-mxmkcaba34
SHA256 d1152f9fb5034866f923f5b6299a3f38196d95444a0a0eb3ac4fbe62d67a11ac
MD5 8c8ea2db78a0b166cc340bf1f6668cf0
SHA1 be3beea6cd8f3eb2e64ada472887394954bd160d
SHA512 f00e6d9ac1f1dc0e03847ae1ee6aebd261b1d3dfb62a64fc6b75d4e2216ea2a29b4741a5a3843eccff72918a289fd399aed7a76d5a5a0d073e4fdfd0d3bee408
SSDEEP 12288:yfnHcqboSUBgevDX1Vh4ACNoVA4sVqxUXdX90EmIdj89biBFq27Ub1FYg:yfH3FUBpZmzMxUXJff
TLSH
T1C3E4AE543951D032D863A1F5CDBCDA5A516DBD301B2218EB73F4B72A1A344E36E32A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1152f9fb5034866f923f5b6299a3f38196d95444a0a0eb3ac4fbe62d67a11ac

File Explorer

d1152f9fb5034866f923f5b6299a3f38196d95444a0a0eb3ac4fbe62d67a11ac

.exe 662KB

d1152f9fb5034866f923f5b6299a3f38196d95444a0a0eb3ac4fbe62d67a11ac

IMPHASH ea0c3c86540e1e345e4ec25219fc3be4
SHA256 d1152f9fb5034866f923f5b6299a3f38196d95444a0a0eb3ac4fbe62d67a11ac
MD5 8c8ea2db78a0b166cc340bf1f6668cf0
SHA1 be3beea6cd8f3eb2e64ada472887394954bd160d
SHA512 f00e6d9ac1f1dc0e03847ae1ee6aebd261b1d3dfb62a64fc6b75d4e2216ea2a29b4741a5a3843eccff72918a289fd399aed7a76d5a5a0d073e4fdfd0d3bee408
SSDEEP 12288:yfnHcqboSUBgevDX1Vh4ACNoVA4sVqxUXdX90EmIdj89biBFq27Ub1FYg:yfH3FUBpZmzMxUXJff
TLSH
T1C3E4AE543951D032D863A1F5CDBCDA5A516DBD301B2218EB73F4B72A1A344E36E32A3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

236903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\clean_master\fresh_home\xing_ju_shi_dai\surf_guard\tray\Release\SurfGuardTray.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

HeapSetInformation InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject GetCurrentProcessId GetCurrentThreadId FindResourceExW GetModuleFileNameW GetProcAddress LoadResource LockResource SizeofResource LoadLibraryW FindResourceW MultiByteToWideChar GetFileAttributesW FreeLibrary GetLocalTime WideCharToMultiByte GetCurrentProcess GetModuleHandleW GetPrivateProfileStringW CopyFileW DeleteAtom AddAtomW FindAtomW WritePrivateProfileStringW CreateProcessW GetStartupInfoW GetProcessHeap GetConsoleMode GetConsoleCP SetFilePointerEx HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetErrorMode SetLastError GetLastError SetUnhandledExceptionFilter RaiseException SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW WriteConsoleW ReadConsoleW SetEndOfFile SetStdHandle GetFileType GetStdHandle DeleteFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale RtlUnwind FlushFileBuffers TerminateProcess UnhandledExceptionFilter WriteFile CloseHandle DecodePointer GetACP ExitProcess GetModuleHandleExW GetTimeZoneInformation EncodePointer IsDebuggerPresent OutputDebugStringW ReadFile InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetStringTypeW FormatMessageW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ReleaseMutex CreateMutexW LocalFree GetCommandLineW CreateFileMappingW MapViewOfFileEx UnmapViewOfFile LoadLibraryExW lstrcmpiW CreateFileW FindClose FindNextFileW GetFileSizeEx

user32

UnregisterClassW PeekMessageW SendMessageTimeoutW RegisterWindowMessageW GetMessageW TranslateMessage RegisterClassExW LoadIconW GetParent GetCursorPos SetForegroundWindow TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu IsWindow GetWindowLongW KillTimer SetTimer ShowWindow DestroyWindow CallWindowProcW PostQuitMessage wsprintfW GetClassInfoExW CharNextW DefWindowProcW PostMessageW LoadCursorW SetWindowLongW CreateWindowExW DispatchMessageW

shell32

ShellExecuteExW Shell_NotifyIconW SHCreateDirectoryExW

ole32

CoInitialize CoTaskMemAlloc CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathAppendW PathCombineW PathFileExistsW StrStrIW PathRemoveFileSpecW PathIsDirectoryW

comctl32

InitCommonControlsEx

gdiplus

GdiplusShutdown GdiplusStartup

advapi32

RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCloseKey RegOpenKeyExW RegCreateKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

d1152f9fb5034866f923f5b6299a3f38196d95444a0a0eb3ac4fbe62d67a11ac

version

kernel32

user32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

advapi32

generic