4d60387f9661662726d6b7ac2d6b3e5e3efba45e460b916266c6583a3cd2afd5

Sharing

Copy URL Twitter E-mail

General

Target
4d60387f9661662726d6b7ac2d6b3e5e3efba45e460b916266c6583a3cd2afd5
Size 850KB
Sample260821-mzfjtaba39
SHA256 4d60387f9661662726d6b7ac2d6b3e5e3efba45e460b916266c6583a3cd2afd5
MD5 98954a53b927e2d920ed6073fe7d3499
SHA1 b77b3c564d58d89fcdec4e899537f675d7fba0a5
SHA512 fbe0d0a28e409cf6ac3703c991e5284eaa89202b29f344b1d437bd591d1311b439275ff1734abe7acd7f052138b295ffa0e199a22b745fae637fd7fb766b3d55
SSDEEP 12288:enjCymRYD6aYgpRsrVAfNuuIm7MZyQ8BqcvPDVcj89biBFq27UbXe+/:ejCyqG80Q8BqQbWG1
TLSH
T1D4059D213541C03AD5B250F5CDBCEF6A915EFD351B2548E76BE47B2A1A340E31E32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d60387f9661662726d6b7ac2d6b3e5e3efba45e460b916266c6583a3cd2afd5

File Explorer

4d60387f9661662726d6b7ac2d6b3e5e3efba45e460b916266c6583a3cd2afd5

.exe 850KB

4d60387f9661662726d6b7ac2d6b3e5e3efba45e460b916266c6583a3cd2afd5

IMPHASH 4f4f12cffb8ae659a1df87013bfbb3de
SHA256 4d60387f9661662726d6b7ac2d6b3e5e3efba45e460b916266c6583a3cd2afd5
MD5 98954a53b927e2d920ed6073fe7d3499
SHA1 b77b3c564d58d89fcdec4e899537f675d7fba0a5
SHA512 fbe0d0a28e409cf6ac3703c991e5284eaa89202b29f344b1d437bd591d1311b439275ff1734abe7acd7f052138b295ffa0e199a22b745fae637fd7fb766b3d55
SSDEEP 12288:enjCymRYD6aYgpRsrVAfNuuIm7MZyQ8BqcvPDVcj89biBFq27UbXe+/:ejCyqG80Q8BqQbWG1
TLSH
T1D4059D213541C03AD5B250F5CDBCEF6A915EFD351B2548E76BE47B2A1A340E31E32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

271959

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\clean_master\fresh_home\xing_ju_shi_dai\surf_guard\tray\Release\SurfGuardTray.pdb

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

kernel32

DeleteCriticalSection WaitForSingleObject GetCurrentProcessId GetCurrentThreadId FindResourceExW GetModuleFileNameW GetProcAddress LoadResource LockResource SizeofResource LoadLibraryW FindResourceW MultiByteToWideChar GetFileAttributesW FreeLibrary SetEvent CreateEventW GetLocalTime WaitForMultipleObjects WideCharToMultiByte GetCurrentProcess GetModuleHandleW GetPrivateProfileStringW CopyFileW DeleteAtom AddAtomW FindAtomW WritePrivateProfileStringW CreateProcessW GetStartupInfoW InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection HeapSetInformation GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetErrorMode SetLastError lstrcmpA DeviceIoControl Sleep CreateThread SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW WriteConsoleW ReadConsoleW SetEndOfFile SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP GetStdHandle GetModuleHandleExW ExitProcess GetTimeZoneInformation GetConsoleMode GetLastError SetUnhandledExceptionFilter GetConsoleCP SetFilePointerEx GetFileType RaiseException CloseHandle DecodePointer ExitThread FreeLibraryAndExitThread LoadLibraryExA IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree DeleteFileW GetStringTypeW FormatMessageW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ReleaseMutex CreateMutexW LocalFree GetCommandLineW CreateFileMappingW MapViewOfFileEx UnmapViewOfFile LoadLibraryExW lstrcmpiW CreateFileW FindClose FindFirstFileW FindNextFileW GetFileSizeEx ReadFile WriteFile UnhandledExceptionFilter TerminateProcess GetTickCount64 FlushFileBuffers RtlUnwind

user32

DestroyMenu CreatePopupMenu IsWindow GetWindowLongW KillTimer TrackPopupMenu ShowWindow SetForegroundWindow CallWindowProcW PostQuitMessage DefWindowProcW wsprintfW SendMessageW SendMessageTimeoutW CharNextW PostMessageW LoadCursorW SetWindowLongW CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW PeekMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW GetCursorPos GetParent LoadIconW AppendMenuW DestroyWindow SetTimer PostThreadMessageW

shell32

Shell_NotifyIconW ShellExecuteExW SHCreateDirectoryExW SHGetSpecialFolderPathW

ole32

CoInitialize CoUninitialize CoTaskMemRealloc CoCreateGuid CoTaskMemAlloc CoTaskMemFree CoCreateInstance

oleaut32

VarUI4FromStr SysStringLen SysAllocStringLen SysFreeString

shlwapi

PathAppendW StrTrimA StrStrIA PathFindFileNameW PathCombineW PathFileExistsW StrCmpNIW StrCmpIW PathIsDirectoryW PathRemoveFileSpecW PathIsRelativeW StrStrIW PathIsRootW

comctl32

InitCommonControlsEx

gdiplus

GdiplusStartup GdiplusShutdown

iphlpapi

GetAdaptersInfo

advapi32

GetTokenInformation RegQueryValueExW OpenProcessToken RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegOpenKeyExW RegGetValueW

Sharing

General

Malware Config

Signatures

File Explorer

4d60387f9661662726d6b7ac2d6b3e5e3efba45e460b916266c6583a3cd2afd5

version

kernel32

user32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

iphlpapi

advapi32

generic