5dbc9e68ffc10987ce01f5d0c169772d68cb4d7dc7e72d56c1549df736c8126d

Sharing

Copy URL Twitter E-mail

General

Target
5dbc9e68ffc10987ce01f5d0c169772d68cb4d7dc7e72d56c1549df736c8126d
Size 2.0MB
Sample260823-hkelratfle
SHA256 5dbc9e68ffc10987ce01f5d0c169772d68cb4d7dc7e72d56c1549df736c8126d
MD5 615b88f836d741fd43b222f9e916ee96
SHA1 b6a7c018b60ff47671940e1a8565958c5e07c192
SHA512 3893d80e99b8915bdf0d5108f59ee683a0441ddfce8265e7329f31085ec4e334404966cd9302978d5bd1bfdeb916126a0ec4e91367c257bf0f84ddf504cc0840
SSDEEP 49152:W2JyseEZbHSWtJTkDfU+68/oWV8zROZ/DbWDkbr:lJyseEZbHSWtJTkzUgWK+De
TLSH
T16CA5BF11BB418171E1B1023055B9AB76897D7D39BF308ACBA3D01B6DD9306E2AD35F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5dbc9e68ffc10987ce01f5d0c169772d68cb4d7dc7e72d56c1549df736c8126d

File Explorer

5dbc9e68ffc10987ce01f5d0c169772d68cb4d7dc7e72d56c1549df736c8126d

.exe 2.0MB

5dbc9e68ffc10987ce01f5d0c169772d68cb4d7dc7e72d56c1549df736c8126d

IMPHASH befaf5a7c5c508d9e294f65d7a6f4b48
SHA256 5dbc9e68ffc10987ce01f5d0c169772d68cb4d7dc7e72d56c1549df736c8126d
MD5 615b88f836d741fd43b222f9e916ee96
SHA1 b6a7c018b60ff47671940e1a8565958c5e07c192
SHA512 3893d80e99b8915bdf0d5108f59ee683a0441ddfce8265e7329f31085ec4e334404966cd9302978d5bd1bfdeb916126a0ec4e91367c257bf0f84ddf504cc0840
SSDEEP 49152:W2JyseEZbHSWtJTkDfU+68/oWV8zROZ/DbWDkbr:lJyseEZbHSWtJTkzUgWK+De
TLSH
T16CA5BF11BB418171E1B1023055B9AB76897D7D39BF308ACBA3D01B6DD9306E2AD35F3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

801915

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

I:\xhuabao_ludashi_del_cos\StatisticalSDK\StatisticalSDK\Release\promoteEngine.pdb

ws2_32

__WSAFDIsSet select gethostname WSASetLastError getaddrinfo freeaddrinfo send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ioctlsocket sendto recvfrom listen htonl accept WSACleanup WSAStartup socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind recv

wldap32

ord301 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord143 ord200

crypt32

CryptStringToBinaryA PFXImportCertStore CertAddCertificateContextToStore CryptDecodeObjectEx CertEnumCertificatesInStore CertGetNameStringA CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindExtension CertOpenStore CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CertCloseStore CryptQueryObject CertFreeCertificateContext CryptMsgClose

kernel32

GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualFree VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile UnregisterWaitEx CreateTimerQueueTimer DeleteTimerQueueTimer FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress GlobalFree LocalAlloc LocalFree SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetDateFormatW GetTimeFormatW GetStringTypeW MultiByteToWideChar WideCharToMultiByte LCMapStringW GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers SetFilePointer GetLocalTime OutputDebugStringW GetPrivateProfileIntW CreateDirectoryW SizeofResource GetCommandLineW LockResource LoadResource FindResourceW DeleteCriticalSection GetExitCodeProcess FindClose GetPrivateProfileStringW DeleteFileW GetTempFileNameW FindNextFileW GetModuleHandleA CreateToolhelp32Snapshot Process32NextW Process32FirstW lstrlenW GetFileSizeEx RemoveDirectoryW GetFileAttributesW lstrcmpW DeviceIoControl lstrcmpA lstrcmpiA WritePrivateProfileStringW InitializeCriticalSection WritePrivateProfileStructW CopyFileW SetUnhandledExceptionFilter SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetDiskFreeSpaceExW MoveFileW IsBadWritePtr TlsSetValue SetEndOfFile CancelWaitableTimer TlsAlloc TlsFree IsBadReadPtr GetProcessHeap QueryPerformanceFrequency GetSystemDirectoryA FormatMessageW MoveFileExA GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe VerSetConditionMask VerifyVersionInfoA CreateFileA IsProcessorFeaturePresent GetThreadTimes CreateProcessW GetCurrentThreadId CreateThread SwitchToThread TerminateProcess GetCurrentProcessId GetCurrentProcess CreateWaitableTimerW WaitForMultipleObjects Sleep SetWaitableTimer CreateEventW CreateMutexW WaitForSingleObjectEx SleepEx WaitForSingleObject ReleaseMutex ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapSize HeapFree HeapReAlloc HeapAlloc QueryPerformanceCounter SetLastError GetLastError RaiseException AreFileApisANSI GetTempPathW FindFirstFileW CreateFileW GetCurrentDirectoryW ExpandEnvironmentStringsW TryEnterCriticalSection TlsGetValue GetCPInfo UnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache SignalObjectAndWait SetThreadPriority GetThreadPriority ChangeTimerQueueTimer GetProcessAffinityMask GetCurrentThread FreeLibraryAndExitThread InterlockedFlushSList QueryDepthSList CreateTimerQueue RtlUnwind ExitThread GetModuleHandleExW GetDriveTypeW FileTimeToSystemTime SetFilePointerEx ExitProcess GetACP GetConsoleMode ReadConsoleW GetConsoleCP IsValidLocale GetFileAttributesExW SetStdHandle GetFullPathNameW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW GetLocaleInfoW

user32

GetMessagePos CallWindowProcW SetWindowPos SetWindowTextW RegisterClassExW ShowWindow EnumDisplayDevicesW GetAsyncKeyState LoadCursorW KillTimer GetClassInfoExW wsprintfW SendMessageTimeoutW GetForegroundWindow GetClassNameW GetWindowTextW PostThreadMessageW MessageBoxW UnregisterClassW FindWindowExA GetDesktopWindow FindWindowA GetMonitorInfoW MonitorFromWindow EnumDisplaySettingsW GetWindowThreadProcessId FindWindowExW FindWindowW SetWindowLongW GetWindowLongW WindowFromPoint GetWindowRect ReleaseDC GetDC GetSystemMetrics SetTimer CreateWindowExW PostQuitMessage DefWindowProcW PostMessageW SendMessageW GetKeyState IsWindow

gdi32

GetDeviceCaps

advapi32

RegDeleteKeyW RegOpenKeyExW RegQueryValueExW CryptGenRandom CryptAcquireContextA RegEnumKeyExW CryptDestroyHash CryptHashData CryptCreateHash CryptEncrypt CryptImportKey CryptGetHashParam CryptDestroyKey CryptReleaseContext

shell32

SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteW

shlwapi

SHGetValueW PathAppendW PathFindFileNameW PathRemoveFileSpecW PathAddBackslashW PathFileExistsW PathFindFileNameA PathCombineW StrStrIW PathIsRootW SHSetValueW SHGetValueA PathGetDriveNumberW PathRemoveBackslashW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

psapi

GetProcessImageFileNameW GetModuleFileNameExW

powrprof

CallNtPowerInformation

setupapi

SetupIterateCabinetW

winhttp

WinHttpGetIEProxyConfigForCurrentUser

netapi32

Netbios

wininet

HttpQueryInfoA InternetSetOptionW InternetConnectW InternetCloseHandle InternetGetLastResponseInfoW HttpSendRequestExW InternetReadFileExA InternetErrorDlg InternetOpenUrlW HttpAddRequestHeadersA HttpSendRequestW HttpAddRequestHeadersW InternetReadFile HttpEndRequestW InternetCrackUrlW HttpQueryInfoW FtpGetFileSize FtpCommandW HttpOpenRequestW InternetQueryOptionW InternetWriteFile InternetSetStatusCallbackW FtpOpenFileW InternetOpenW InternetSetOptionA

generic

count=21, id=241, version=40116,

count=185, id=243, version=40116,

count=30, id=242, version=40116,

count=5, id=199, version=41118,

count=28, id=259, version=26706,

count=127, id=261, version=26706,

count=38, id=260, version=26706,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=605, id=1, productName=Unmarked objects,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=112, id=260, version=27034,

count=45, id=265, version=27051,

count=1, id=261, version=35219,

count=3, id=261, version=27051,

count=1, id=256, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,