e8cb602bcb8ee830e4beba5a59ffd12e92e64187dbefdf941fda773f4be6616b

Sharing

Copy URL Twitter E-mail

General

Target
e8cb602bcb8ee830e4beba5a59ffd12e92e64187dbefdf941fda773f4be6616b
Size 603KB
Sample260824-nctzcssvfs
SHA256 e8cb602bcb8ee830e4beba5a59ffd12e92e64187dbefdf941fda773f4be6616b
MD5 b19b8d90b324941f5246cf65ef52b717
SHA1 080524aacd3bb61453ed4f9e23fbb48165730fe1
SHA512 637baf1d73d813cbf7003f240863f9bc6a383179a89aa0d1224c40108a7049434b1351e10fe01fb4cbebbbb98ad841fd32bbd11c98995b811ccb8d6a89f52dd0
SSDEEP 12288:Baaq1Ng5qNig9vC6ghwuFggWni+TCHalf8P:BanTDghwieni+TCHg
TLSH
T19FD42992E223D4B5D48E21F0DE356C5081ACDC254FAF5DCF06DE396E19F50CAE632A89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e8cb602bcb8ee830e4beba5a59ffd12e92e64187dbefdf941fda773f4be6616b

File Explorer

e8cb602bcb8ee830e4beba5a59ffd12e92e64187dbefdf941fda773f4be6616b

.dll 603KB

e8cb602bcb8ee830e4beba5a59ffd12e92e64187dbefdf941fda773f4be6616b

IMPHASH 870356ecc8b76d4e58da096c015f2ae0
SHA256 e8cb602bcb8ee830e4beba5a59ffd12e92e64187dbefdf941fda773f4be6616b
MD5 b19b8d90b324941f5246cf65ef52b717
SHA1 080524aacd3bb61453ed4f9e23fbb48165730fe1
SHA512 637baf1d73d813cbf7003f240863f9bc6a383179a89aa0d1224c40108a7049434b1351e10fe01fb4cbebbbb98ad841fd32bbd11c98995b811ccb8d6a89f52dd0
SSDEEP 12288:Baaq1Ng5qNig9vC6ghwuFggWni+TCHalf8P:BanTDghwieni+TCHg
TLSH
T19FD42992E223D4B5D48E21F0DE356C5081ACDC254FAF5DCF06DE396E19F50CAE632A89
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188610

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\code\clean_master\fresh_home\li_fang_xing_qiu\cyber_shield\tray\Release\CyberShieldEngine.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

DeleteCriticalSection WaitForSingleObject GetCurrentProcessId GetCurrentThreadId FindResourceExW GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource LoadLibraryW FindResourceW MultiByteToWideChar FreeLibrary WideCharToMultiByte GetCurrentProcess GetPrivateProfileStringW CreateProcessW GetStartupInfoW DeleteFileW CreateMutexW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA InitializeCriticalSectionEx ReadConsoleW SetEndOfFile SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle GetACP GetModuleFileNameA ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetModuleHandleExW InterlockedFlushSList RtlUnwind FlushFileBuffers TerminateProcess UnhandledExceptionFilter WriteFile ReadFile FindNextFileA FindClose GetFileSizeEx CreateFileW lstrcmpiW LeaveCriticalSection EnterCriticalSection LoadLibraryExW UnmapViewOfFile InitializeCriticalSection HeapSetInformation GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetErrorMode SetLastError GetLastError SetUnhandledExceptionFilter RaiseException CloseHandle DecodePointer WriteConsoleW IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead IsProcessorFeaturePresent GetStringTypeW FormatMessageW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ReleaseMutex LocalFree GetCommandLineW

user32

DestroyWindow RegisterWindowMessageW wsprintfW CharNextW

shell32

ShellExecuteExW

ole32

CoInitialize CoUninitialize CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW StrStrIW PathRemoveFileSpecW PathAppendW PathIsDirectoryW

comctl32

InitCommonControlsEx

gdiplus

GdiplusStartup GdiplusShutdown

advapi32

RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegCloseKey RegOpenKeyExW RegCreateKeyExW RegDeleteValueW RegQueryInfoKeyW

Sharing

General

Malware Config

Signatures

File Explorer

e8cb602bcb8ee830e4beba5a59ffd12e92e64187dbefdf941fda773f4be6616b

version

kernel32

user32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

advapi32

generic