4c9f34aa8b2d0a623b94e92d2ca7c89562f04fab1977948d6c3d8722f595458f

Sharing

Copy URL Twitter E-mail

General

Target
4c9f34aa8b2d0a623b94e92d2ca7c89562f04fab1977948d6c3d8722f595458f
Size 1.8MB
Sample260827-g2cm2sysds
SHA256 4c9f34aa8b2d0a623b94e92d2ca7c89562f04fab1977948d6c3d8722f595458f
MD5 b684001864aad880c5f4b2ef1bfa1748
SHA1 da3f0611a4a0759d4f4448dd2d447625475849c2
SHA512 8044e6904c0b2364c5b07d3509a235bb693774504a6d52af30cf7bb3aed75f892cdbaba24849aa7282238d0a0fa38958881fba1b7d989cc78b011d423d900ebf
SSDEEP 49152:TJngV6ajuqwPU0BSMGsiCh8nFbvHgCThfUi9Y3Bj8HRL4aSI:o6Q3XbvHgCT1
TLSH
T11D95BF103A05C076D2AE02F18E7CEFBD916C5D344B7444D77AD06F6A9A319E3AF31A26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c9f34aa8b2d0a623b94e92d2ca7c89562f04fab1977948d6c3d8722f595458f

File Explorer

4c9f34aa8b2d0a623b94e92d2ca7c89562f04fab1977948d6c3d8722f595458f

.dll 1.8MB

4c9f34aa8b2d0a623b94e92d2ca7c89562f04fab1977948d6c3d8722f595458f

IMPHASH abc61d9eaa41f69f4c808ae3f9a69d0f
SHA256 4c9f34aa8b2d0a623b94e92d2ca7c89562f04fab1977948d6c3d8722f595458f
MD5 b684001864aad880c5f4b2ef1bfa1748
SHA1 da3f0611a4a0759d4f4448dd2d447625475849c2
SHA512 8044e6904c0b2364c5b07d3509a235bb693774504a6d52af30cf7bb3aed75f892cdbaba24849aa7282238d0a0fa38958881fba1b7d989cc78b011d423d900ebf
SSDEEP 49152:TJngV6ajuqwPU0BSMGsiCh8nFbvHgCThfUi9Y3Bj8HRL4aSI:o6Q3XbvHgCT1
TLSH
T11D95BF103A05C076D2AE02F18E7CEFBD916C5D344B7444D77AD06F6A9A319E3AF31A26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

649832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

I:\code.aliyun.com\clean_master\fresh_home\realization_module\universal_guide\Build\dd-master-b1\C1\service_guide.pdb

kernel32

GetCurrentThread ResumeThread GetThreadIOPendingFlag GlobalMemoryStatusEx GetLogicalDrives DuplicateHandle CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CancelIo CreateWaitableTimerW ReadDirectoryChangesW GetProcessTimes GetPriorityClass GetSystemTimes K32GetModuleFileNameExW K32GetProcessMemoryInfo GetModuleFileNameW SetLastError GetCurrentThreadId GetTickCount64 GetFileTime QueryDosDeviceW VirtualAlloc VirtualFree LocalFree GetEnvironmentVariableW GetWindowsDirectoryW GetSystemWindowsDirectoryW SetThreadPriority SetThreadPriorityBoost GetSystemTimeAsFileTime UnregisterWaitEx RegisterWaitForSingleObject Sleep CreateProcessW TerminateProcess GetStartupInfoW CancelWaitableTimer SetWaitableTimer ResetEvent QueryPerformanceFrequency QueryPerformanceCounter Process32NextW Process32FirstW CreateToolhelp32Snapshot WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetLocalTime OpenProcess GetFileSizeEx GetDriveTypeW GetDiskFreeSpaceExW GetFileAttributesW LoadLibraryW GetProcAddress GetModuleHandleW FindResourceExW GetCurrentProcess WaitForMultipleObjects CreateEventW WaitForSingleObject SetEvent lstrcmpA DeviceIoControl WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP DeleteFileW FindResourceW SizeofResource LockResource LoadResource LoadLibraryExW FreeLibrary WideCharToMultiByte MultiByteToWideChar GetSystemDirectoryW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError GetFileType ExitThread RtlUnwind CreateTimerQueue QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcessId CreateMutexW ReleaseMutex ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait WaitForSingleObjectEx GetVersionExW GetModuleHandleExW GetModuleHandleA SetFilePointerEx SetEndOfFile GetStdHandle LoadLibraryExA RaiseException CloseHandle DecodePointer GetFinalPathNameByHandleW FindNextFileW FindFirstFileW CreateThread FindClose CreateFileW lstrcmpiW MapViewOfFileEx GetCommandLineW UnmapViewOfFile CreateFileMappingW GetTempPathW GetStringTypeW FormatMessageW TryEnterCriticalSection ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared EncodePointer InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW FlushFileBuffers ReadFile WriteFile IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent

user32

PostMessageW DefWindowProcW CallWindowProcW PeekMessageW MsgWaitForMultipleObjectsEx DispatchMessageW GetWindowPlacement TranslateMessage MonitorFromWindow ReleaseDC GetDC RegisterWindowMessageW UnhookWinEvent GetClassNameW DestroyWindow SetWindowLongW IsWindowVisible GetWindowRect GetWindowThreadProcessId SetWinEventHook SendMessageTimeoutW GetWindowLongW GetWindowTextW IsWindow PostQuitMessage UnregisterClassW CharLowerW GetMessageW UnregisterPowerSettingNotification RegisterPowerSettingNotification GetForegroundWindow SystemParametersInfoW LoadCursorW KillTimer SetTimer CreateWindowExW GetClassInfoExW RegisterClassExW FindWindowW wsprintfW WaitForInputIdle CharNextW

gdi32

GetDeviceCaps

advapi32

RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle RegGetValueW GetTokenInformation RegDeleteKeyW

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW SHGetKnownFolderPath SHGetFolderPathW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoUninitialize CoCreateGuid StringFromGUID2 CoInitialize CoSetProxyBlanket CoInitializeSecurity CoTaskMemFree

oleaut32

SysAllocStringLen SysAllocString VariantClear VarUI4FromStr SysStringLen SysFreeString VariantInit

shlwapi

StrStrIW StrTrimA StrCmpNIW StrStrIA PathIsRelativeW PathAppendW PathFileExistsW PathRemoveFileSpecW wnsprintfW PathIsDirectoryW SHGetValueW PathFindFileNameW PathCombineW PathIsRootW StrCmpIW

gdiplus

GdiplusStartup

powrprof

PowerGetActiveScheme

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

winmm

timeGetTime

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

4c9f34aa8b2d0a623b94e92d2ca7c89562f04fab1977948d6c3d8722f595458f

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

powrprof

wininet

iphlpapi

winmm

version

urlmon

generic