0e6c04692de556799652d8f8fdb790b0d30d5c639a20fd17662a128aa0041917

Sharing

Copy URL Twitter E-mail

General

Target
0e6c04692de556799652d8f8fdb790b0d30d5c639a20fd17662a128aa0041917
Size 2.2MB
Sample260827-jee6rsgf49
SHA256 0e6c04692de556799652d8f8fdb790b0d30d5c639a20fd17662a128aa0041917
MD5 2470b565a1ff76dc59ad1fd6999378ac
SHA1 55b3ee005956877c7d06465d173d1ac4a4d9ceec
SHA512 9b2123c17cb11dea17e843e94a03d34c2314e282960aa0c8a05d990d1af060f2b52a7fcf4495a0075401658910bbd22a8ade5a090cf939078792d4032af006e2
SSDEEP 49152:U2Zw8V5O9CUTLUzocgXICrwr/Gl6ZDQBj8HRLhIql:rzjOg2llRrw2kI
TLSH
T1ABB5BF113246C175DA9E02F189BDEBBE815CDD740B7418C766D43FBAA9304D3AF32A26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e6c04692de556799652d8f8fdb790b0d30d5c639a20fd17662a128aa0041917

File Explorer

0e6c04692de556799652d8f8fdb790b0d30d5c639a20fd17662a128aa0041917

.dll 2.2MB

0e6c04692de556799652d8f8fdb790b0d30d5c639a20fd17662a128aa0041917

IMPHASH 572335f2005563b493d8148a876ac4dd
SHA256 0e6c04692de556799652d8f8fdb790b0d30d5c639a20fd17662a128aa0041917
MD5 2470b565a1ff76dc59ad1fd6999378ac
SHA1 55b3ee005956877c7d06465d173d1ac4a4d9ceec
SHA512 9b2123c17cb11dea17e843e94a03d34c2314e282960aa0c8a05d990d1af060f2b52a7fcf4495a0075401658910bbd22a8ade5a090cf939078792d4032af006e2
SSDEEP 49152:U2Zw8V5O9CUTLUzocgXICrwr/Gl6ZDQBj8HRLhIql:rzjOg2llRrw2kI
TLSH
T1ABB5BF113246C175DA9E02F189BDEBBE815CDD740B7418C766D43FBAA9304D3AF32A26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

753864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

I:\code.aliyun.com\clean_master\fresh_home\realization_module\universal_guide\Build\dd-master-reg\D1\service_guide.pdb

kernel32

GetCurrentThread ResumeThread GetThreadIOPendingFlag GlobalMemoryStatusEx GetLogicalDrives DuplicateHandle CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CancelIo CreateWaitableTimerW ReadDirectoryChangesW GetProcessTimes GetPriorityClass GetSystemTimes K32GetModuleFileNameExW K32GetProcessMemoryInfo GetModuleFileNameW SetLastError GetCurrentThreadId GetTickCount64 GetFileTime QueryDosDeviceW VirtualAlloc VirtualFree LocalFree GetEnvironmentVariableW GetWindowsDirectoryW GetSystemWindowsDirectoryW SetThreadPriority SetThreadPriorityBoost GetSystemTimeAsFileTime UnregisterWaitEx RegisterWaitForSingleObject ExpandEnvironmentStringsW CopyFileW Sleep CreateProcessW TerminateProcess GetStartupInfoW CancelWaitableTimer SetWaitableTimer ResetEvent QueryPerformanceFrequency QueryPerformanceCounter Process32NextW Process32FirstW CreateToolhelp32Snapshot WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetLocalTime OpenProcess GetFileSizeEx GetDriveTypeW GetDiskFreeSpaceExW GetFileAttributesW LoadLibraryW GetProcAddress GetModuleHandleW FindResourceExW GetCurrentProcess WaitForMultipleObjects CreateEventW WaitForSingleObject SetEvent lstrcmpA DeviceIoControl WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP DeleteFileW FindResourceW SizeofResource LockResource LoadResource LoadLibraryExW FreeLibrary WideCharToMultiByte MultiByteToWideChar GetSystemDirectoryW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError GetFileType ExitThread RtlUnwind CreateTimerQueue QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcessId CreateMutexW ReleaseMutex ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait WaitForSingleObjectEx GetVersionExW OutputDebugStringA GetModuleHandleExW GetModuleHandleExA GetModuleHandleA GetNativeSystemInfo SetFilePointerEx SetFilePointer SetEndOfFile GetStdHandle LoadLibraryExA RaiseException CloseHandle DecodePointer GetFinalPathNameByHandleW FindNextFileW FindFirstFileW CreateThread FindClose CreateFileW InterlockedCompareExchange InterlockedExchange lstrcmpiW MapViewOfFileEx GetCommandLineW UnmapViewOfFile CreateFileMappingW GetTempPathW GetStringTypeW FormatMessageW TryEnterCriticalSection ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared EncodePointer InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW FlushFileBuffers ReadFile WriteFile IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent

user32

PostMessageW DefWindowProcW CallWindowProcW PeekMessageW MsgWaitForMultipleObjectsEx DispatchMessageW GetWindowPlacement TranslateMessage MonitorFromWindow ReleaseDC GetDC RegisterWindowMessageW GetIconInfo DestroyIcon UnhookWinEvent GetClassNameW DestroyWindow SetWindowLongW IsWindowVisible GetWindowRect GetWindowThreadProcessId SetWinEventHook SendMessageTimeoutW GetQueueStatus GetWindowLongW GetWindowTextW IsWindow PostQuitMessage UnregisterClassW CharLowerW CallMsgFilterW GetMessageW UnregisterPowerSettingNotification RegisterPowerSettingNotification GetForegroundWindow SystemParametersInfoW LoadCursorW KillTimer SetTimer CreateWindowExW GetClassInfoExW RegisterClassExW FindWindowW wsprintfW WaitForInputIdle CharNextW WaitMessage

gdi32

DeleteObject GetDeviceCaps GetObjectW

advapi32

RegSetValueExW RegQueryInfoKeyW RegNotifyChangeKeyValue RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle RegGetValueW GetTokenInformation RegDeleteKeyW

shell32

SHGetSpecialFolderPathW SHGetFileInfoW SHCreateDirectoryExW SHGetKnownFolderPath SHGetFolderPathW CommandLineToArgvW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoUninitialize CoCreateGuid CoInitializeEx StringFromGUID2 CoInitialize CoSetProxyBlanket CoInitializeSecurity CoTaskMemFree

oleaut32

SysAllocStringLen SysAllocString VariantClear VarUI4FromStr SysStringLen SysFreeString VariantInit

shlwapi

StrStrIW StrTrimA StrCmpNIW StrStrIA PathMatchSpecW PathIsRelativeW PathAppendW PathFileExistsW PathRemoveFileSpecW wnsprintfW PathIsDirectoryW SHGetValueW PathFindFileNameW PathCombineW PathFindExtensionW PathIsRootW StrCmpIW

gdiplus

GdipGetImageEncoders GdiplusStartup GdipAlloc GdipFree GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromHICON GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipGetImagePixelFormat GdipCloneImage GdipDisposeImage GdipGetImageHeight GdipGetImageWidth GdipGetImageEncodersSize GdipSaveImageToFile

powrprof

PowerGetActiveScheme

crypt32

CertGetNameStringW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

winmm

timeBeginPeriod timeGetTime timeEndPeriod

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

0e6c04692de556799652d8f8fdb790b0d30d5c639a20fd17662a128aa0041917

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

powrprof

crypt32

wininet

iphlpapi

wintrust

winmm

version

urlmon

generic