76e15e443b6c16f985e03964d22150d1891911a6c6882b95d17789ce67487c36

Sharing

Copy URL Twitter E-mail

General

Target
76e15e443b6c16f985e03964d22150d1891911a6c6882b95d17789ce67487c36
Size 2.1MB
Sample260831-j2pcysfl8s
SHA256 76e15e443b6c16f985e03964d22150d1891911a6c6882b95d17789ce67487c36
MD5 e1054c4526f8487d35b41b43c2c4aab1
SHA1 65e8b936c0ca0859f588289f63b8ee4e09f66b02
SHA512 d6b2264156fb0e121e6532cc03b5232763e69533e89b36055ea44c8916a8c31e4e29ee359d2e7268c50340f2b06edd2c0797b2c8365023ea2ba481c9c6f8284f
SSDEEP 49152:EeGibbPfdH7HshZ3Myy7BdRKTBj8HRL57mbiQM:lG+BLshZ3VY7V
TLSH
T180A5BF113105C0B5E66D12F54ABCEFBE425C9C700B7854E77AE42B6E5A304E3BF35A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
76e15e443b6c16f985e03964d22150d1891911a6c6882b95d17789ce67487c36

File Explorer

76e15e443b6c16f985e03964d22150d1891911a6c6882b95d17789ce67487c36

.dll 2.1MB

76e15e443b6c16f985e03964d22150d1891911a6c6882b95d17789ce67487c36

IMPHASH c0d94987d334e228dad3c73e70b3b49a
SHA256 76e15e443b6c16f985e03964d22150d1891911a6c6882b95d17789ce67487c36
MD5 e1054c4526f8487d35b41b43c2c4aab1
SHA1 65e8b936c0ca0859f588289f63b8ee4e09f66b02
SHA512 d6b2264156fb0e121e6532cc03b5232763e69533e89b36055ea44c8916a8c31e4e29ee359d2e7268c50340f2b06edd2c0797b2c8365023ea2ba481c9c6f8284f
SSDEEP 49152:EeGibbPfdH7HshZ3Myy7BdRKTBj8HRL57mbiQM:lG+BLshZ3VY7V
TLSH
T180A5BF113105C0B5E66D12F54ABCEFBE425C9C700B7854E77AE42B6E5A304E3BF35A2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

696424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

I:\code.aliyun.com\clean_master\fresh_home\realization_module\universal_guide\Build\service_guide.pdb

kernel32

GetCurrentThread ResumeThread GetThreadIOPendingFlag GlobalMemoryStatusEx GetLogicalDrives DuplicateHandle CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CancelIo CreateWaitableTimerW ReadDirectoryChangesW GetProcessTimes GetPriorityClass GetSystemTimes K32GetModuleFileNameExW K32GetProcessMemoryInfo GetModuleFileNameW SetLastError GetCurrentThreadId GetTickCount64 GetFileTime QueryDosDeviceW VirtualAlloc VirtualFree LocalFree GetEnvironmentVariableW GetWindowsDirectoryW GetSystemWindowsDirectoryW SetThreadPriority SetThreadPriorityBoost GetSystemTimeAsFileTime UnregisterWaitEx RegisterWaitForSingleObject CopyFileW Sleep TerminateProcess GetStartupInfoW SetUnhandledExceptionFilter CancelWaitableTimer SetWaitableTimer ResetEvent QueryPerformanceFrequency QueryPerformanceCounter Process32NextW Process32FirstW CreateToolhelp32Snapshot WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetLocalTime OpenProcess GetFileSizeEx GetDriveTypeW GetDiskFreeSpaceExW GetFileAttributesW LoadLibraryW GetProcAddress GetModuleHandleW FindResourceExW GetCurrentProcess WaitForMultipleObjects CreateEventW WaitForSingleObject SetEvent lstrcmpA DeviceIoControl WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP GetFileType DeleteFileW FindResourceW SizeofResource LockResource LoadResource LoadLibraryExW FreeLibrary WideCharToMultiByte MultiByteToWideChar GetSystemDirectoryW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError ExitThread RtlUnwind CreateTimerQueue QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer UnhandledExceptionFilter GetCurrentProcessId CreateMutexW ReleaseMutex LoadLibraryExA CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait WaitForSingleObjectEx GetVersionExW OutputDebugStringA GetModuleHandleExW GetModuleHandleExA GetModuleHandleA GetNativeSystemInfo SetFilePointerEx SetFilePointer SetEndOfFile GetStdHandle IsProcessorFeaturePresent CreateThread RaiseException CloseHandle DecodePointer GetFinalPathNameByHandleW FindNextFileW FindFirstFileW FindClose CreateFileW InterlockedCompareExchange InterlockedExchange lstrcmpiW MapViewOfFileEx GetCommandLineW UnmapViewOfFile CreateFileMappingW GetTempPathW GetStringTypeW FormatMessageW TryEnterCriticalSection ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared EncodePointer InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW FlushFileBuffers ReadFile WriteFile IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache CreateProcessW

user32

PostQuitMessage MsgWaitForMultipleObjectsEx CharLowerW PeekMessageW TranslateMessage MonitorFromWindow ReleaseDC GetDC RegisterWindowMessageW GetIconInfo DestroyIcon UnhookWinEvent GetClassNameW EnumChildWindows GetWindowLongW GetWindowTextW PostMessageW DefWindowProcW CallWindowProcW DestroyWindow SetWindowLongW IsWindowVisible GetWindowRect GetWindowThreadProcessId SetWinEventHook SendMessageTimeoutW GetWindowPlacement IsWindow UnregisterClassW DispatchMessageW CallMsgFilterW GetMessageW UnregisterPowerSettingNotification RegisterPowerSettingNotification GetForegroundWindow WaitMessage GetClientRect SystemParametersInfoW LoadCursorW KillTimer SetTimer CreateWindowExW GetClassInfoExW RegisterClassExW FindWindowW wsprintfW WaitForInputIdle CharNextW GetQueueStatus

gdi32

DeleteObject GetDeviceCaps GetObjectW

advapi32

RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle RegGetValueW GetTokenInformation RegDeleteKeyW

shell32

SHGetFileInfoW SHGetKnownFolderPath SHCreateDirectoryExW SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoInitializeEx CoCreateGuid StringFromGUID2 CoInitialize CoSetProxyBlanket CoInitializeSecurity CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

SysAllocStringLen SysAllocString VariantClear VarUI4FromStr SysStringLen SysFreeString VariantInit

shlwapi

StrCmpIW StrStrIW PathIsRelativeW PathIsRootW StrStrIA PathAppendW StrCmpNIW PathFileExistsW PathRemoveFileSpecW wnsprintfW PathIsDirectoryW SHGetValueW PathFindFileNameW PathCombineW StrTrimA

gdiplus

GdipBitmapLockBits GdipBitmapUnlockBits GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdipAlloc GdipCreateBitmapFromHICON GdipCreateBitmapFromScan0 GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipSaveImageToFile GdipDisposeImage GdipCloneImage GdipFree GdipCreateBitmapFromHBITMAP

powrprof

PowerGetActiveScheme

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

winmm

timeBeginPeriod timeGetTime timeEndPeriod

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

76e15e443b6c16f985e03964d22150d1891911a6c6882b95d17789ce67487c36

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

powrprof

wininet

iphlpapi

winmm

version

urlmon

generic