65412df0099c1de0f09c95b1cd359753536f1e8879bdd651efbed7f050c719fc

Sharing

Copy URL Twitter E-mail

General

Target
65412df0099c1de0f09c95b1cd359753536f1e8879bdd651efbed7f050c719fc
Size 2.1MB
Sample260831-m45dqssyet
SHA256 65412df0099c1de0f09c95b1cd359753536f1e8879bdd651efbed7f050c719fc
MD5 0091ea562c5cf1dab08101903ae27ca8
SHA1 7a5802af86fd15f936c81770c9e656db39127a7f
SHA512 733fea2067f079514eb525c58a9f58d6040147ddbbb57c7e72025afc3854102b276667cd6195b3642ab2c05b76e6bc3f0ad2cfa0b623b7400b8b0b868c282c36
SSDEEP 49152:H1rqh84Ry8xK30OXSM9V9sJM+CYBj8HRL4EdmlE:Jqv8CM9VCJ
TLSH
T1CEA5BE113105C1B5D6AD02F18EBDFFAE415D9D700B7444E7BAD02B6E6A308E3AF39926
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65412df0099c1de0f09c95b1cd359753536f1e8879bdd651efbed7f050c719fc

File Explorer

65412df0099c1de0f09c95b1cd359753536f1e8879bdd651efbed7f050c719fc

.dll 2.1MB

65412df0099c1de0f09c95b1cd359753536f1e8879bdd651efbed7f050c719fc

IMPHASH 8073d8eab187ca096f069d9cb86bc7fb
SHA256 65412df0099c1de0f09c95b1cd359753536f1e8879bdd651efbed7f050c719fc
MD5 0091ea562c5cf1dab08101903ae27ca8
SHA1 7a5802af86fd15f936c81770c9e656db39127a7f
SHA512 733fea2067f079514eb525c58a9f58d6040147ddbbb57c7e72025afc3854102b276667cd6195b3642ab2c05b76e6bc3f0ad2cfa0b623b7400b8b0b868c282c36
SSDEEP 49152:H1rqh84Ry8xK30OXSM9V9sJM+CYBj8HRL4EdmlE:Jqv8CM9VCJ
TLSH
T1CEA5BE113105C1B5D6AD02F18EBDFFAE415D9D700B7444E7BAD02B6E6A308E3AF39926
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

691352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

I:\code.aliyun.com\clean_master\fresh_home\realization_module\universal_guide\Build\dd-master-terminal\K2\service_guide.pdb

kernel32

GetCurrentThread ResumeThread GetThreadIOPendingFlag GlobalMemoryStatusEx GetLogicalDrives DuplicateHandle CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CancelIo CreateWaitableTimerW ReadDirectoryChangesW GetProcessTimes GetPriorityClass GetSystemTimes K32GetModuleFileNameExW K32GetProcessMemoryInfo GetModuleFileNameW SetLastError GetCurrentThreadId GetTickCount64 GetFileTime QueryDosDeviceW VirtualAlloc VirtualFree LocalFree GetEnvironmentVariableW GetWindowsDirectoryW GetSystemWindowsDirectoryW SetThreadPriority SetThreadPriorityBoost GetSystemTimeAsFileTime UnregisterWaitEx RegisterWaitForSingleObject ExpandEnvironmentStringsW CopyFileW Sleep CreateProcessW TerminateProcess GetStartupInfoW CancelWaitableTimer SetWaitableTimer ResetEvent QueryPerformanceFrequency QueryPerformanceCounter Process32NextW Process32FirstW CreateToolhelp32Snapshot WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetLocalTime OpenProcess GetFileSizeEx GetDriveTypeW GetDiskFreeSpaceExW GetFileAttributesW LoadLibraryW GetProcAddress GetModuleHandleW FindResourceExW GetCurrentProcess WaitForMultipleObjects CreateEventW WaitForSingleObject SetEvent lstrcmpA DeviceIoControl WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP DeleteFileW FindResourceW SizeofResource LockResource LoadResource LoadLibraryExW FreeLibrary WideCharToMultiByte MultiByteToWideChar GetSystemDirectoryW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError GetFileType ExitThread RtlUnwind CreateTimerQueue QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcessId CreateMutexW ReleaseMutex ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait WaitForSingleObjectEx GetVersionExW OutputDebugStringA GetModuleHandleExW GetModuleHandleExA GetModuleHandleA GetNativeSystemInfo SetFilePointerEx SetFilePointer SetEndOfFile GetStdHandle LoadLibraryExA RaiseException CloseHandle DecodePointer GetFinalPathNameByHandleW FindNextFileW FindFirstFileW CreateThread FindClose CreateFileW InterlockedCompareExchange InterlockedExchange lstrcmpiW MapViewOfFileEx GetCommandLineW UnmapViewOfFile CreateFileMappingW GetTempPathW GetStringTypeW FormatMessageW TryEnterCriticalSection ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared EncodePointer InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW FlushFileBuffers ReadFile WriteFile IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent

user32

PostMessageW DefWindowProcW CallWindowProcW PeekMessageW MsgWaitForMultipleObjectsEx DispatchMessageW GetWindowPlacement TranslateMessage MonitorFromWindow ReleaseDC GetDC RegisterWindowMessageW GetIconInfo DestroyIcon UnhookWinEvent GetClassNameW DestroyWindow SetWindowLongW IsWindowVisible GetWindowRect GetWindowThreadProcessId SetWinEventHook SendMessageTimeoutW GetQueueStatus GetWindowLongW GetWindowTextW IsWindow PostQuitMessage UnregisterClassW CharLowerW CallMsgFilterW GetMessageW UnregisterPowerSettingNotification RegisterPowerSettingNotification GetForegroundWindow SystemParametersInfoW LoadCursorW KillTimer SetTimer CreateWindowExW GetClassInfoExW RegisterClassExW FindWindowW wsprintfW WaitForInputIdle CharNextW WaitMessage

gdi32

DeleteObject GetDeviceCaps GetObjectW

advapi32

RegSetValueExW RegQueryInfoKeyW RegNotifyChangeKeyValue RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle RegGetValueW GetTokenInformation RegDeleteKeyW

shell32

SHGetSpecialFolderPathW SHGetFileInfoW SHCreateDirectoryExW SHGetKnownFolderPath SHGetFolderPathW CommandLineToArgvW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoUninitialize CoCreateGuid CoInitializeEx StringFromGUID2 CoInitialize CoSetProxyBlanket CoInitializeSecurity CoTaskMemFree

oleaut32

SysAllocStringLen SysAllocString VariantClear VarUI4FromStr SysStringLen SysFreeString VariantInit

shlwapi

StrStrIW StrTrimA StrCmpNIW StrStrIA PathIsRelativeW PathAppendW PathFileExistsW PathRemoveFileSpecW wnsprintfW PathIsDirectoryW SHGetValueW PathFindFileNameW PathCombineW PathIsRootW StrCmpIW

gdiplus

GdipGetImageEncoders GdiplusStartup GdipAlloc GdipFree GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromHICON GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipGetImagePixelFormat GdipCloneImage GdipDisposeImage GdipGetImageHeight GdipGetImageWidth GdipGetImageEncodersSize GdipSaveImageToFile

powrprof

PowerGetActiveScheme

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

winmm

timeBeginPeriod timeGetTime timeEndPeriod

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

65412df0099c1de0f09c95b1cd359753536f1e8879bdd651efbed7f050c719fc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

powrprof

wininet

iphlpapi

winmm

version

urlmon

generic