6de27022bbe0ee80b6cb45d65dc5a3f57f875ce8eacc827305f594d488f2f5a2

General

Target
6de27022bbe0ee80b6cb45d65dc5a3f57f875ce8eacc827305f594d488f2f5a2
Size 942KB
Sample260905-q1cfbsdk71
SHA256 6de27022bbe0ee80b6cb45d65dc5a3f57f875ce8eacc827305f594d488f2f5a2
MD5 3eced6f1bf49fc98ce296c525eacdff7
SHA1 d2707452b7103bcf2da139a4ed1918e90eb69e5a
SHA512 b8e61a202396567ed5dec3b0b1640d314d9cf08b0f4d65d23ae5573fd5233afa8be39b50b509d08d4e47d21d6eae89a6a4fed4c576d796911a403a6842a97109
SSDEEP 12288:KbK0XT9FFLuQiWqUUtfh2Pc5f1KWkU+PrxxY3R7atxUaQnswsawZuZY2s+vq9Mr:h0XT9LuTakf1XsY7aRmsvZuZY2s+Nr
TLSH
T144256B607666D233E56181F20E78AFA6A06DAD2C0F710BCF77C42B3E45355D26E31E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6de27022bbe0ee80b6cb45d65dc5a3f57f875ce8eacc827305f594d488f2f5a2

File Explorer

6de27022bbe0ee80b6cb45d65dc5a3f57f875ce8eacc827305f594d488f2f5a2

.exe 942KB

6de27022bbe0ee80b6cb45d65dc5a3f57f875ce8eacc827305f594d488f2f5a2

IMPHASH a6dbd23a3335ac475e53cab6aaf12053
SHA256 6de27022bbe0ee80b6cb45d65dc5a3f57f875ce8eacc827305f594d488f2f5a2
MD5 3eced6f1bf49fc98ce296c525eacdff7
SHA1 d2707452b7103bcf2da139a4ed1918e90eb69e5a
SHA512 b8e61a202396567ed5dec3b0b1640d314d9cf08b0f4d65d23ae5573fd5233afa8be39b50b509d08d4e47d21d6eae89a6a4fed4c576d796911a403a6842a97109
SSDEEP 12288:KbK0XT9FFLuQiWqUUtfh2Pc5f1KWkU+PrxxY3R7atxUaQnswsawZuZY2s+vq9Mr:h0XT9LuTakf1XsY7aRmsvZuZY2s+Nr
TLSH
T144256B607666D233E56181F20E78AFA6A06DAD2C0F710BCF77C42B3E45355D26E31E26
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

499853

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_1c3c3\rc_bugfix_master_\Build\Release\WPSOffice\office6\wpscloudsvr.pdb

kernel32

SetCurrentDirectoryW FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW GetCommandLineW CloseHandle GetLastError Sleep GetCurrentProcessId TerminateProcess GetCurrentThreadId OpenProcess GetSystemDirectoryW GetSystemWow64DirectoryW GetModuleHandleW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject WaitForMultipleObjects CreateThread QueueUserWorkItem UnregisterWaitEx LocalFree GetEnvironmentVariableW SetEnvironmentVariableW GetDriveTypeW GetTempPathW GetStartupInfoW GetTickCount SetDllDirectoryW GetDllDirectoryW CopyFileW GetSystemTime SystemTimeToFileTime GetExitCodeProcess VerSetConditionMask GetCurrentProcess LocalAlloc VerifyVersionInfoW FindClose FindFirstFileW FindNextFileW SetEvent CreateEventW CreateFileW ReadFile WriteFile SetNamedPipeHandleState WaitNamedPipeW GetOverlappedResult CancelIo FlushFileBuffers ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateDirectoryW GetFileAttributesW ReadProcessMemory WideCharToMultiByte SetUnhandledExceptionFilter LoadLibraryExW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar GetFileAttributesExW SetErrorMode GetModuleHandleExW VirtualAlloc VirtualFree lstrlenW GetPrivateProfileIntW GetPrivateProfileStringW CreateProcessW ExpandEnvironmentStringsW GetLongPathNameW GetCurrentThread ProcessIdToSessionId WTSGetActiveConsoleSessionId OutputDebugStringA SetLastError QueryPerformanceCounter QueryPerformanceFrequency SetStdHandle GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetStringTypeW FindFirstFileExW SetEndOfFile SetFilePointerEx EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetCPInfo ResetEvent WaitForSingleObjectEx InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter OutputDebugStringW RtlUnwind InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree SetConsoleCtrlHandler GetStdHandle ExitProcess GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode GetFileSizeEx ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

6de27022bbe0ee80b6cb45d65dc5a3f57f875ce8eacc827305f594d488f2f5a2

kernel32

generic