edc9d5790772894c7964f6a385285c6b5005a74a32a5b4007d9d1476a34ff2ab

Sharing

Copy URL Twitter E-mail

General

Target
edc9d5790772894c7964f6a385285c6b5005a74a32a5b4007d9d1476a34ff2ab
Size 1.3MB
Sample260909-ejvd2a1ela
SHA256 edc9d5790772894c7964f6a385285c6b5005a74a32a5b4007d9d1476a34ff2ab
MD5 b28c6ca50f88aedf1513e3af1d8b4c3c
SHA1 4deec8153e6191aaa6adfa161fcded64483017cb
SHA512 3628284e6e9a65e52ed9ace4a1e1779e242dd0325b883aa20af2ed80edf675f70256b85ee1aca3ffd1c7dfab6bf21c44f219a467df46ec04bb38cab4694f182b
SSDEEP 24576:gkFe9G+5YTb8fI45TmWPV4WsRgIeVLKjv7:gkFerJ5TmkMQVLKT
TLSH
T12255121232C2C473E6A2643256B8CB76A63DFE7A0F2069EF53C0673A1D705D09539B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edc9d5790772894c7964f6a385285c6b5005a74a32a5b4007d9d1476a34ff2ab

File Explorer

edc9d5790772894c7964f6a385285c6b5005a74a32a5b4007d9d1476a34ff2ab

.exe 1.3MB

edc9d5790772894c7964f6a385285c6b5005a74a32a5b4007d9d1476a34ff2ab

IMPHASH 032d4eb5855875c419a145e1c8c31d55
SHA256 edc9d5790772894c7964f6a385285c6b5005a74a32a5b4007d9d1476a34ff2ab
MD5 b28c6ca50f88aedf1513e3af1d8b4c3c
SHA1 4deec8153e6191aaa6adfa161fcded64483017cb
SHA512 3628284e6e9a65e52ed9ace4a1e1779e242dd0325b883aa20af2ed80edf675f70256b85ee1aca3ffd1c7dfab6bf21c44f219a467df46ec04bb38cab4694f182b
SSDEEP 24576:gkFe9G+5YTb8fI45TmWPV4WsRgIeVLKjv7:gkFerJ5TmkMQVLKT
TLSH
T12255121232C2C473E6A2643256B8CB76A63DFE7A0F2069EF53C0673A1D705D09539B5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32011

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\workspace_back\app5\pstyle\plugin\DACL\Release\QiyiDACL.pdb

kernel32

RemoveDirectoryW GetModuleFileNameW FindClose CreateFileW GetVersionExW Sleep OutputDebugStringW lstrlenW GetSystemInfo LocalFree GetModuleHandleW CopyFileW GetConsoleMode FindNextFileW SetLastError FindFirstFileW CreateDirectoryW FreeLibrary GetProcAddress LoadLibraryW DeleteFileW GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW HeapReAlloc LockResource GetLastError HeapSize InitializeCriticalSectionEx HeapFree CloseHandle SizeofResource GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WriteConsoleW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage IsDebuggerPresent RaiseException EnterCriticalSection LeaveCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileType CompareStringW LCMapStringW FindFirstFileExW

advapi32

RegCloseKey GetAclInformation GetAce EqualSid RegDeleteKeyW BuildExplicitAccessWithNameW SetEntriesInAclW RegCreateKeyExW SetNamedSecurityInfoW CopySid GetNamedSecurityInfoW RegEnumKeyExW IsValidSid RegSetValueExW AddAce InitializeAcl RegOpenKeyExW RegDeleteValueW GetLengthSid GetUserNameW RegQueryValueExW LookupAccountNameW

shell32

ShellExecuteW SHChangeNotify SHGetSpecialFolderLocation SHGetSpecialFolderPathW

ole32

CoTaskMemFree StringFromGUID2 CoUninitialize CoInitialize CoCreateInstance

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

Sharing

General

Malware Config

Signatures

File Explorer

edc9d5790772894c7964f6a385285c6b5005a74a32a5b4007d9d1476a34ff2ab

kernel32

advapi32

shell32

ole32

wtsapi32

generic