点击安装中文语言包1[.]exe

General

Target
点击安装中文语言包1.exe
Size 464KB
Sample260913-thbymazamd
SHA256 d1ab754415972d89e5b17baca0906c3ccab59ad61eec55988688ee1daf08e122
MD5 c9e024fa97e1551e3808405b7112207e
SHA1 d4e72d60fe46c60a88d62bb28f432bc0fec497bd
SHA512 48ff16092a21181aea752a00ef38a28bf728850cac9471497b6e1ebfb8b0c32355be11710e4593b309db86756614fb89b6fc9124e74c0ef4ff4acb604a1b5458
SSDEEP 12288:/swEd6i31zmgqMDC5b0wFvApItCnheuKwgQIk2:/TDMDC5om2IA6D
TLSH
T117A4CFB2D1D0B8D7D565857C80A33A81A3F1767243385BAB32CC8EC51F2AEE54C1BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
点击安装中文语言包1.exe

File Explorer

点击安装中文语言包1.exe

.exe 464KB

点击安装中文语言包1.exe

IMPHASH 433ce1b8b47f73487b8732dfc40f9b3f
SHA256 d1ab754415972d89e5b17baca0906c3ccab59ad61eec55988688ee1daf08e122
MD5 c9e024fa97e1551e3808405b7112207e
SHA1 d4e72d60fe46c60a88d62bb28f432bc0fec497bd
SHA512 48ff16092a21181aea752a00ef38a28bf728850cac9471497b6e1ebfb8b0c32355be11710e4593b309db86756614fb89b6fc9124e74c0ef4ff4acb604a1b5458
SSDEEP 12288:/swEd6i31zmgqMDC5b0wFvApItCnheuKwgQIk2:/TDMDC5om2IA6D
TLSH
T117A4CFB2D1D0B8D7D565857C80A33A81A3F1767243385BAB32CC8EC51F2AEE54C1BD96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryW lstrlenA GetComputerNameW GetSystemPowerStatus WriteConsoleW CloseHandle FreeLibrary SetFilePointerEx GetConsoleMode GetConsoleOutputCP GetSystemInfo GetDiskFreeSpaceExW CreateFileW GetEnvironmentVariableW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers

user32

CreateWindowExW GetSystemMetrics UnregisterClassW DefWindowProcW PeekMessageW RegisterClassExW DestroyWindow

advapi32

RegCloseKey GetUserNameW RegOpenKeyExW

Name

.text

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

331KB

Virtual Size

330KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

点击安装中文语言包1.exe

kernel32

user32

advapi32

generic