05905d7a4f90df1da8bb6196c332bec310a2333695341fcb514630fa1aa62bc7

General

Target
05905d7a4f90df1da8bb6196c332bec310a2333695341fcb514630fa1aa62bc7
Size 551KB
Sample260916-hd4bjaweph
SHA256 05905d7a4f90df1da8bb6196c332bec310a2333695341fcb514630fa1aa62bc7
MD5 b3210071cccb37f32ccdcd04b7d6ebe9
SHA1 01ad8bec8a73fa93d91ce7765664a64a188aa6ac
SHA512 fe82d03b5349e2d06e5e778be1eb1170354e91780d65bd30a7f507052a59005bf3a5d16e0297c2190899d0a693161dd03460e05a82a14226b75dcf8ba7f0af93
SSDEEP 6144:kzW+itIxRMfY3XpcXpLSyYCD+2Ri8X3e2SpTyzu:DXt4MfKpgpT+SOdyzu
TLSH
T12DC41F74A9E2FA07C66AD03B14408CDB81EB2D1859E1461EC750BB1BC9B6EC0771E9F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05905d7a4f90df1da8bb6196c332bec310a2333695341fcb514630fa1aa62bc7

File Explorer

05905d7a4f90df1da8bb6196c332bec310a2333695341fcb514630fa1aa62bc7

.exe 551KB

05905d7a4f90df1da8bb6196c332bec310a2333695341fcb514630fa1aa62bc7

IMPHASH afe1090566ae01814fbb2fec62aeef02
SHA256 05905d7a4f90df1da8bb6196c332bec310a2333695341fcb514630fa1aa62bc7
MD5 b3210071cccb37f32ccdcd04b7d6ebe9
SHA1 01ad8bec8a73fa93d91ce7765664a64a188aa6ac
SHA512 fe82d03b5349e2d06e5e778be1eb1170354e91780d65bd30a7f507052a59005bf3a5d16e0297c2190899d0a693161dd03460e05a82a14226b75dcf8ba7f0af93
SSDEEP 6144:kzW+itIxRMfY3XpcXpLSyYCD+2Ri8X3e2SpTyzu:DXt4MfKpgpT+SOdyzu
TLSH
T12DC41F74A9E2FA07C66AD03B14408CDB81EB2D1859E1461EC750BB1BC9B6EC0771E9F7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

23616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\test\上课\Project1\x64\Release\上课.pdb

kernel32

VirtualAlloc GetSystemInfo GlobalMemoryStatusEx WriteConsoleW CreateFileW HeapSize EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree CloseHandle WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap RtlUnwind

user32

MessageBoxA

Name

.text

Size

133KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

227KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

05905d7a4f90df1da8bb6196c332bec310a2333695341fcb514630fa1aa62bc7

kernel32

user32

generic