28e3e5c7aea8238bf886c574e5bd064b39d67b1117607b2d102ed6f75ef8a9b8

Sharing

Copy URL Twitter E-mail

General

Target
28e3e5c7aea8238bf886c574e5bd064b39d67b1117607b2d102ed6f75ef8a9b8
Size 1.6MB
Sample260916-klcvnavzht
SHA256 28e3e5c7aea8238bf886c574e5bd064b39d67b1117607b2d102ed6f75ef8a9b8
MD5 9b4e74ffe051b5ba2b8e50d478c53adc
SHA1 3aa68d19435d14f38445fb94b849c0e4c17e81ca
SHA512 26e5be3884449079ce0b311ad46085567274c6ad3af2bf210a21998e1ec48fe6671d13c3e00029cc8c42cc57b0f96ceab2d94631892ae148b824a8c8406b415b
SSDEEP 49152:zC6sgixdOKjU0co6OTMSq20eGaPcoWvrWNtmr7e:zC6mxdOKjD6IMz203f
TLSH
T10E85AF13B9808032E9EA0272D27A6F7A4D7EE934136D81E7A7D0289D5D705D2B73E353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28e3e5c7aea8238bf886c574e5bd064b39d67b1117607b2d102ed6f75ef8a9b8

File Explorer

28e3e5c7aea8238bf886c574e5bd064b39d67b1117607b2d102ed6f75ef8a9b8

.dll 1.6MB

28e3e5c7aea8238bf886c574e5bd064b39d67b1117607b2d102ed6f75ef8a9b8

IMPHASH 81857dbcbd88cf2c1e04148d0803cb16
SHA256 28e3e5c7aea8238bf886c574e5bd064b39d67b1117607b2d102ed6f75ef8a9b8
MD5 9b4e74ffe051b5ba2b8e50d478c53adc
SHA1 3aa68d19435d14f38445fb94b849c0e4c17e81ca
SHA512 26e5be3884449079ce0b311ad46085567274c6ad3af2bf210a21998e1ec48fe6671d13c3e00029cc8c42cc57b0f96ceab2d94631892ae148b824a8c8406b415b
SSDEEP 49152:zC6sgixdOKjU0co6OTMSq20eGaPcoWvrWNtmr7e:zC6mxdOKjD6IMz203f
TLSH
T10E85AF13B9808032E9EA0272D27A6F7A4D7EE934136D81E7A7D0289D5D705D2B73E353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

388308

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\buildbot\build1\kugou_installer\build\Release\isx.pdb

kernel32

GetCurrentProcess MultiByteToWideChar WideCharToMultiByte lstrlenA SetFilePointer CreatePipe SetHandleInformation SetLastError CreateProcessW WaitForSingleObject GetExitCodeProcess GetTickCount PeekNamedPipe Sleep CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId OpenProcess TerminateProcess InterlockedDecrement GetPrivateProfileSectionW GetPrivateProfileSectionNamesW FindFirstFileW FindNextFileW FindClose GetLogicalDriveStringsW GetDriveTypeW RemoveDirectoryW WaitForMultipleObjects GetModuleFileNameW MoveFileW LoadLibraryExW EnumResourceNamesW FindResourceW SizeofResource LoadResource LockResource GetDiskFreeSpaceW GetProcessAffinityMask SetProcessAffinityMask LocalAlloc LocalFree SetEvent SetCurrentDirectoryW GetCommandLineW CreateEventW OpenFileMappingW OpenEventW GetFileAttributesW GetTimeZoneInformation GetNativeSystemInfo VerLanguageNameW GetFileSizeEx GetSystemInfo GetProcAddress GetModuleHandleW GetPrivateProfileIntW GetLocalTime GetPrivateProfileStringW lstrcatW GetCurrentThreadId GetVersionExW lstrcmpiW GlobalAlloc lstrcpynW SetConsoleMode ReadConsoleInputA FlushConsoleInputBuffer GetVersionExA GlobalMemoryStatus SetEndOfFile GetCurrentDirectoryW GetFullPathNameW SetEnvironmentVariableA WriteConsoleW GlobalFree FreeLibrary LoadLibraryW DeleteFileW DeviceIoControl UnmapViewOfFile MapViewOfFile CreateFileMappingW lstrcpyW GetLastError CreateThread WriteFile CreateDirectoryW ReadFile CloseHandle GetFileSize CreateFileW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount SetConsoleCtrlHandler SystemTimeToTzSpecificLocalTime FindFirstFileExW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetModuleFileNameA FlushFileBuffers GetConsoleCP ReadConsoleW GetConsoleMode VirtualProtect VirtualFree VirtualAlloc UnregisterWaitEx InitializeSListHead ReleaseSemaphore QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList HeapSize AreFileApisANSI GetModuleHandleExW ExitProcess GetOEMCP GetACP IsValidCodePage GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID GetSystemDefaultLangID lstrlenW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx CreateTimerQueue CreateSemaphoreW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind RaiseException ExitThread FileTimeToSystemTime GetFileInformationByHandle FileTimeToLocalFileTime SetFilePointerEx HeapAlloc GetCommandLineA IsProcessorFeaturePresent IsDebuggerPresent GetCPInfo GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes OutputDebugStringW HeapReAlloc SleepEx InitializeCriticalSection GetStdHandle LoadLibraryA GetFileType ExpandEnvironmentStringsA FormatMessageA InterlockedIncrement GetStringTypeW DuplicateHandle GetCurrentThread GetExitCodeThread EncodePointer DecodePointer GetSystemTimeAsFileTime HeapFree

user32

GetDesktopWindow GetWindowThreadProcessId SetForegroundWindow SystemParametersInfoW GetSystemMetrics MsgWaitForMultipleObjects GetDC ReleaseDC MessageBoxA UnhookWindowsHookEx CallNextHookEx SendMessageW GetDlgItem GetClassNameW SetWindowsHookExW wsprintfW PeekMessageW TranslateMessage GetUserObjectInformationW BringWindowToTop AttachThreadInput GetForegroundWindow FindWindowExW DestroyMenu CreatePopupMenu LoadStringW AllowSetForegroundWindow GetProcessWindowStation DispatchMessageW PostMessageW CharNextW

gdi32

GetDeviceCaps

advapi32

RegQueryInfoKeyW CloseServiceHandle QueryServiceStatus OpenServiceW OpenSCManagerW EqualSid GetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCreateKeyExW AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW RegSetValueExW RegDeleteValueW RegEnumValueW ReportEventA RegQueryValueExW RegCloseKey RegOpenKeyExW RegisterEventSourceA DeregisterEventSource

shell32

SHGetDesktopFolder SHGetSpecialFolderPathW SHCreateDirectoryExW CommandLineToArgvW ShellExecuteExW SHChangeNotify SHGetSpecialFolderLocation

ole32

CoCreateGuid CoUninitialize CoInitialize CoCreateInstance CoTaskMemFree PropVariantClear

oleaut32

VariantInit VariantClear SysAllocString SysFreeString

shlwapi

PathFileExistsW PathIsDirectoryEmptyW ord176 PathFindExtensionW PathRemoveFileSpecW PathAppendW PathIsDirectoryW SHStrDupW PathFindFileNameW StrToIntW PathCombineW

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ws2_32

ntohs htons WSAGetLastError connect getpeername getsockname sendto recvfrom accept listen __WSAFDIsSet select ioctlsocket freeaddrinfo getaddrinfo gethostname setsockopt recv bind socket WSASetLastError closesocket getsockopt WSAStartup WSACleanup shutdown send

wldap32

ord46 ord30 ord211 ord301 ord27 ord33 ord60 ord26 ord41 ord143 ord50 ord22 ord35 ord32 ord200 ord79

generic

count=7, id=199, version=41118,

count=38, id=223, productName=VS2013 build 21005, version=21005,

count=4, id=225, version=20806,

count=133, id=225, productName=VS2013 build 21005, version=21005,

count=262, id=224, productName=VS2013 build 21005, version=21005,

count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,

count=483, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=346, id=1, productName=Unmarked objects,

count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=107, id=229, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,