ZhangWallPaperSetup[.]exe

General

Target
ZhangWallPaperSetup.exe
Size 3.8MB
Sample260916-vpd71atarc
SHA256 1f593377f3cf75b4f2cf0e0937221b62e7f67c341635b3f530b5098a3b9466f7
MD5 ac68bdbf469cf908014035c45bbd36e2
SHA1 051467db593d90da6d6624de9ad2be7e82053184
SHA512 d78b3e9d06848638f3240ae9f825e24f4737c69f5e39d300d0fbeccf6ffb5cac948478694124d49ae5cc0fe9fa2c08ece590239fecb88a2fbbb95778d49e7159
SSDEEP 98304:EHeF+roFYBzakMPYsjwKVqvgSt8haoMbtZetE+KKCn7:E1Fs0uuKa4E+W7
TLSH
T137068C31B68BC537D57A15B0692CDBAF5069BE650FB094D763D83E6E08B08C34632E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ZhangWallPaperSetup.exe

File Explorer

ZhangWallPaperSetup.exe

.exe 3.8MB

ZhangWallPaperSetup.exe

IMPHASH d25b29054fccfd62c3ed5a8a3d014883
SHA256 1f593377f3cf75b4f2cf0e0937221b62e7f67c341635b3f530b5098a3b9466f7
MD5 ac68bdbf469cf908014035c45bbd36e2
SHA1 051467db593d90da6d6624de9ad2be7e82053184
SHA512 d78b3e9d06848638f3240ae9f825e24f4737c69f5e39d300d0fbeccf6ffb5cac948478694124d49ae5cc0fe9fa2c08ece590239fecb88a2fbbb95778d49e7159
SSDEEP 98304:EHeF+roFYBzakMPYsjwKVqvgSt8haoMbtZetE+KKCn7:E1Fs0uuKa4E+W7
TLSH
T137068C31B68BC537D57A15B0692CDBAF5069BE650FB094D763D83E6E08B08C34632E27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1186773

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW GetLastError SizeofResource LockResource LoadResource FindResourceW FindResourceExW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap InterlockedDecrement InterlockedIncrement EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW SetEvent InitializeCriticalSection lstrcpynW WaitForSingleObject CreateThread GetProcAddress LoadLibraryExW DecodePointer Sleep GetDiskFreeSpaceExW GetExitCodeThread GetCurrentProcessId CreateDirectoryW FreeLibrary GetSystemDirectoryW lstrlenW GetVersionExW lstrcmpiW GetModuleHandleW LoadLibraryW GetDriveTypeW CompareStringW GetTempPathW GetSystemTime SystemTimeToFileTime GetTempFileNameW FindFirstFileW RemoveDirectoryW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW SetFileAttributesW GetFileTime CopyFileW ReadFile FindClose MultiByteToWideChar WideCharToMultiByte InterlockedExchange GetCurrentProcess GetSystemInfo WaitForMultipleObjects WriteConsoleW VirtualProtect VirtualQuery LoadLibraryExA GetShortPathNameW GetStringTypeW SetUnhandledExceptionFilter FormatMessageW GetEnvironmentVariableW GetEnvironmentStringsW LocalFree LoadLibraryA GetModuleFileNameA GetFullPathNameW GetCurrentThread SetFilePointer FlushFileBuffers SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW CreateProcessW GetExitCodeProcess GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultLangID GetWindowsDirectoryW FileTimeToSystemTime CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent MoveFileW GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetLocalTime CreateNamedPipeW ConnectNamedPipe TerminateThread LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetCPInfo LCMapStringW WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW QueryPerformanceCounter RtlUnwind QueryPerformanceFrequency GetACP ExitProcess GetModuleHandleExW GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode IsValidCodePage GetOEMCP SetFilePointerEx FindFirstFileExW GetCommandLineA FreeEnvironmentStringsW SetStdHandle ReadConsoleW

Sharing