3dc5d2a5c06d8b338b83e44400d41460a7ef3f8110a82e9c7095dd590ad59057

Sharing

Copy URL Twitter E-mail

General

Target
3dc5d2a5c06d8b338b83e44400d41460a7ef3f8110a82e9c7095dd590ad59057
Size 4.9MB
Sample260926-we3chsycrd
SHA256 3dc5d2a5c06d8b338b83e44400d41460a7ef3f8110a82e9c7095dd590ad59057
MD5 7a466e67f668d998cf2ecfdc1ff7a23d
SHA1 0c5aa55b25b22da2a9ba99ad20cd146709d12069
SHA512 7ff54e2fd4011a54939689d021522c810139eb5494c60ff537d4f9306c34710eb9026f7a5a872c9b4522df8a65e6d443a00ae1d08a0b1d7a37b36cb5bbb8bbf0
SSDEEP 98304:JXibGN9UCZIu+/7wFPUw0K3MN1Rs4Ud2SmBad7e0UMkC504qI6/El:cbGNLw/EFP173MJsHd2SmBavUJI6/q
TLSH
T17D36BE32BA41C036F59E02B2A97E9B7F893DAA300735C4D793D41A5E5D305C22B3A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3dc5d2a5c06d8b338b83e44400d41460a7ef3f8110a82e9c7095dd590ad59057

File Explorer

3dc5d2a5c06d8b338b83e44400d41460a7ef3f8110a82e9c7095dd590ad59057

.dll 4.9MB

3dc5d2a5c06d8b338b83e44400d41460a7ef3f8110a82e9c7095dd590ad59057

IMPHASH ac02a7daa8344d50ad4493c4e8b7d2e5
SHA256 3dc5d2a5c06d8b338b83e44400d41460a7ef3f8110a82e9c7095dd590ad59057
MD5 7a466e67f668d998cf2ecfdc1ff7a23d
SHA1 0c5aa55b25b22da2a9ba99ad20cd146709d12069
SHA512 7ff54e2fd4011a54939689d021522c810139eb5494c60ff537d4f9306c34710eb9026f7a5a872c9b4522df8a65e6d443a00ae1d08a0b1d7a37b36cb5bbb8bbf0
SSDEEP 98304:JXibGN9UCZIu+/7wFPUw0K3MN1Rs4Ud2SmBad7e0UMkC504qI6/El:cbGNLw/EFP173MJsHd2SmBavUJI6/q
TLSH
T17D36BE32BA41C036F59E02B2A97E9B7F893DAA300735C4D793D41A5E5D305C22B3A75B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3454753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\WorkSpace\VS_Project\qqpcmgr_proj\Basic\Output\BinFinal\QMFileSearchCoreMT.pdb

ws2_32

send htonl htons WSAGetLastError WSACleanup recv WSASetLastError closesocket

kernel32

HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceExW FindResourceW GetTickCount64 SetEvent CreateEventW WaitForSingleObject ResetEvent DeviceIoControl SetFilePointer IsBadReadPtr InitializeCriticalSection UnhandledExceptionFilter DeleteFileW ReleaseMutex OpenSemaphoreW ReleaseSemaphore WaitForSingleObjectEx DebugBreak FormatMessageW GetCurrentThreadId GetModuleHandleExW GetModuleFileNameA GetModuleHandleW GetProcAddress IsDebuggerPresent OutputDebugStringW GetLogicalDriveStringsA GetDriveTypeA GetVolumeInformationA CreateFileA GetCurrentProcessId CreateMutexExW CreateSemaphoreExW GetFileInformationByHandle GetModuleFileNameW CreateProcessW WritePrivateProfileStringW GetPrivateProfileIntW GetPrivateProfileStringW GetFileAttributesW OpenMutexW MultiByteToWideChar CreateFileMappingW MapViewOfFile FlushFileBuffers MoveFileExW GetFileSizeEx UnmapViewOfFile ExpandEnvironmentStringsW GetFullPathNameW CreateDirectoryW GetLocalTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindFirstFileW FindNextFileW FindClose GetWindowsDirectoryW GetFileAttributesExW SetFilePointerEx GetDiskFreeSpaceExA GetTempPathW CopyFileW RemoveDirectoryW Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WaitForMultipleObjectsEx WaitForMultipleObjects GetLongPathNameW lstrcpynW GetFileAttributesA GetCurrentProcess ResumeThread GetCurrentThread GetThreadTimes CreateHardLinkW GetSystemInfo CreateFileMappingA GetTickCount QueryPerformanceCounter FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime LockFileEx LocalFree UnlockFile HeapCompact LoadLibraryW DeleteFileA LoadLibraryA FlushViewOfFile GetDiskFreeSpaceA GetTempPathA HeapValidate HeapDestroy UnlockFileEx GetFullPathNameA LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI TryEnterCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue SleepConditionVariableSRW GetStdHandle GetEnvironmentVariableW GetFileType DeleteFiber TerminateProcess ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency GetCurrentDirectoryW SwitchToThread GetCommandLineW ProcessIdToSessionId GetVersionExW GetACP lstrlenW MapViewOfFileEx GetSystemDefaultLangID GetNativeSystemInfo VirtualQuery GetSystemPowerStatus GetCPInfo OpenProcess lstrcmpiW GetDateFormatW GetTimeFormatW GetExitCodeThread GetDriveTypeW ExitThread ExitProcess RtlUnwind VirtualFree VirtualProtect VirtualAlloc CreateTimerQueue RaiseException DecodePointer LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionEx Sleep SetLastError GetLastError SetEndOfFile WriteFile CloseHandle ReadFile GetFileSize CreateFileW PeekNamedPipe SetStdHandle SetConsoleCtrlHandler SetEnvironmentVariableW GetConsoleOutputCP CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW UnregisterWaitEx DuplicateHandle UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait GetModuleHandleA FreeLibraryAndExitThread QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList LoadLibraryExW InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter CompareStringEx LCMapStringEx EncodePointer CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer GetCurrentProcessorNumber FlushProcessWriteBuffers CreateEventExW InitOnceExecuteOnce IsProcessorFeaturePresent CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns FreeEnvironmentStringsW WriteConsoleW GetStringTypeW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS CreateMutexW TlsFree InitOnceComplete InitOnceBeginInitialize InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared FindFirstFileExW SetFileInformationByHandle

user32

PeekMessageW DispatchMessageW GetProcessWindowStation GetUserObjectInformationW MessageBoxW MsgWaitForMultipleObjects

advapi32

RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW DeregisterEventSource RegSetKeySecurity RegGetKeySecurity RegNotifyChangeKeyValue RegEnumValueW RegFlushKey RegDeleteValueW RegCloseKey ReportEventW RegisterEventSourceW

shell32

SHGetDesktopFolder SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoInitialize CoSetProxyBlanket StringFromGUID2 CoUninitialize CoInitializeEx CoInitializeSecurity CoCreateInstance CoTaskMemFree

oleaut32

SysAllocString VariantClear SysFreeString

shlwapi

PathFindExtensionW PathFileExistsW PathRemoveFileSpecW SHGetValueW wnsprintfW StrRetToStrW PathRemoveBackslashW PathIsRelativeW PathIsRootW PathFindFileNameW PathAppendW PathAddBackslashW StrStrIW SHCreateStreamOnFileEx

msi

ord173 ord217 ord70

bcrypt

BCryptGenRandom

psapi

GetModuleBaseNameW EnumProcessModules EnumProcesses GetProcessMemoryInfo GetModuleFileNameExW

generic

count=25, id=259, version=30795,

count=213, id=261, version=30795,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=253, version=28518,

count=18, id=260, version=30034,

count=27, id=259, version=30034,

count=160, id=261, version=30034,

count=2, id=253, version=23601,

count=28, id=260, version=30795,

count=1, id=262, version=30795,

count=3, id=203, version=65501,

count=40, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=20, id=257, version=30795,

count=21, productName=Unmarked objects (old),

count=489, id=260, version=31332,

count=94, id=260, version=30154,

count=245, id=261, version=30154,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=406, id=1, productName=Unmarked objects,

count=121, id=265, version=30154,

count=1, id=256, version=30154,

count=1, id=255, version=30154,

count=1, id=151,

count=1, id=258, version=30154,