3de7cf366c678e931d00acbe342463397d1e5e72316083659e3fc605c119d84c

Sharing

Copy URL Twitter E-mail

General

Target
3de7cf366c678e931d00acbe342463397d1e5e72316083659e3fc605c119d84c
Size 4.8MB
Sample260926-yjat6sstdt
SHA256 3de7cf366c678e931d00acbe342463397d1e5e72316083659e3fc605c119d84c
MD5 35b71092d9db791a40fa55610d71beaf
SHA1 0a4e01d0d65a45c4dc7923819f8189bbe5252b62
SHA512 d9556341a7f844610dd37d46f15ff71306d94a452523b855aca8d8a65da93b1352dd55b7a8b00e5d010e4fecded6569b0a9468b5fcf6a88d8fe8efca1c56e78d
SSDEEP 98304:0bHDkS9lcKdpBwZHExkQb8+ho9eZkqC2I7wpru/kkYQWMHDo9CRnpUG78GpJ7:0bHDkS9KUIE+GyMCwpru2VMUIlCG78Gr
TLSH
T12D362322B8A58032D2B207315A3CE56921F9BF366B3555CBB3C41E2D0DB45C2AF3576B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3de7cf366c678e931d00acbe342463397d1e5e72316083659e3fc605c119d84c

File Explorer

3de7cf366c678e931d00acbe342463397d1e5e72316083659e3fc605c119d84c

.exe 4.8MB

3de7cf366c678e931d00acbe342463397d1e5e72316083659e3fc605c119d84c

IMPHASH 05f4cde488a0552ae873fd8a9509d8a6
SHA256 3de7cf366c678e931d00acbe342463397d1e5e72316083659e3fc605c119d84c
MD5 35b71092d9db791a40fa55610d71beaf
SHA1 0a4e01d0d65a45c4dc7923819f8189bbe5252b62
SHA512 d9556341a7f844610dd37d46f15ff71306d94a452523b855aca8d8a65da93b1352dd55b7a8b00e5d010e4fecded6569b0a9468b5fcf6a88d8fe8efca1c56e78d
SSDEEP 98304:0bHDkS9lcKdpBwZHExkQb8+ho9eZkqC2I7wpru/kkYQWMHDo9CRnpUG78GpJ7:0bHDkS9KUIE+GyMCwpru2VMUIlCG78Gr
TLSH
T12D362322B8A58032D2B207315A3CE56921F9BF366B3555CBB3C41E2D0DB45C2AF3576B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

420557

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\jenkins\workspace\PC-优品股票通Hummer-install\misc\output\bin\Install_Offline_r.pdb

kernel32

LocalFree DeleteCriticalSection DecodePointer RaiseException InitializeCriticalSectionAndSpinCount FindResourceExW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetVersionExW GetPrivateProfileStringW DeleteFileW CopyFileW FreeResource LockResource GetTickCount SizeofResource LoadResource FindResourceW WritePrivateProfileStringW lstrcpyW TerminateThread WaitForSingleObject GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDriveStringsW GetLogicalDrives GetModuleFileNameW WriteFile GetModuleHandleW GetProcAddress CreateFileW CloseHandle GetLastError WriteConsoleW FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP CreateMutexW WideCharToMultiByte SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW GetTimeZoneInformation LCMapStringW CompareStringW GetStringTypeW GetStdHandle IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection LoadLibraryW SetCurrentDirectoryW GetCurrentDirectoryW GetFileSize ReadFile MultiByteToWideChar GetACP ExitProcess MulDiv GetCurrentProcess GetFileType SetFilePointer SetFileTime DuplicateHandle SystemTimeToFileTime DosDateTimeToFileTime CreateDirectoryW GlobalAlloc GlobalLock GlobalUnlock GetLocalTime InterlockedIncrement InterlockedDecrement Sleep GetSystemInfo FreeLibrary FindFirstFileW FindNextFileW FindClose RemoveDirectoryW CreateProcessW GlobalFree GetEnvironmentVariableA OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW TerminateProcess SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetFileAttributesW EncodePointer RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW SetLastError GetFileAttributesExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCommandLineA GetCommandLineW

user32

IsIconic GetMonitorInfoW MonitorFromWindow OffsetRect GetWindowRect SetWindowRgn GetWindowLongW SetWindowLongW SendMessageW DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW SetPropW GetPropW GetParent DestroyWindow UpdateLayeredWindow CharNextW GetFocus GetKeyState SetCapture ReleaseCapture GetDC ReleaseDC BeginPaint IsZoomed GetUpdateRect InvalidateRect CreateCaret GetCaretBlinkTime SetCaretPos IntersectRect UnionRect IsRectEmpty InflateRect CharPrevW DrawTextW FillRect SetRect MessageBoxW MoveWindow GetWindowRgn HideCaret ShowCaret GetCaretPos ClientToScreen GetSysColor MapWindowPoints SetWindowTextW GetWindowTextW GetWindowTextLengthW FindWindowW CreateAcceleratorTableW InvalidateRgn SetWindowPos GetCursorPos PostMessageW EndPaint wsprintfW PtInRect SetCursor LoadCursorW ScreenToClient GetWindow ShowWindow EnableWindow IsWindow GetMessageW GetSystemMetrics KillTimer IsWindowVisible LoadIconW TrackPopupMenu AppendMenuW CreatePopupMenu SetForegroundWindow SetFocus SetTimer PostQuitMessage DispatchMessageW TranslateMessage GetClientRect

gdi32

SelectObject SaveDC RestoreDC GetStockObject DeleteDC CreatePen DeleteObject CreateRoundRectRgn CreateFontIndirectW CreateRectRgnIndirect GetTextMetricsW GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo Rectangle RoundRect SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt CombineRgn GetObjectW CreateSolidBrush CreateDIBSection GetObjectA MoveToEx TextOutW CreateCompatibleDC CreateCompatibleBitmap BitBlt SetTextColor CreatePenIndirect GetDeviceCaps CreateRectRgn PtInRegion SetStretchBltMode

advapi32

RegOpenKeyW RegOpenKeyA RegEnumValueA RegQueryValueExA RegSetValueExA RegQueryValueExW RegCloseKey RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegDeleteValueW

shell32

SHGetSpecialFolderPathW Shell_NotifyIconW SHBrowseForFolderW SHGetPathFromIDListW SHChangeNotify ShellExecuteW SHCreateDirectoryExW SHGetSpecialFolderLocation

ole32

CoUninitialize CoInitialize CreateStreamOnHGlobal CoCreateInstance CLSIDFromString CLSIDFromProgID OleLockRunning CoCreateGuid CoTaskMemFree

shlwapi

PathFileExistsW

ws2_32

ntohs WSAStartup gethostname gethostbyname htons htonl ntohl

iphlpapi

GetAdaptersInfo

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW EnumProcessModules

imagehlp

MakeSureDirectoryPathExists

winhttp

WinHttpOpen WinHttpQueryDataAvailable WinHttpReadData WinHttpSetTimeouts WinHttpCrackUrl WinHttpConnect WinHttpQueryHeaders WinHttpCloseHandle WinHttpOpenRequest WinHttpSetOption WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpWriteData WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpSendRequest

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipDrawImageRectI GdipImageGetFrameDimensionsList GdipGetPropertyItem GdipCreateFontFromLogfontA GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipFillRectangleI GdipCreateFontFromDC GdipImageGetFrameDimensionsCount GdipDeleteFont GdipDrawString GdipMeasureString GdipStringFormatGetGenericTypographic GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameCount

Name

.text

Size

534KB

Virtual Size

533KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

320B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

78.3MB

Virtual Size

78.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=17, id=241, version=40116,

count=149, id=243, version=40116,

count=26, id=242, version=40116,

count=1, id=199, version=41118,

count=22, id=259, version=24123,

count=20, id=260, version=24123,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=40, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=50, id=261, version=24123,

count=2, id=261, version=23013,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=387, id=1, productName=Unmarked objects,

count=28, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,