d87cf1fadde02935e6e81ed65ce274d5f454cb6ff03af9d01783b290019414f6

Sharing

Copy URL Twitter E-mail

General

Target
d87cf1fadde02935e6e81ed65ce274d5f454cb6ff03af9d01783b290019414f6
Size 2.3MB
Sample260930-gylfsatarg
SHA256 d87cf1fadde02935e6e81ed65ce274d5f454cb6ff03af9d01783b290019414f6
MD5 fbd27174b8871d830df3cb0ec79fb92f
SHA1 6af0834b890ffa34bb318b4fceb5b634587c780b
SHA512 928b84182d887b74958c070c1799cdf19314c15f05331a95f46ca4f499465e61ea00b6f19b6522683d8fc2998b7922b2fa9c97ea3a1d619962380d19ba32b059
SSDEEP 49152:aIAe4FrXoK+lT/JLXHTfJ4klKXnnkkYej15VHW:mF5+HzfJ4khA15V2
TLSH
T1D7B5F022F542C032E9E100B066BDCBBB59BC6938172554E7E3D14E799A701E33B79B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d87cf1fadde02935e6e81ed65ce274d5f454cb6ff03af9d01783b290019414f6

File Explorer

d87cf1fadde02935e6e81ed65ce274d5f454cb6ff03af9d01783b290019414f6

.exe 2.3MB

d87cf1fadde02935e6e81ed65ce274d5f454cb6ff03af9d01783b290019414f6

IMPHASH 9f624221b5c0987f11d05cb7d2da48e2
SHA256 d87cf1fadde02935e6e81ed65ce274d5f454cb6ff03af9d01783b290019414f6
MD5 fbd27174b8871d830df3cb0ec79fb92f
SHA1 6af0834b890ffa34bb318b4fceb5b634587c780b
SHA512 928b84182d887b74958c070c1799cdf19314c15f05331a95f46ca4f499465e61ea00b6f19b6522683d8fc2998b7922b2fa9c97ea3a1d619962380d19ba32b059
SSDEEP 49152:aIAe4FrXoK+lT/JLXHTfJ4klKXnnkkYej15VHW:mF5+HzfJ4khA15V2
TLSH
T1D7B5F022F542C032E9E100B066BDCBBB59BC6938172554E7E3D14E799A701E33B79B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

692097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\pinyin_agent\workspace\p-e1ae94d8e66344a7989020677190c8be\src\QQPY6.x\client\Release\QQPYBugReport.pdb

kernel32

PeekNamedPipe WaitForSingleObject FindFirstFileA WaitForMultipleObjects ExpandEnvironmentStringsA FormatMessageA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW MultiByteToWideChar WideCharToMultiByte SetFilePointer GetSystemTime SetEndOfFile GetLastError GetFileTime FindFirstFileW FindNextFileW FindClose GetFileAttributesW CopyFileW GetModuleFileNameW LoadLibraryW GlobalAlloc GlobalFree FileTimeToSystemTime HeapFree GetProcessHeap GetVersionExW lstrlenA LocalAlloc HeapAlloc LocalFree QueryDosDeviceW GetLogicalDrives DeviceIoControl Sleep GetDiskFreeSpaceExW GetDriveTypeW GetSystemDirectoryW UnmapViewOfFile CreateFileMappingW SystemTimeToTzSpecificLocalTime ProcessIdToSessionId SetLastError HeapReAlloc GetTickCount lstrcatA CopyFileA CreateFileA lstrcpyA GetStringTypeW QueryPerformanceFrequency EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo RtlUnwind RaiseException LoadLibraryExW GetStdHandle ExitProcess GetModuleHandleExW GetACP GetTimeZoneInformation SetStdHandle GetFileType SetFilePointerEx GetConsoleMode ReadConsoleW WriteConsoleW CreateThread FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP HeapSize InitializeCriticalSection SleepEx VerSetConditionMask ExitThread FreeLibraryAndExitThread GetCurrentDirectoryW GetFullPathNameW FreeLibrary GetProcAddress LoadLibraryA GetModuleFileNameA GetSystemDirectoryA GetCommandLineW GetFileSize CloseHandle DeleteFileW CreateFileW WriteFile MapViewOfFileEx ReadFile GetModuleHandleA VerifyVersionInfoA GetFileAttributesExW

user32

wsprintfA IsCharAlphaNumericW GetCursorPos MonitorFromPoint GetMonitorInfoW

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW SHFileOperationW CommandLineToArgvW

wininet

InternetOpenUrlA HttpSendRequestA HttpOpenRequestA InternetOpenA InternetQueryOptionA InternetCloseHandle InternetSetOptionA InternetConnectA HttpAddRequestHeadersA

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoA GetFileVersionInfoSizeW VerQueryValueA GetFileVersionInfoSizeA

imm32

ImmDisableIME

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

advapi32

RegCloseKey RegOpenKeyExW ConvertSidToStringSidW RegQueryValueExW LookupAccountNameW SetSecurityDescriptorDacl SetSecurityDescriptorSacl CryptAcquireContextW CryptGenRandom CryptDestroyKey CryptEncrypt CryptImportKey CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext InitializeSecurityDescriptor InitializeAcl AddAccessAllowedAceEx GetLengthSid

ole32

StringFromCLSID CoTaskMemFree

ws2_32

accept listen recvfrom sendto WSAStartup ntohl htonl htons gethostname getaddrinfo WSACleanup WSAGetLastError recv send setsockopt getsockopt connect ntohs socket getsockname getpeername WSASetLastError closesocket WSAIoctl bind select __WSAFDIsSet ioctlsocket freeaddrinfo

wldap32

ord32 ord35 ord30 ord301 ord22 ord46 ord50 ord143 ord60 ord217 ord211 ord41 ord33 ord79 ord200 ord27 ord26

Sharing

General

Malware Config

Signatures

File Explorer

d87cf1fadde02935e6e81ed65ce274d5f454cb6ff03af9d01783b290019414f6

kernel32

user32

shell32

wininet

version

imm32

wtsapi32

advapi32

ole32

ws2_32

wldap32

generic