fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c

Sharing

Copy URL Twitter E-mail

General

Target
fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c
Size 2.4MB
Sample260930-kadyksyybs
SHA256 fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c
MD5 a295e87c68a408977379f2b3cb319440
SHA1 e89a7973b786d89d6831e30e83d32173da356b3b
SHA512 1be550ef2205a23c149f7f1f7fd06c9ffce4557d4b54348b22f91524d6dcba806646a3b13b5eebd984e63820d01cff20c4dde6992fdbd0c283bb9a9bd1cd40b1
SSDEEP 49152:sbA9Ptdh74+dT378IBfJ4klKXnsukYej15VHW:sbuPLy+JfJ4kyA15V2
TLSH
T10FB5F122F942C173E5E1017066BDCBB7593C6924172418E7A3D06E7AA9301D33F7AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c

File Explorer

fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c

.exe 2.4MB

fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c

IMPHASH b5e03f6da314e0269c785369ba68d66b
SHA256 fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c
MD5 a295e87c68a408977379f2b3cb319440
SHA1 e89a7973b786d89d6831e30e83d32173da356b3b
SHA512 1be550ef2205a23c149f7f1f7fd06c9ffce4557d4b54348b22f91524d6dcba806646a3b13b5eebd984e63820d01cff20c4dde6992fdbd0c283bb9a9bd1cd40b1
SSDEEP 49152:sbA9Ptdh74+dT378IBfJ4klKXnsukYej15VHW:sbuPLy+JfJ4kyA15V2
TLSH
T10FB5F122F942C173E5E1017066BDCBB7593C6924172418E7A3D06E7AA9301D33F7AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

704423

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\landun\pinyin_agent\workspace\p-e1ae94d8e66344a7989020677190c8be\src\QQPY6.x\client\Release\QQPYCloud.pdb

kernel32

Sleep GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetTickCount SetUnhandledExceptionFilter IsDebuggerPresent VirtualQuery lstrcpyW GetCurrentProcessId GetProcAddress LoadLibraryW GetCurrentThread FormatMessageW GetCurrentThreadId CreateFileW WriteFile IsBadWritePtr CreateDirectoryW GetModuleHandleW GetModuleFileNameW TerminateProcess GetCurrentProcess MapViewOfFileEx CreateFileMappingW SystemTimeToFileTime GetFileSize GetLocalTime CloseHandle GetLastError UnmapViewOfFile SetFilePointer WriteConsoleW HeapSize FlushFileBuffers GetFullPathNameW GetCurrentDirectoryW GetConsoleCP ReadConsoleW GetConsoleMode SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FreeLibraryAndExitThread ExitThread UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ReadFile SetEndOfFile GetFileTime LocalAlloc GetSystemDirectoryW CopyFileW GetSystemTime FindFirstFileW FindNextFileW FindClose GetFileAttributesW FileTimeToSystemTime CreateMutexW OpenMutexW WaitForSingleObject ReleaseMutex DeleteFileW ProcessIdToSessionId LocalFree GetLogicalDrives DeviceIoControl GetVersionExW GetDriveTypeW FreeLibrary HeapFree GetProcessHeap HeapAlloc LoadLibraryA HeapReAlloc GetSystemDirectoryA VerifyVersionInfoA GetModuleHandleA QueryPerformanceFrequency VerSetConditionMask SleepEx InitializeCriticalSection FormatMessageA ExpandEnvironmentStringsA GetStdHandle WaitForMultipleObjects PeekNamedPipe GetFileType FindFirstFileA FindNextFileA RtlUnwind RaiseException LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA GetACP GetTimeZoneInformation SystemTimeToTzSpecificLocalTime SetFilePointerEx CreateThread GetFileAttributesExW

user32

GetCursorPos GetMonitorInfoW wvsprintfW MonitorFromPoint

advapi32

CryptDestroyKey GetLengthSid AddAccessAllowedAceEx InitializeAcl InitializeSecurityDescriptor SetSecurityDescriptorSacl SetSecurityDescriptorDacl LookupAccountNameW ConvertSidToStringSidW RegOpenKeyExW GetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo SetEntriesInAclW BuildExplicitAccessWithNameW GetSecurityDescriptorSacl RegQueryValueExA RegOpenKeyExA CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextA RegCloseKey RegSetValueExW RegOpenKeyW RegQueryValueExW CryptDecrypt CryptSetKeyParam CryptAcquireContextW CryptGenRandom CryptEncrypt CryptImportKey

shell32

SHCreateDirectoryExW ShellExecuteW SHFileOperationW SHGetSpecialFolderPathW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

ws2_32

getsockname socket ntohs connect getsockopt setsockopt send recv WSAGetLastError WSACleanup WSAStartup ntohl htonl htons WSASetLastError select WSAIoctl bind __WSAFDIsSet freeaddrinfo getpeername getaddrinfo sendto recvfrom listen accept gethostname ioctlsocket closesocket

wldap32

ord301 ord22 ord46 ord26 ord27 ord200 ord79 ord211 ord41 ord32 ord35 ord217 ord30 ord60 ord143 ord50 ord33

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

netapi32

Netbios NetApiBufferFree NetWkstaTransportEnum

ole32

CoUninitialize CoInitialize CoTaskMemFree CoCreateGuid

wininet

InternetQueryOptionA

Sharing

General

Malware Config

Signatures

File Explorer

fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c

kernel32

user32

advapi32

shell32

version

ws2_32

wldap32

wtsapi32

netapi32

ole32

wininet

generic