9648c457319df899c9db137d2c4691adb9cae902dfcb3050ffa147e83ebd4621

Sharing

Copy URL Twitter E-mail

General

Target
9648c457319df899c9db137d2c4691adb9cae902dfcb3050ffa147e83ebd4621
Size 998KB
Sample260930-kcktxayv4l
SHA256 9648c457319df899c9db137d2c4691adb9cae902dfcb3050ffa147e83ebd4621
MD5 24469dc245f9c4a799783120ae35e075
SHA1 43a11361f9714859c50a619b8b478634d62b1465
SHA512 af36c6397ee93e3f5e2de88d48e6cb845970581291ffd502d41d539cd1766b2afa5841afd917c8697d058d5c5f00594b7e5f8f8bf8d523b92299c00c3e5b2e10
SSDEEP 24576:vx8VJLsMvxub8IIR6i7KlaadbU0IOW0weCvx0ltZb:Z8AGxubdNNVdb9IPK
TLSH
T13625E026EBC4E1E0F2A35638A8F47B57D19CBDAD7A95DF3A43D0534D48A09CE8931113
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9648c457319df899c9db137d2c4691adb9cae902dfcb3050ffa147e83ebd4621

File Explorer

9648c457319df899c9db137d2c4691adb9cae902dfcb3050ffa147e83ebd4621

.exe 998KB

9648c457319df899c9db137d2c4691adb9cae902dfcb3050ffa147e83ebd4621

IMPHASH 32c24b2b9af4f6b90ed4c2aab64b1210
SHA256 9648c457319df899c9db137d2c4691adb9cae902dfcb3050ffa147e83ebd4621
MD5 24469dc245f9c4a799783120ae35e075
SHA1 43a11361f9714859c50a619b8b478634d62b1465
SHA512 af36c6397ee93e3f5e2de88d48e6cb845970581291ffd502d41d539cd1766b2afa5841afd917c8697d058d5c5f00594b7e5f8f8bf8d523b92299c00c3e5b2e10
SSDEEP 24576:vx8VJLsMvxub8IIR6i7KlaadbU0IOW0weCvx0ltZb:Z8AGxubdNNVdb9IPK
TLSH
T13625E026EBC4E1E0F2A35638A8F47B57D19CBDAD7A95DF3A43D0534D48A09CE8931113
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61240

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\KINGSOFT_DUBA\Build\Build_Src\kis_wallpaper\kis_wallpaper\product\win32\dbginfo\kdeskassist.pdb

kernel32

FindNextFileW FindClose RemoveDirectoryW LoadLibraryW FreeLibrary MultiByteToWideChar lstrlenW GetPrivateProfileIntW CreateFileW CloseHandle GetLogicalDriveStringsW DeviceIoControl GetDriveTypeW GetDiskFreeSpaceExW GetSystemDirectoryW OpenMutexW InitializeCriticalSectionEx GetPrivateProfileStringW RaiseException DecodePointer DeleteCriticalSection GetCurrentThreadId EnterCriticalSection LeaveCriticalSection LocalFree GetCommandLineW CreateMutexW SetLastError GetLocalTime DeleteFileW lstrcmpiW LoadLibraryExW Sleep FileTimeToSystemTime GetVersionExW GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead FindFirstFileW GetModuleHandleW GetProcAddress GetLastError CreateDirectoryW GetFileAttributesW GetModuleFileNameW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize EncodePointer OutputDebugStringW IsDebuggerPresent GetSystemTimeAsFileTime InitializeCriticalSection HeapDestroy

user32

DefWindowProcW GetWindowLongW SetWindowLongW FindWindowExW IsWindowVisible CallWindowProcW UnregisterClassW CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW PostMessageW SendMessageTimeoutW

advapi32

RegDeleteValueW RegCreateKeyExW RegQueryInfoKeyW RegDeleteKeyW SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyW GetUserNameW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegCloseKey RegOpenKeyExW

shell32

SHGetFolderPathW SHFileOperationW ord680 ShellExecuteExW SHGetSpecialFolderPathW ShellExecuteW

ole32

CoUninitialize CoInitialize CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

VarUI4FromStr SysFreeString

shlwapi

PathAddBackslashW PathAppendW PathRemoveFileSpecW PathFileExistsW PathRemoveBackslashW

comctl32

InitCommonControlsEx

msvcp140

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z _Mbrtowc ?_Xbad_alloc@std@@YAXXZ ?_W_Getmonths@_Locinfo@std@@QBEPBGXZ ?_Getmonths@_Locinfo@std@@QBEPBDXZ ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ?_Getdays@_Locinfo@std@@QBEPBDXZ ?_W_Getdays@_Locinfo@std@@QBEPBGXZ

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

vcruntime140

__current_exception_context _except_handler4_common _CxxThrowException __std_type_info_destroy_list __current_exception _purecall memchr memcmp wcsrchr __std_exception_destroy __std_exception_copy wcschr memmove memset memcpy __std_terminate wcsstr __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

wcscspn tolower wcslen wcsspn _strnicmp wcscpy_s strlen wcspbrk wmemcpy_s _wcsnicmp _wcslwr_s _wcsicmp wcsnlen wcscmp wcsncpy_s iswspace

api-ms-win-crt-runtime-l1-1-0

_c_exit _controlfp_s _invalid_parameter_noinfo_noreturn _beginthreadex _errno _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit _cexit _invalid_parameter_noinfo terminate _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit

api-ms-win-crt-convert-l1-1-0

_wtoi64 _wtol wcstol _wtoi

api-ms-win-crt-stdio-l1-1-0

_wfsopen fclose fflush __stdio_common_vfwprintf __p__commode __stdio_common_vswprintf __stdio_common_vswprintf_s _set_fmode

api-ms-win-crt-time-l1-1-0

_localtime64_s _mktime64 _time64

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-filesystem-l1-1-0

_wrename _waccess

api-ms-win-crt-heap-l1-1-0

_callnewh _recalloc _set_new_mode malloc calloc free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

9648c457319df899c9db137d2c4691adb9cae902dfcb3050ffa147e83ebd4621

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msvcp140

version

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic