c3809196ceaa88db2bc9101749f3c23964fd5b0a024bc0c4917605eeb62fa518

Sharing

Copy URL Twitter E-mail

General

Target
c3809196ceaa88db2bc9101749f3c23964fd5b0a024bc0c4917605eeb62fa518
Size 1.4MB
Sample261001-lbwepasepf
SHA256 c3809196ceaa88db2bc9101749f3c23964fd5b0a024bc0c4917605eeb62fa518
MD5 05c98ca55eeeaa8d5981a18260a45d5c
SHA1 7b1cff58b2d95ac93e993ff081a762bddf115eb3
SHA512 0debdf1774616ee51c6f8d9e0218a5209699294e504460e4d715fabd19e11593b14d7a099838bc8a2d59cfcaadc8b9373f8489136b5e096e22ed60fa64060255
SSDEEP 12288:pWPHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:pxbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T122652386B6C804F9FC1B89B890B65627C1B37D66C39AB3DF0A4095240D795F1E53F2A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c3809196ceaa88db2bc9101749f3c23964fd5b0a024bc0c4917605eeb62fa518

File Explorer

c3809196ceaa88db2bc9101749f3c23964fd5b0a024bc0c4917605eeb62fa518

.exe 1.4MB

c3809196ceaa88db2bc9101749f3c23964fd5b0a024bc0c4917605eeb62fa518

IMPHASH 633082133e5fb9ff25c6a8eee665f592
SHA256 c3809196ceaa88db2bc9101749f3c23964fd5b0a024bc0c4917605eeb62fa518
MD5 05c98ca55eeeaa8d5981a18260a45d5c
SHA1 7b1cff58b2d95ac93e993ff081a762bddf115eb3
SHA512 0debdf1774616ee51c6f8d9e0218a5209699294e504460e4d715fabd19e11593b14d7a099838bc8a2d59cfcaadc8b9373f8489136b5e096e22ed60fa64060255
SSDEEP 12288:pWPHiEUlJ95xHTnKh0sbkqRv94EjW4YhzFeBP35DA9UXJwgV0lyUif0:pxbDxHjsbkqRV4EgFMp3C9UZ9VCXif
TLSH
T122652386B6C804F9FC1B89B890B65627C1B37D66C39AB3DF0A4095240D795F1E53F2A3
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\pc\reverse\weileipeng\iTunesFlash\i4iTunesFlash\x64\Release\iTunesFlash.pdb

kernel32

GetSystemTime GetCurrentProcess GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW WideCharToMultiByte GetProcAddress GetModuleHandleW FreeLibrary GetTickCount RtlLookupFunctionEntry GetLastError Sleep LoadLibraryW MultiByteToWideChar RtlVirtualUnwind UnhandledExceptionFilter RtlCaptureContext InitializeSListHead SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __current_exception __std_exception_copy __std_exception_destroy __current_exception_context memset wcsrchr memmove memcpy

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _crt_atexit _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e _exit __p___argc __p___wargv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table exit terminate _configure_wide_argv _invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

fputs __stdio_common_vsprintf _wfopen __stdio_common_vswprintf __stdio_common_vfprintf __stdio_common_vswprintf_s getchar fclose fflush __acrt_iob_func fopen __p__commode _set_fmode

api-ms-win-crt-convert-l1-1-0

_wtoi _wcstoui64

api-ms-win-crt-string-l1-1-0

strncpy strcmp

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

c3809196ceaa88db2bc9101749f3c23964fd5b0a024bc0c4917605eeb62fa518

kernel32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic