901634bc5019d2548fe50b75e745fbf040e1b7261cc71c5d501caaa9c3b75e7b

Sharing

Copy URL Twitter E-mail

General

Target
901634bc5019d2548fe50b75e745fbf040e1b7261cc71c5d501caaa9c3b75e7b
Size 12.9MB
Sample261002-hs393svaqa
SHA256 901634bc5019d2548fe50b75e745fbf040e1b7261cc71c5d501caaa9c3b75e7b
MD5 2026f241de2be666a7d4d51b7fa91e8f
SHA1 6bb6632cd41dad3ba528c8768f42972b25625933
SHA512 3c77d6d4e79d1e355fd87cb698755bccee40608c5397dad5b4d6dbcaf945ede3416c959052be7c660ce2cdd27eadf11c84a02f00719e1f512be3762c42bade81
SSDEEP 393216:ZH7qJ0P01o6BenfCbyYU4ugFFBqGKWXYkx/adkXp8:NEo68fsSg3ACYkx/mcp8
TLSH
T1BDD633D3028C1F9E05C7CC0A495A04960C1792585366D13A4875EA6722FCFE9FDEBFAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Aion2Translate.exe

File Explorer

901634bc5019d2548fe50b75e745fbf040e1b7261cc71c5d501caaa9c3b75e7b

.zip 12.9MB
Aion2Translate.exe

.exe 14.7MB
使用说明.txt

1KB

901634bc5019d2548fe50b75e745fbf040e1b7261cc71c5d501caaa9c3b75e7b

SHA256 901634bc5019d2548fe50b75e745fbf040e1b7261cc71c5d501caaa9c3b75e7b
MD5 2026f241de2be666a7d4d51b7fa91e8f
SHA1 6bb6632cd41dad3ba528c8768f42972b25625933
SHA512 3c77d6d4e79d1e355fd87cb698755bccee40608c5397dad5b4d6dbcaf945ede3416c959052be7c660ce2cdd27eadf11c84a02f00719e1f512be3762c42bade81
SSDEEP 393216:ZH7qJ0P01o6BenfCbyYU4ugFFBqGKWXYkx/adkXp8:NEo68fsSg3ACYkx/mcp8
TLSH
T1BDD633D3028C1F9E05C7CC0A495A04960C1792585366D13A4875EA6722FCFE9FDEBFAE
MD5 SHA1 SHA512 SSDEEP TLSH

Aion2Translate.exe

IMPHASH 25cc1323431cfb0eefd31029818bf2c7
SHA256 070e8bd78ff21e1e644d2c82e07811d7dd379f5d5e3bedfdb96c90839e7378d3
MD5 2a200d90d43f75d7123889452b6dd5ec
SHA1 dded8bc1ae1c4f8bc643af0273d95f86395adf3a
SHA512 5064a5abe3785e98c8ff9cac3094f031dbdfba53d3d7ed71f60896414685e94aacf244b62814b7563a60fc461cb8eb2d4b84ea315f2cdf69fd0e2e326eb1dfcd
SSDEEP 393216:HPdEFfA6hsx0hiCXaZvKr0WUo8cNvvg6AoLm2S34DkXd:0iCqZI6c9Igm2S3aid
TLSH
T17AF6123179408037F6F202B595BD26798A1C5D351B18ADEB83DC77198A35CE36E3B22B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1632011

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\work\work_pro\PARALLEL\TransStandalone\build\Release\Aion2Translate.pdb

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetCredentials WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpWriteData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl

dbghelp

SymGetOptions SymSetOptions SymFromAddrW SymGetModuleBase64 SymFunctionTableAccess64 StackWalk64 SymInitialize

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

advapi32

CryptDestroyKey CryptEncrypt CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptGenRandom CryptReleaseContext CryptAcquireContextA CryptImportKey RegGetValueA RegGetValueW RegOpenKeyExW RegCloseKey

ws2_32

WSAGetLastError __WSAFDIsSet select WSASetLastError recv WSAStartup bind closesocket connect getpeername getsockname getsockopt htons ntohs ntohl socket WSAIoctl gethostbyname accept getaddrinfo freeaddrinfo recvfrom sendto listen ioctlsocket gethostname WSACleanup htonl send setsockopt

crypt32

CertFreeCertificateContext

wldap32

ord45 ord60 ord211 ord46 ord143 ord22 ord301 ord200 ord30 ord79 ord35 ord33 ord41 ord32 ord27 ord26 ord50

normaliz

IdnToUnicode IdnToAscii

comctl32

_TrackMouseEvent ord17 InitCommonControlsEx

gdiplus

GdipCreatePen1 GdipDeletePen GdipSetPenDashStyle GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipDrawLine GdipDrawPath GdipFillPath GdiplusStartup GdiplusShutdown GdipAddPathLine GdipSetPenMode GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipCloneImage GdipDisposeImage GdipSetTextRenderingHint GdipSetInterpolationMode GdipDrawRectangleI GdipFillRectangleI GdipAlloc GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipMeasureString GdipStringFormatGetGenericTypographic GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipDrawImageRectI GdipTranslateWorldTransform GdipRotateWorldTransform GdipDeleteBrush GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathArc GdipCreateSolidFill GdipCreateFontFromDC GdipCloneBrush GdipFree

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

ole32

CoTaskMemFree CoUninitialize CoInitializeEx RegisterDragDrop RevokeDragDrop DoDragDrop OleDuplicateData ReleaseStgMedium CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID OleLockRunning CoCreateInstance

oleaut32

VariantChangeType CreateErrorInfo SetErrorInfo GetErrorInfo VariantClear VariantInit SysFreeString SysAllocString

msimg32

AlphaBlend

api-ms-win-core-winrt-l1-1-0

RoInitialize RoGetActivationFactory RoUninitialize

shlwapi

PathFileExistsW UrlGetPartW

shell32

SHGetKnownFolderPath DragQueryFileW ShellExecuteW

kernel32

SetThreadpoolWait GetCPInfo UnhandledExceptionFilter CreateThreadpoolWait CloseThreadpoolTimer SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind SetThreadpoolTimer CreateThreadpoolTimer InterlockedPushEntrySList InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW GetNativeSystemInfo GetExitCodeThread SwitchToThread GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockShared SleepConditionVariableSRW TryAcquireSRWLockExclusive CreateSymbolicLinkW CloseThreadpoolWait CreateHardLinkW CreateDirectoryExW DeviceIoControl AreFileApisANSI GetTempPathW SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetDiskFreeSpaceExW FindFirstFileExW GetLocaleInfoEx TlsFree ExitThread FreeLibraryAndExitThread lstrcpyW EncodePointer SetConsoleCtrlHandler LockFileEx UnlockFileEx GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW LCMapStringEx GetStringTypeW GetFileInformationByHandleEx CompareStringEx IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetTimeZoneInformation IsValidCodePage GetOEMCP SetStdHandle SetEndOfFile HeapReAlloc GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW lstrcpynW lstrcmpiW GetLocalTime InitializeCriticalSectionAndSpinCount DecodePointer VerifyVersionInfoW GetVersionExW GetProcessHeap HeapSize WriteConsoleW WaitForThreadpoolTimerCallbacks OpenProcess ExitProcess lstrlenW LoadLibraryW GetTickCount SetCurrentDirectoryW FreeResource CreateFileW WriteFile CloseHandle GetLastError GetPrivateProfileStringW WritePrivateProfileStringW MultiByteToWideChar GetFileAttributesW ReleaseMutex WaitForSingleObject CreateMutexW GetCurrentProcessId GetTickCount64 GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileSizeEx ReadFile Sleep GlobalAlloc GlobalUnlock GlobalLock GlobalFree MulDiv IsProcessorFeaturePresent GetVersion GetCommandLineA CreateDirectoryW DeleteFileW OutputDebugStringA OutputDebugStringW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent CreateEventW GetSystemInfo GetStdHandle InitOnceExecuteOnce WideCharToMultiByte RtlCaptureContext GetEnvironmentVariableA GetCurrentProcess TerminateProcess GetCurrentThread GetThreadId GetSystemTimeAsFileTime GetProcAddress FindClose FindFirstFileW FindNextFileW RemoveDirectoryW GetModuleFileNameW CopyFileW MoveFileExW QueryPerformanceCounter QueryPerformanceFrequency VirtualQuery FreeLibrary LoadLibraryExW LocalFree FormatMessageW K32GetModuleFileNameExW Module32FirstW Module32NextW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitializeConditionVariable WakeAllConditionVariable SleepConditionVariableCS GetCurrentThreadId WakeConditionVariable CreateThread CreateProcessW LoadLibraryA RtlCaptureStackBackTrace OpenThread SuspendThread ResumeThread GetThreadContext RaiseException GetModuleHandleA SetLastError FormatMessageA InitializeCriticalSectionEx SleepEx VerSetConditionMask GetSystemDirectoryA VerifyVersionInfoA WaitForSingleObjectEx GetFileType PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA GetFileSize GetCurrentDirectoryW LocalFileTimeToFileTime SetFilePointer SetFileTime SystemTimeToFileTime GetACP

user32

PeekMessageW SendMessageW PostQuitMessage SetWindowPos IsWindowVisible IsIconic OpenClipboard CloseClipboard SetClipboardData EmptyClipboard SetTimer KillTimer GetSystemMetrics GetDC ReleaseDC SetWindowRgn GetWindowRgn InvalidateRect SetWindowTextW LoadImageW SetCursor InflateRect UnionRect OffsetRect LoadCursorW wsprintfW CharNextW GetMessageW PostMessageW CreateWindowExW IsWindow IsZoomed SetFocus GetActiveWindow GetFocus GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect TranslateMessage GetWindowRect GetCursorPos SetProcessDPIAware MapWindowPoints GetSysColor IntersectRect IsRectEmpty PtInRect GetWindowLongW SetWindowLongW GetParent GetWindow MonitorFromWindow GetMonitorInfoW DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW EnableWindow GetMenu SetPropW GetPropW AdjustWindowRectEx MonitorFromPoint UpdateWindow IsWindowEnabled UpdateLayeredWindow MoveWindow UnregisterClassW CharPrevW DrawTextW FillRect SetRect CreatePopupMenu DestroyMenu EnableMenuItem AppendMenuW TrackPopupMenu CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen EqualRect GetWindowTextW GetWindowTextLengthW wsprintfA DrawTextA CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo SetForegroundWindow GetKeyboardLayout GetKeyNameTextW MapVirtualKeyExW MessageBoxW ShowWindow DestroyWindow DispatchMessageW ScreenToClient GetClientRect

gdi32

IntersectClipRect GetDeviceCaps GetCurrentObject PtInRegion CombineRgn CreatePenIndirect CloseEnhMetaFile GetLayout Rectangle SaveDC CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextColor GetTextExtentPoint32W SelectObject LineTo SelectClipRgn ExtSelectClipRgn RestoreDC SetBkMode StretchBlt SetStretchBltMode SetTextColor GetObjectA MoveToEx TextOutW CreatePatternBrush CreateRoundRectRgn GetTextExtentPointA GetBitmapBits SetBitmapBits CreateDIBSection GetObjectW SetViewportOrgEx SetWindowOrgEx GdiFlush CreateDIBitmap CreateFontIndirectW CreatePen BitBlt CreateCompatibleBitmap CreateCompatibleDC GetTextMetricsW PlayEnhMetaFile GetEnhMetaFileHeader SetBkColor CreateRectRgn RemoveFontMemResourceEx CreateEnhMetaFileW GetStockObject GetViewportOrgEx AddFontMemResourceEx DeleteDC DeleteObject

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer WindowsCreateStringReference WindowsCreateString WindowsDeleteString WindowsGetStringLen

generic

count=40, id=259, version=26213,

count=205, id=261, version=26213,

count=9, id=260, version=27047,

count=20, id=261, version=27047,

count=5, id=253, version=35207,

count=22, id=260, version=35207,

count=29, id=259, version=35207,

count=103, id=261, version=35207,

count=45, id=260, version=26213,

count=1, id=263, version=26213,

count=52, id=261, version=27048,

count=10, id=257, version=25711,

count=100, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=29, id=257, version=26213,

count=565, id=1, productName=Unmarked objects,

count=62, id=260, version=35213,

count=12, id=261, version=35213,

count=1, id=255, version=35213,

count=3, id=151,

count=1, id=258, version=35213,

Sharing

General

Malware Config

Signatures

File Explorer

901634bc5019d2548fe50b75e745fbf040e1b7261cc71c5d501caaa9c3b75e7b

Aion2Translate.exe

winhttp

dbghelp

version

api-ms-win-core-synch-l1-2-0

advapi32

ws2_32

crypt32

wldap32

normaliz

comctl32

gdiplus

imm32

ole32

oleaut32

msimg32

api-ms-win-core-winrt-l1-1-0

shlwapi

shell32

kernel32

user32

gdi32

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

generic

使用说明.txt