b0bd6c2ae0945af1b08edf400fe3d2fa02c29be36057049f21585e3366ae1f9d

General

Target
b0bd6c2ae0945af1b08edf400fe3d2fa02c29be36057049f21585e3366ae1f9d
Size 1.3MB
Sample261002-jyaqdsdc42
SHA256 b0bd6c2ae0945af1b08edf400fe3d2fa02c29be36057049f21585e3366ae1f9d
MD5 73886b163fb2891f21b41fa8b5aec564
SHA1 42b693642d0458e99d877027d0946e57351e8393
SHA512 dcf004a90476d948b8c0bd2a57566a001ae2ea6a0189dd9eddb3bcfdcb235123795064c33bd02d9191362ef8fac6fb974eaaddaada4fceedf594d6072c1f9239
SSDEEP 24576:U0PimyBXnBMfH0fHtWaKngL2jdshRTdG1YxITqvfPkbIcbjLm:UxxMfUfNWarSj8RoTCCW
TLSH
T19F55E0113B80E439E5A305729FFAC61D567DBD520B6221C7B3C87B1E4E34AE1BA39712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0bd6c2ae0945af1b08edf400fe3d2fa02c29be36057049f21585e3366ae1f9d

File Explorer

b0bd6c2ae0945af1b08edf400fe3d2fa02c29be36057049f21585e3366ae1f9d

.exe 1.3MB

b0bd6c2ae0945af1b08edf400fe3d2fa02c29be36057049f21585e3366ae1f9d

IMPHASH b4707d7c70ea35e3b62b5604bb07f62a
SHA256 b0bd6c2ae0945af1b08edf400fe3d2fa02c29be36057049f21585e3366ae1f9d
MD5 73886b163fb2891f21b41fa8b5aec564
SHA1 42b693642d0458e99d877027d0946e57351e8393
SHA512 dcf004a90476d948b8c0bd2a57566a001ae2ea6a0189dd9eddb3bcfdcb235123795064c33bd02d9191362ef8fac6fb974eaaddaada4fceedf594d6072c1f9239
SSDEEP 24576:U0PimyBXnBMfH0fHtWaKngL2jdshRTdG1YxITqvfPkbIcbjLm:UxxMfUfNWarSj8RoTCCW
TLSH
T19F55E0113B80E439E5A305729FFAC61D567DBD520B6221C7B3C87B1E4E34AE1BA39712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

91880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\build_9.0\trunk_cn_9.0_app崩溃提示\simulator\bin\ldtool.pdb

kernel32

DeleteFileW FindClose RemoveDirectoryW GetModuleFileNameW GetTempPathW LoadLibraryW GetProcAddress FreeLibrary ReadFile WriteFile MultiByteToWideChar WideCharToMultiByte WaitForSingleObject GetStdHandle TerminateProcess GetCurrentProcess GetModuleHandleW GetModuleHandleA GetStartupInfoW CreateEventW SetEvent GetLocalTime GetVersionExW QueryPerformanceCounter OutputDebugStringW GetProcessHeap HeapAlloc HeapFree SetLastError EncodePointer DecodePointer DeleteCriticalSection RaiseException RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent ExitProcess GetModuleHandleExW HeapSize GetCurrentThread GetFileType GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreW IsValidCodePage GetACP GetOEMCP GetCPInfo GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers LoadLibraryExW HeapReAlloc LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStringTypeW SetStdHandle WriteConsoleW ReadConsoleW SetEndOfFile CreateTimerQueue ExitThread CreateThread GetExitCodeThread DuplicateHandle InitializeCriticalSection WaitForSingleObjectEx SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread VirtualAlloc VirtualFree VirtualProtect ReleaseSemaphore InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx GetLastError GetTickCount CloseHandle CreateFileW GetCurrentThreadId LeaveCriticalSection UnhandledExceptionFilter EnterCriticalSection FindNextFileW FindFirstFileW GetCommandLineW Sleep

user32

LoadStringW KillTimer SetWindowLongW CreateWindowExW DestroyWindow DefWindowProcW

shlwapi

PathFileExistsW

shell32

ShellExecuteW SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

b0bd6c2ae0945af1b08edf400fe3d2fa02c29be36057049f21585e3366ae1f9d

kernel32

user32

shlwapi

shell32

generic