cf04366affd866051c1b1b3b74c6a789d459e3180db9d03481f4204fee302007

Sharing

Copy URL Twitter E-mail

General

Target
cf04366affd866051c1b1b3b74c6a789d459e3180db9d03481f4204fee302007
Size 3.1MB
Sample261002-k6evrasckd
SHA256 cf04366affd866051c1b1b3b74c6a789d459e3180db9d03481f4204fee302007
MD5 8e9e52bc8cbf793e579efff85c7bc575
SHA1 b28bd37029330763d39bb38cf8d2506a4161db99
SHA512 4a1cc90cacd6a42df9e336f7b8664c1bed756d52f38640d8e6d030e53ffef56110ca671f70b98e10f8d94fc21ff05246996fa2be9d959e0a98bba68d6f042be6
SSDEEP 49152:6tEMb6OHY/1ZhqQ1eqVOOtvEsSuyThsfd5t2YJ8Si6U:6aMOOH01Z71vVOO+svd2YJS
TLSH
T19EE57B20B585C121F1E201F09979A67544287D1387ECB5D7A29CCF197B2FEF1AA3227B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf04366affd866051c1b1b3b74c6a789d459e3180db9d03481f4204fee302007

File Explorer

cf04366affd866051c1b1b3b74c6a789d459e3180db9d03481f4204fee302007

.exe 3.1MB

cf04366affd866051c1b1b3b74c6a789d459e3180db9d03481f4204fee302007

IMPHASH 43a01e9edfe7a53d6e88d675117126c6
SHA256 cf04366affd866051c1b1b3b74c6a789d459e3180db9d03481f4204fee302007
MD5 8e9e52bc8cbf793e579efff85c7bc575
SHA1 b28bd37029330763d39bb38cf8d2506a4161db99
SHA512 4a1cc90cacd6a42df9e336f7b8664c1bed756d52f38640d8e6d030e53ffef56110ca671f70b98e10f8d94fc21ff05246996fa2be9d959e0a98bba68d6f042be6
SSDEEP 49152:6tEMb6OHY/1ZhqQ1eqVOOtvEsSuyThsfd5t2YJ8Si6U:6aMOOH01Z71vVOO+svd2YJS
TLSH
T19EE57B20B585C121F1E201F09979A67544287D1387ECB5D7A29CCF197B2FEF1AA3227B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

910809

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\trunk_en_4.0(多捆绑)\downloader2\bin\ldplayerinst.pdb

advapi32

RegOpenKeyExA RegCloseKey OpenProcessToken DuplicateTokenEx RegQueryValueExW RegCreateKeyW RegOpenKeyW RegDeleteValueW CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptGenRandom CryptReleaseContext CryptAcquireContextA

ws2_32

WSACleanup gethostbyname inet_addr ntohs recvfrom freeaddrinfo getaddrinfo ntohl htons getsockopt getsockname getpeername WSASetLastError select __WSAFDIsSet WSAGetLastError accept listen closesocket shutdown recv send connect bind ioctlsocket setsockopt socket WSAStartup htonl gethostname WSAIoctl sendto

crypt32

CertFreeCertificateContext

wldap32

ord301 ord200 ord30 ord26 ord27 ord22 ord79 ord35 ord32 ord143 ord46 ord211 ord33 ord41 ord50 ord45

normaliz

IdnToAscii

kernel32

CreateFileW GetFileSizeEx GetFileSize MoveFileExW FindFirstFileW FindNextFileW DeleteFileW FindClose GetModuleFileNameW LoadLibraryW GetProcAddress FreeLibrary ReadFile WriteFile SetFilePointer GetExitCodeProcess GetStdHandle CreateProcessW OpenProcess TerminateProcess GetModuleHandleW Sleep GetStartupInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetWindowsDirectoryW MultiByteToWideChar WideCharToMultiByte GetVersionExW CreateMutexW GetLocalTime GlobalLock GlobalUnlock GlobalAlloc GlobalFree GetProcessHeap HeapAlloc GetCurrentProcess GetDiskFreeSpaceExW GetVolumeInformationW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetTickCount FindResourceW LoadResource FreeResource SizeofResource LockResource WritePrivateProfileStringW WritePrivateProfileStringA RaiseException InitializeCriticalSectionAndSpinCount SetEvent DecodePointer HeapDestroy HeapReAlloc HeapSize SetLastError GetLogicalDriveStringsW GetDriveTypeW DeviceIoControl DuplicateHandle FormatMessageA GetTickCount64 InitializeCriticalSectionEx SleepEx VerSetConditionMask GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerifyVersionInfoA WaitForSingleObjectEx GetFileType PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA FindFirstFileExW SetStdHandle FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStringTypeW GetConsoleCP ReadConsoleW GetConsoleMode UnregisterWaitEx InitializeSListHead ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc FreeLibraryAndExitThread GetThreadTimes OutputDebugStringW GetOEMCP IsValidCodePage AreFileApisANSI GetModuleHandleExW GetCPInfo CreateSemaphoreW SetUnhandledExceptionFilter UnhandledExceptionFilter FileTimeToSystemTime GetFileInformationByHandle FileTimeToLocalFileTime SetFilePointerEx GetCommandLineW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation TlsFree TlsSetValue TlsGetValue TlsAlloc CloseHandle TerminateThread WaitForSingleObject CreateEventW GetLastError SystemTimeToTzSpecificLocalTime GetLocaleInfoW IsValidLocale GetUserDefaultLCID GetFileAttributesExW EnumSystemLocalesW CompareStringW LCMapStringW GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList CreateTimerQueue RtlUnwind IsProcessorFeaturePresent IsDebuggerPresent LoadLibraryExW ExitThread CreateThread EncodePointer GetCurrentProcessId MulDiv ExitProcess GetCurrentDirectoryW GetACP GetSystemTimeAsFileTime GetCurrentThread WriteConsoleW GetTimeZoneInformation SetEnvironmentVariableA GetFullPathNameW SetEndOfFile CreateDirectoryW FindResourceExW HeapFree

user32

GetSysColor GetGUIThreadInfo CreateAcceleratorTableW InvalidateRgn IntersectRect ClientToScreen GetPropW SetPropW FindWindowExW RegisterClassW wsprintfW SetWindowTextW PostQuitMessage CloseWindow MessageBoxW DestroyWindow SetWindowLongW CreateWindowExW PostMessageW DefWindowProcW PtInRect GetCursorPos ReleaseDC GetDC SetWindowPos BringWindowToTop SetForegroundWindow ShowWindow GetWindowLongW SendMessageW IsIconic KillTimer SetTimer GetWindowRect MoveWindow MonitorFromWindow GetMonitorInfoW EnableWindow SetCaretPos ShowCaret HideCaret CreateCaret SetRect FillRect DrawTextW CharPrevW GetCaretPos GetCaretBlinkTime GetWindowTextLengthW GetWindowTextW SetWindowRgn IsZoomed IsRectEmpty CharNextW MapWindowPoints wvsprintfW SetCursor UnionRect OffsetRect LoadCursorW GetMessageW TranslateMessage DispatchMessageW CallWindowProcW RegisterClassExW GetClassInfoExW IsWindow SetFocus GetClientRect GetParent GetWindow IsWindowVisible ScreenToClient GetActiveWindow GetFocus GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect InvalidateRect

gdi32

GetClipBox GetCharABCWidthsW CreateRectRgnIndirect CreatePenIndirect CombineRgn SetTextColor SetBkMode CreateSolidBrush CreatePatternBrush GetObjectA SetBkColor StretchBlt SetStretchBltMode GetTextExtentPoint32W CreateDIBSection LineTo TextOutW ExtTextOutW CreateRoundRectRgn SetWindowOrgEx GetTextMetricsW SaveDC RestoreDC Rectangle CreatePen CreateFontIndirectW GetDeviceCaps DeleteDC GetObjectW GetStockObject ExtSelectClipRgn SelectClipRgn MoveToEx DeleteObject GdiFlush BitBlt SelectObject CreateCompatibleBitmap RoundRect CreateCompatibleDC

shell32

SHGetPathFromIDListW ord165 SHGetFolderPathW ShellExecuteW ShellExecuteExW SHBrowseForFolderW SHGetMalloc SHGetSpecialFolderLocation

ole32

CLSIDFromProgID OleLockRunning CoUninitialize CreateStreamOnHGlobal CoCreateInstance CoTaskMemFree CLSIDFromString CoInitialize

shlwapi

StrStrIA PathFileExistsW PathIsRootW

wininet

HttpSendRequestExW HttpQueryInfoW InternetReadFile HttpSendRequestW HttpEndRequestW InternetCloseHandle InternetOpenW InternetConnectW HttpOpenRequestW

psapi

EnumProcessModules GetModuleFileNameExW

iphlpapi

GetAdaptersInfo

comctl32

ord17 _TrackMouseEvent

imm32

ImmSetCompositionFontW ImmReleaseContext ImmGetContext ImmGetVirtualKey ImmSetCompositionWindow

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

gdiplus

GdipDeleteFontFamily GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushI GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipGraphicsClear GdipDrawImage GdipDrawImageRectI GdipImageGetFrameCount GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipGetFamily GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipLoadImageFromStream GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList

generic

count=2, id=225, version=20806,

count=6, id=199, version=41118,

count=46, id=223, productName=VS2013 build 21005, version=21005,

count=34, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=142, id=225, productName=VS2013 build 21005, version=21005,

count=269, id=224, productName=VS2013 build 21005, version=21005,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=28, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=530, id=1, productName=Unmarked objects,

count=11, id=203, version=65501,

count=94, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=60, id=229, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,