edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30

General

Target
edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30
Size 2.7MB
Sample261002-mpy86sys5k
SHA256 edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30
MD5 50684cd35b3bdbbe6ea7ec703c54538f
SHA1 5d7d6cc2aab5c39c4e963b80df9014c8e55fd957
SHA512 b68d10c8f88b588f38c0197d9e53f6ec81c73d8e9d33ae10baa5c2cfce3ff4c5653298d5727b588ec3d6ac76dafb7eb15780df55617466d1fe7e361f969231fe
SSDEEP 49152:D61nCNDpWLQued6Ox6hNre93IYSBb1Mtii/EgVnUrmXpfzbwAcN+6:G8NGOx6bre93IYYb1ji/Ej8wAcQ6
TLSH
T105D5E0207697C136D17181B0597CDFB191ADAC3C5F7246CBA3C43B2A5A309D26E3AF26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30

File Explorer

edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30

.exe 2.7MB

edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30

IMPHASH 0499950a4dd49ea5b1323b16d409fdff
SHA256 edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30
MD5 50684cd35b3bdbbe6ea7ec703c54538f
SHA1 5d7d6cc2aab5c39c4e963b80df9014c8e55fd957
SHA512 b68d10c8f88b588f38c0197d9e53f6ec81c73d8e9d33ae10baa5c2cfce3ff4c5653298d5727b588ec3d6ac76dafb7eb15780df55617466d1fe7e361f969231fe
SSDEEP 49152:D61nCNDpWLQued6Ox6hNre93IYSBb1Mtii/EgVnUrmXpfzbwAcN+6:G8NGOx6bre93IYYb1ji/Ej8wAcQ6
TLSH
T105D5E0207697C136D17181B0597CDFB191ADAC3C5F7246CBA3C43B2A5A309D26E3AF26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

714257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_1lgl3\rc_bugfix_master_\Build\Release\WPSOffice\wtoolex\updateself.pdb

kernel32

VerSetConditionMask CloseHandle GetLastError SetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetCurrentProcess GetCurrentThread GetSystemDirectoryW GetSystemWow64DirectoryW FreeLibrary GetProcAddress LoadLibraryW LocalFree VerifyVersionInfoW GetDateFormatW GetTimeFormatW GetEnvironmentVariableW SetEnvironmentVariableW GetFileAttributesW OpenProcess GlobalMemoryStatusEx GetNativeSystemInfo IsWow64Process GetModuleFileNameW GetPrivateProfileIntW GetPrivateProfileStringW GetComputerNameW MultiByteToWideChar WideCharToMultiByte GetGeoInfoW GetUserGeoID GetUserDefaultLCID ExpandEnvironmentStringsW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW FindClose FindNextFileW GetFileSizeEx ReadFile Sleep GetModuleHandleW MoveFileExW GlobalFree WriteFile WaitNamedPipeW GetOverlappedResult CancelIo WaitForSingleObject GetLongPathNameW GetCurrentProcessId TerminateProcess GetExitCodeProcess ProcessIdToSessionId GetVersionExW FindResourceExW LoadResource LockResource SizeofResource FindResourceW CopyFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLocalTime SetFilePointer SetEvent ResetEvent CreateEventW CreateThread GetExitCodeThread ResumeThread GetTickCount MoveFileW WritePrivateProfileStringW GetFileSize SetUnhandledExceptionFilter GetCurrentThreadId GetProcessId SetFileAttributesW GetPrivateProfileSectionW GetCommandLineW DecodePointer RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetFileAttributesExW OutputDebugStringW ReleaseMutex CreateMutexW lstrlenA DeviceIoControl lstrlenW GetUserDefaultUILanguage WTSGetActiveConsoleSessionId CreateProcessW CreateFileA GetSystemTime LoadLibraryExW LocalFileTimeToFileTime SetFileTime SystemTimeToFileTime QueryPerformanceCounter QueryPerformanceFrequency SetStdHandle GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection GetStringTypeW InitOnceBeginInitialize InitOnceComplete FormatMessageA FindFirstFileExW SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx GetSystemTimeAsFileTime EncodePointer LCMapStringEx GetLocaleInfoEx CompareStringEx GetCPInfo IsDebuggerPresent WaitForSingleObjectEx UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualAlloc SetConsoleCtrlHandler SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle ExitProcess CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetFileType GetConsoleMode ReadConsoleW FlushFileBuffers GetConsoleCP IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

edae646b12d7c69a67b861f5701a1a67f136995a6defa50e1f97ce87ae6c4f30

kernel32

generic