0183328237220f3fb160dc13176be6bd7ff5dd619f2a13873864a2a18ee117b6

General

Target
0183328237220f3fb160dc13176be6bd7ff5dd619f2a13873864a2a18ee117b6
Size 1.6MB
Sample261011-j7fb8sysg1
SHA256 0183328237220f3fb160dc13176be6bd7ff5dd619f2a13873864a2a18ee117b6
MD5 c9a4665b6dd11218e40e0adee5bb9205
SHA1 edef373d83457d9f497f702aa304d214dc5fa1fa
SHA512 fca431d20cf23f2734e7887d5575d5807ecb44935a6ebe749f9b95c2b8a4ac1acb6ad1dfcf280395d3c5e8dabcb0f04c7a612a69abe94f91c0458fa43c7ba5a1
SSDEEP 24576:udj8bk6yZ7bvvdvxmgUOm0NRZuacpW02whyrddBkecxfMct:08bkZb9JmVvgZuauD2qyr/y
TLSH
T1B675C0607656D233D46180F24EB8AFA6E07DBD2D0F7116CF63C42B7A59391C62E31E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0183328237220f3fb160dc13176be6bd7ff5dd619f2a13873864a2a18ee117b6

File Explorer

0183328237220f3fb160dc13176be6bd7ff5dd619f2a13873864a2a18ee117b6

.exe 1.6MB

0183328237220f3fb160dc13176be6bd7ff5dd619f2a13873864a2a18ee117b6

IMPHASH 0d3f01fe9f2d02c219369cad0f9f0241
SHA256 0183328237220f3fb160dc13176be6bd7ff5dd619f2a13873864a2a18ee117b6
MD5 c9a4665b6dd11218e40e0adee5bb9205
SHA1 edef373d83457d9f497f702aa304d214dc5fa1fa
SHA512 fca431d20cf23f2734e7887d5575d5807ecb44935a6ebe749f9b95c2b8a4ac1acb6ad1dfcf280395d3c5e8dabcb0f04c7a612a69abe94f91c0458fa43c7ba5a1
SSDEEP 24576:udj8bk6yZ7bvvdvxmgUOm0NRZuacpW02whyrddBkecxfMct:08bkZb9JmVvgZuauD2qyr/y
TLSH
T1B675C0607656D233D46180F24EB8AFA6E07DBD2D0F7116CF63C42B7A59391C62E31E26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

473938

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_ffjj\rc_bug_mas_v12_2412\Build\Release\WPSOffice\office6\wpscloudsvr.pdb

kernel32

SetCurrentDirectoryW FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW GetCommandLineW CloseHandle GetLastError Sleep GetCurrentProcessId TerminateProcess GetCurrentThreadId OpenProcess GetSystemDirectoryW GetSystemWow64DirectoryW GetModuleHandleW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject WaitForMultipleObjects CreateThread QueueUserWorkItem UnregisterWaitEx LocalFree GetEnvironmentVariableW SetEnvironmentVariableW GetDriveTypeW GetTempPathW GetStartupInfoW GetTickCount SetDllDirectoryW GetDllDirectoryW CopyFileW GetSystemTime SystemTimeToFileTime GetExitCodeProcess VerSetConditionMask GetCurrentProcess LocalAlloc VerifyVersionInfoW CreateFileW ReadFile WriteFile SetNamedPipeHandleState WaitNamedPipeW GetOverlappedResult CancelIo FlushFileBuffers ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateDirectoryW GetFileAttributesW WideCharToMultiByte SetUnhandledExceptionFilter LoadLibraryExW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar GetFileAttributesExW SetEvent CreateEventW GetModuleHandleExW VirtualAlloc VirtualFree SetLastError QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread SetStdHandle GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA lstrlenW GetPrivateProfileIntW GetPrivateProfileStringW CreateProcessW ExpandEnvironmentStringsW GetLongPathNameW ProcessIdToSessionId OutputDebugStringA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetStringTypeW FindClose FindFirstFileExW FindNextFileW SetEndOfFile SetFilePointerEx EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetCPInfo ResetEvent WaitForSingleObjectEx InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter OutputDebugStringW RtlUnwind InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree SetConsoleCtrlHandler GetStdHandle ExitProcess GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode GetFileSizeEx ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

0183328237220f3fb160dc13176be6bd7ff5dd619f2a13873864a2a18ee117b6

kernel32

generic