1e7b8313e615a13ec162001a19e73b88379e702c5fa7ffddd603d3d9f7a4552b

Sharing

Copy URL Twitter E-mail

General

Target
1e7b8313e615a13ec162001a19e73b88379e702c5fa7ffddd603d3d9f7a4552b
Size 876KB
Sample261011-jf2fdseb45
SHA256 1e7b8313e615a13ec162001a19e73b88379e702c5fa7ffddd603d3d9f7a4552b
MD5 005baec446b7dfd9416bc585349e1269
SHA1 b32d8a9f28b790dc5383b4f8ce3ee7639c6ddb19
SHA512 2674a2071736608e4e4d3802c9f44577458db10c70b5ca6ff728a906953756f5ef373457e818fc8dd201f109b6dccdbeb27a830a759932267afa17e10e2b0247
SSDEEP 24576:PtXzmxTpD51MceJ4ZCGrriJY5R/dUV+s4PqrHfV:VjwThTMHJm5IeFq+Zir/V
TLSH
T1AA15F1313BD14837E1B20134F9F892F9A6657D315A2286CFB3813B4A6D31EA29D34B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1e7b8313e615a13ec162001a19e73b88379e702c5fa7ffddd603d3d9f7a4552b

File Explorer

1e7b8313e615a13ec162001a19e73b88379e702c5fa7ffddd603d3d9f7a4552b

.exe 876KB

1e7b8313e615a13ec162001a19e73b88379e702c5fa7ffddd603d3d9f7a4552b

IMPHASH a93894461dcaffe31d2f44a85f98f384
SHA256 1e7b8313e615a13ec162001a19e73b88379e702c5fa7ffddd603d3d9f7a4552b
MD5 005baec446b7dfd9416bc585349e1269
SHA1 b32d8a9f28b790dc5383b4f8ce3ee7639c6ddb19
SHA512 2674a2071736608e4e4d3802c9f44577458db10c70b5ca6ff728a906953756f5ef373457e818fc8dd201f109b6dccdbeb27a830a759932267afa17e10e2b0247
SSDEEP 24576:PtXzmxTpD51MceJ4ZCGrriJY5R/dUV+s4PqrHfV:VjwThTMHJm5IeFq+Zir/V
TLSH
T1AA15F1313BD14837E1B20134F9F892F9A6657D315A2286CFB3813B4A6D31EA29D34B57
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

141557

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\QQ\HummerSDK_proj\Output\PdbFinal\bugreport.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

dbghelp

SymSetOptions SymGetModuleInfoW SymCleanup SymLoadModule SymInitialize

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle InternetReadFile HttpSendRequestA InternetConnectA HttpOpenRequestA

psapi

GetModuleFileNameExW GetModuleFileNameExA

comctl32

InitCommonControlsEx ImageList_ReplaceIcon ImageList_Create

tinyxml

?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ ?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ ?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ ?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ ?ToDocument@TiXmlDocument@@UAEPAV1@XZ ?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ ?Clone@TiXmlDocument@@MBEPAVTiXmlNode@@XZ ?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ ?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ ?Print@TiXmlDocument@@UBEXPAU_iobuf@@H@Z ?ToElement@TiXmlNode@@UBEPBVTiXmlElement@@XZ ?GetText@TiXmlElement@@QBEPBDXZ ?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ ?Value@TiXmlNode@@QBEPBDXZ ?ToElement@TiXmlNode@@UAEPAVTiXmlElement@@XZ ??1TiXmlDocument@@UAE@XZ ?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ ?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ ?Accept@TiXmlDocument@@UBE_NPAVTiXmlVisitor@@@Z ?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z ?Attribute@TiXmlElement@@QBEPBDPBD@Z ?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ ?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ??0TiXmlDocument@@QAE@XZ ?ToDocument@TiXmlDocument@@UBEPBV1@XZ

kernel32

QueryPerformanceCounter OutputDebugStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcess LeaveCriticalSection DeviceIoControl EnterCriticalSection InitializeCriticalSection GetProcessTimes IsDebuggerPresent GetStartupInfoW InitializeSListHead CreateFileW MoveFileW GetCurrentThreadId GetCurrentProcessId VirtualFree VirtualAlloc SetFileAttributesW GetThreadSelectorEntry WritePrivateProfileStringW GetPrivateProfileIntW GetFileSize GetVersionExW CreateDirectoryW HeapAlloc GetProcessHeap VirtualProtect HeapFree GetModuleHandleW HeapDestroy HeapSize HeapReAlloc SetErrorMode MultiByteToWideChar GetCommandLineW GetTickCount SetCurrentDirectoryW ReadProcessMemory WriteProcessMemory CloseHandle OpenProcess GetLastError VirtualQueryEx CreateFileA GetWindowsDirectoryW GetModuleFileNameW OpenThread CreateThread GetLocalTime TerminateProcess SetEvent CreateProcessW FreeLibrary WaitForSingleObject lstrlenW lstrcatW DeleteFileW CopyFileW LoadLibraryW FindFirstFileW FindNextFileW FindClose lstrcpyW WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceW FindResourceExW InterlockedIncrement InterlockedDecrement GlobalAlloc GlobalLock GlobalUnlock GlobalFree Sleep IsDBCSLeadByte FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime ResumeThread FreeResource CreateEventW GetFileAttributesW GetTempPathW GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteFile InitializeCriticalSectionAndSpinCount RaiseException DeleteCriticalSection GetPrivateProfileSectionW GetSystemDefaultLCID ReadFile SetFilePointer GetSystemTimeAsFileTime

user32

DestroyWindow CreateWindowExW RegisterClassExW GetDlgItem EndDialog LoadIconW SendMessageW SetWindowTextW SetWindowPos LoadImageW ShowWindow GetClientRect DrawIconEx GetWindowThreadProcessId GetWindowTextW GetClassNameW EnumWindows GetWindowLongW EnumChildWindows PostMessageW GetDesktopWindow GetWindowTextLengthW GetKeyState CallWindowProcW SetTimer SendDlgItemMessageW EnableWindow GetSystemMenu GetMenuItemCount GetMenuItemID EnableMenuItem SetDlgItemTextW GetSysColorBrush KillTimer ClientToScreen SetWindowLongW MapWindowPoints GetWindowRect MapDialogRect InvalidateRect RegisterClipboardFormatW OpenClipboard EmptyClipboard SetClipboardData CloseClipboard DialogBoxParamW BeginPaint EndPaint GetDC DrawTextW ReleaseDC GetGuiResources IsWindow CreatePopupMenu TrackPopupMenu DestroyMenu DefWindowProcW GetClassInfoExW

gdi32

SetBkMode DeleteObject SetTextColor CreateFontW SelectObject GetStockObject

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegSetValueExW RegDeleteValueW RegCreateKeyExW

shell32

ord155 ShellExecuteW SHGetDesktopFolder ShellExecuteExW SHGetFileInfoW SHBindToParent SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal OleInitialize DoDragDrop OleUninitialize

oleaut32

SysStringLen SysAllocString SysFreeString SysAllocStringByteLen SysStringByteLen

gdiplus

GdipAlloc GdipFree GdiplusStartup GdipGetPropertyItem GdiplusShutdown GdipCreateFromHDC GdipDeleteGraphics GdipGetPropertyItemSize GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipLoadImageFromStreamICM GdipGetImageWidth GdipGetImageHeight GdipDrawImageRectI GdipDisposeImage GdipCloneImage GdipImageSelectActiveFrame

shlwapi

PathFileExistsW

msvcp140

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvCertFromChain WinVerifyTrust WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain

iphlpapi

GetAdaptersAddresses GetAdaptersInfo

netapi32

Netbios

vcruntime140

__CxxFrameHandler3 __std_terminate memcpy memset memmove _purecall wcsrchr wcschr wcsstr memcmp strchr strrchr _except_handler4_common __std_exception_copy __std_exception_destroy _CxxThrowException memchr

api-ms-win-crt-string-l1-1-0

_wcslwr_s wcsncpy strnlen wcsnlen tolower wmemcpy_s wcsncmp wcscmp _wcsicmp iswspace strcmp strncpy_s strlen wcscpy wcscat iswalnum wcscpy_s wcslen iswdigit wcscat_s towlower strncmp isalnum isspace iswalpha

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit terminate _seh_filter_exe _set_app_type _initialize_onexit_table _configure_wide_argv _beginthreadex __p___wargv __p___argc _get_wide_winmain_command_line _invalid_parameter_noinfo_noreturn _errno _initterm _initterm_e exit _exit _c_exit _register_thread_local_exe_atexit_callback _controlfp_s _initialize_wide_environment _invalid_parameter_noinfo _register_onexit_function

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc

api-ms-win-crt-stdio-l1-1-0

fwrite fread ftell fseek _wfopen __stdio_common_vfprintf __stdio_common_vsprintf_s __stdio_common_vswprintf_s __stdio_common_vswprintf __stdio_common_vswscanf _set_fmode fclose __stdio_common_vsprintf __p__commode

api-ms-win-crt-time-l1-1-0

_gmtime32 _time32 _time64

api-ms-win-crt-multibyte-l1-1-0

_mbscmp _mbsstr _mbslwr_s _mbsrchr _mbsicmp _mbschr

api-ms-win-crt-convert-l1-1-0

_wtoi atoi strtoul

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

1e7b8313e615a13ec162001a19e73b88379e702c5fa7ffddd603d3d9f7a4552b

version

dbghelp

wininet

psapi

comctl32

tinyxml

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

shlwapi

msvcp140

wtsapi32

crypt32

wintrust

iphlpapi

netapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic