52ee35b790a758a9e91ccb8729fa1864a49be4b5b4ac018de982d668fec508dc

General

Target
52ee35b790a758a9e91ccb8729fa1864a49be4b5b4ac018de982d668fec508dc
Size 1.7MB
Sample261017-cjhdcsvvbv
SHA256 52ee35b790a758a9e91ccb8729fa1864a49be4b5b4ac018de982d668fec508dc
MD5 0e9e35cbd5efcba269e6908d97613a9c
SHA1 787ec76ae4331e374c4911159a9ea05f8e43e649
SHA512 77560495b523e2a63ed1168f6f949857b632c75f7694cb2f83584f2a37df86cb841c595db978940acc3eef4ab60b5daad96d25cd32f920b70d6eaa477ff9bc42
SSDEEP 24576:rJHGKa6rv8IABtWGBX+GIZUmgfysF4aD0gvtl3Bf6z5g7oM9xdml4ZFKGz:5a65nGh+GIZUmHs21gvtlxSGLdrFxz
TLSH
T1B185BF20B616D233D56181F24DB8AFB6906DAD381F750ACF67C42B3E45362D26F31E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52ee35b790a758a9e91ccb8729fa1864a49be4b5b4ac018de982d668fec508dc

File Explorer

52ee35b790a758a9e91ccb8729fa1864a49be4b5b4ac018de982d668fec508dc

.exe 1.7MB

52ee35b790a758a9e91ccb8729fa1864a49be4b5b4ac018de982d668fec508dc

IMPHASH ffa2750cbab007c8a3aee42ba562902d
SHA256 52ee35b790a758a9e91ccb8729fa1864a49be4b5b4ac018de982d668fec508dc
MD5 0e9e35cbd5efcba269e6908d97613a9c
SHA1 787ec76ae4331e374c4911159a9ea05f8e43e649
SHA512 77560495b523e2a63ed1168f6f949857b632c75f7694cb2f83584f2a37df86cb841c595db978940acc3eef4ab60b5daad96d25cd32f920b70d6eaa477ff9bc42
SSDEEP 24576:rJHGKa6rv8IABtWGBX+GIZUmgfysF4aD0gvtl3Bf6z5g7oM9xdml4ZFKGz:5a65nGh+GIZUmHs21gvtlxSGLdrFxz
TLSH
T1B185BF20B616D233D56181F24DB8AFB6906DAD381F750ACF67C42B3E45362D26F31E26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

506371

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_1p3u4\master_kso_v12\Build\Release\WPSOffice\office6\wpscloudsvr.pdb

kernel32

SetCurrentDirectoryW FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW WideCharToMultiByte GetCommandLineW CloseHandle GetLastError Sleep GetCurrentProcessId TerminateProcess GetCurrentThreadId OpenProcess GetSystemDirectoryW GetSystemWow64DirectoryW GetModuleHandleW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject WaitForMultipleObjects CreateThread QueueUserWorkItem UnregisterWaitEx LocalFree GetEnvironmentVariableW SetEnvironmentVariableW GetDriveTypeW GetTempPathW GetStartupInfoW GetTickCount SetDllDirectoryW GetDllDirectoryW CopyFileW GetSystemTime SystemTimeToFileTime GetExitCodeProcess VerSetConditionMask GetCurrentProcess LocalAlloc VerifyVersionInfoW CreateFileW FindClose FindFirstFileW FindNextFileW SetEvent CreateEventW ReadFile WriteFile SetNamedPipeHandleState WaitNamedPipeW GetOverlappedResult CancelIo FlushFileBuffers ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateDirectoryW GetFileAttributesW ReadProcessMemory MultiByteToWideChar SetUnhandledExceptionFilter LoadLibraryExW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount FindResourceExW LoadResource LockResource SizeofResource FindResourceW GetFileAttributesExW SetErrorMode GetModuleHandleExW VirtualAlloc VirtualFree lstrlenW GetPrivateProfileIntW GetPrivateProfileStringW CreateProcessW ExpandEnvironmentStringsW GetLongPathNameW GetCurrentThread ProcessIdToSessionId WTSGetActiveConsoleSessionId GetFileSize SetFilePointer OutputDebugStringA SetLastError QueryPerformanceCounter QueryPerformanceFrequency SetStdHandle GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetStringTypeW FindFirstFileExW SetEndOfFile SetFilePointerEx EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetCPInfo ResetEvent WaitForSingleObjectEx InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter OutputDebugStringW RtlUnwind InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree SetConsoleCtrlHandler GetStdHandle ExitProcess GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode GetFileSizeEx ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

52ee35b790a758a9e91ccb8729fa1864a49be4b5b4ac018de982d668fec508dc

kernel32

generic