35019f7e36fffe7d2c5e081ec5b895b9119b957de1b282c9f22190b25664faa5

Sharing

Copy URL Twitter E-mail

General

Target
35019f7e36fffe7d2c5e081ec5b895b9119b957de1b282c9f22190b25664faa5
Size 2.0MB
Sample261020-hapnzawv8n
SHA256 35019f7e36fffe7d2c5e081ec5b895b9119b957de1b282c9f22190b25664faa5
MD5 272e55fa7298f135850d4fdcb606be04
SHA1 52c1208e7aae282a2eb6255154f80862e694f472
SHA512 0ac96c76181b29842ef14a72019b2c92305e883afc7b464fc1e439d1bf1963ed4811c1d9e2d81b7e6947e19f03179263fb7df740331368cc1f667ea130764b13
SSDEEP 49152:a5UhCFHsZelmOvJvt/j1nw3NQewJv35mV:aqimOBV/hnw3NpO5mV
TLSH
T188A5F1D16605C53ED95300F09B769AAE102DDF8487E55CC3ABC83AED6F709D21A33A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35019f7e36fffe7d2c5e081ec5b895b9119b957de1b282c9f22190b25664faa5

File Explorer

35019f7e36fffe7d2c5e081ec5b895b9119b957de1b282c9f22190b25664faa5

.exe 2.0MB

35019f7e36fffe7d2c5e081ec5b895b9119b957de1b282c9f22190b25664faa5

IMPHASH 55ad07890b9f3c9d308dadb00e8ec550
SHA256 35019f7e36fffe7d2c5e081ec5b895b9119b957de1b282c9f22190b25664faa5
MD5 272e55fa7298f135850d4fdcb606be04
SHA1 52c1208e7aae282a2eb6255154f80862e694f472
SHA512 0ac96c76181b29842ef14a72019b2c92305e883afc7b464fc1e439d1bf1963ed4811c1d9e2d81b7e6947e19f03179263fb7df740331368cc1f667ea130764b13
SSDEEP 49152:a5UhCFHsZelmOvJvt/j1nw3NQewJv35mV:aqimOBV/hnw3NpO5mV
TLSH
T188A5F1D16605C53ED95300F09B769AAE102DDF8487E55CC3ABC83AED6F709D21A33A1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

258436

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\baidu\netdisk\pc-common\output\libcef\Release\TeraBoxRender.pdb

libcef

cef_log cef_process_message_create cef_dictionary_value_create cef_v8context_get_current_context cef_v8value_create_bool cef_execute_process cef_v8value_create_string cef_v8value_create_function cef_string_list_size cef_string_list_value cef_string_list_append cef_string_map_size cef_string_map_key cef_string_map_value cef_string_map_append cef_string_multimap_size cef_string_multimap_key cef_string_multimap_value cef_string_multimap_append cef_string_multimap_alloc cef_string_multimap_free cef_post_task cef_api_hash cef_command_line_create cef_string_map_free cef_string_map_alloc cef_string_list_free cef_string_list_alloc cef_v8value_create_int cef_string_userfree_utf16_free cef_register_extension cef_string_utf16_to_utf8 cef_string_utf8_clear cef_string_utf16_cmp cef_string_utf8_to_utf16 cef_string_utf16_set cef_string_utf16_clear

kernel32

GetStartupInfoW OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter CreateFileW CloseHandle SetEnvironmentVariableW GetCommandLineW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap InitializeCriticalSectionAndSpinCount GetLastError DeleteCriticalSection GetModuleFileNameW SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter GetProcAddress GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent SetEvent LeaveCriticalSection EnterCriticalSection IsProcessorFeaturePresent TerminateProcess GetCurrentProcess IsDebuggerPresent

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?_BADOFF@std@@3_JB ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z ?uncaught_exception@std@@YA_NXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

vcruntime140

__vcrt_InitializeCriticalSectionEx memset memcpy _except_handler4_common _CxxThrowException __CxxFrameHandler3 memchr wcsrchr _purecall __std_exception_copy __std_exception_destroy __std_terminate memmove

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vsprintf_s

api-ms-win-crt-runtime-l1-1-0

_get_wide_winmain_command_line _initterm _initterm_e exit _exit _initialize_onexit_table _c_exit _register_thread_local_exe_atexit_callback _initialize_wide_environment _configure_wide_argv _controlfp_s _set_app_type _seh_filter_exe _cexit _crt_atexit _invalid_parameter_noinfo_noreturn terminate _invalid_parameter_noinfo _errno _register_onexit_function

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh

api-ms-win-crt-string-l1-1-0

isdigit strpbrk

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-filesystem-l1-1-0

_waccess

api-ms-win-crt-math-l1-1-0

__setusermatherr _except1

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

270KB

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

375KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

35019f7e36fffe7d2c5e081ec5b895b9119b957de1b282c9f22190b25664faa5

libcef

kernel32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic