edba07086077c14d73fa5fcc808b33fb6f5e5de9a2651332770c01f6f050b406

Sharing

Copy URL Twitter E-mail

General

Target
edba07086077c14d73fa5fcc808b33fb6f5e5de9a2651332770c01f6f050b406
Size 4.1MB
Sample261020-hedr9sd19x
SHA256 edba07086077c14d73fa5fcc808b33fb6f5e5de9a2651332770c01f6f050b406
MD5 3e9dc8ec200efa2a34979a4e2e76eb63
SHA1 ebd49010f8221c8eaf2eb447f9b1d50cd62b50da
SHA512 ccf542990590e30e2c520c2dca9fe8ef75ea800e135d39f9627140bddb8cbcb29069ba49b9da29ec2bef27da7003f611abc1780f922f481bd57abaf2ee4cdce2
SSDEEP 49152:h09KgGCvA5iN5ft6I4ylTytbJDNDy4d0F5wg99BEQkdmvg+PAlloHg:h09KgGYvsIZyttH25b99BEwnPAP
TLSH
T1E4167D213A48C136CD6223F29E3D9A9E550D6D340BA511DFA39C7B7E5D701E36E30A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edba07086077c14d73fa5fcc808b33fb6f5e5de9a2651332770c01f6f050b406

File Explorer

edba07086077c14d73fa5fcc808b33fb6f5e5de9a2651332770c01f6f050b406

.exe 4.1MB

edba07086077c14d73fa5fcc808b33fb6f5e5de9a2651332770c01f6f050b406

IMPHASH 9ac32c68da29e6c89bde0bfd518c8fcf
SHA256 edba07086077c14d73fa5fcc808b33fb6f5e5de9a2651332770c01f6f050b406
MD5 3e9dc8ec200efa2a34979a4e2e76eb63
SHA1 ebd49010f8221c8eaf2eb447f9b1d50cd62b50da
SHA512 ccf542990590e30e2c520c2dca9fe8ef75ea800e135d39f9627140bddb8cbcb29069ba49b9da29ec2bef27da7003f611abc1780f922f481bd57abaf2ee4cdce2
SSDEEP 49152:h09KgGCvA5iN5ft6I4ylTytbJDNDy4d0F5wg99BEQkdmvg+PAlloHg:h09KgGYvsIZyttH25b99BEwnPAP
TLSH
T1E4167D213A48C136CD6223F29E3D9A9E550D6D340BA511DFA39C7B7E5D701E36E30A3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

868862

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\bizhi_install\bizhi_install\trunk\Release\Uninstall.pdb

kernel32

WaitForSingleObject SetEvent GetLocalTime WritePrivateProfileStringW GetPrivateProfileStringW InitializeCriticalSectionAndSpinCount SetLastError GetCurrentThreadId RaiseException GetVersionExW LocalFree LoadLibraryW DeleteCriticalSection GetProcAddress FreeLibrary WideCharToMultiByte MultiByteToWideChar DeleteFileW FindResourceExW FindResourceW SizeofResource LoadResource LockResource ReadFile GetFileSize UnlockFile LockFile Process32NextW Process32FirstW CreateToolhelp32Snapshot GetModuleFileNameW CreateMutexW LeaveCriticalSection EnterCriticalSection CreateDirectoryW GetTempFileNameW SetFileTime FindCloseChangeNotification SetEndOfFile WriteConsoleW SetFilePointerEx ReadConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP FindFirstChangeNotificationW CompareFileTime GetFileInformationByHandle CopyFileW SetCurrentDirectoryW GetTempPathW LoadLibraryExW lstrcmpiW Sleep GetCurrentProcess InterlockedDecrement CreateEventW DecodePointer RemoveDirectoryW GetShortPathNameW GetModuleHandleW GetCurrentDirectoryW InitializeCriticalSection GetCurrentProcessId OpenProcess GetLongPathNameW GetLastError GetFileAttributesExW CreateFileW CreateFileMappingW UnmapViewOfFile IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler GetConsoleMode GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetFileType GetCurrentThread GetACP GetStdHandle GetModuleFileNameA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread InterlockedFlushSList RtlUnwind lstrcmpiA lstrcmpA GetSystemWindowsDirectoryW FreeResource QueryPerformanceCounter WaitForSingleObjectEx ResetEvent SetUnhandledExceptionFilter UnhandledExceptionFilter GlobalFree MapViewOfFile CloseHandle SetFilePointer GlobalUnlock GlobalLock GlobalAlloc FlushFileBuffers GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo GetSystemTimeAsFileTime InterlockedIncrement SearchPathW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread FormatMessageW LoadLibraryExA VirtualFree VirtualAlloc GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InitializeCriticalSectionEx TerminateProcess GetExitCodeProcess FindClose GetTickCount lstrlenW GetFullPathNameW SetFileAttributesW GetFileAttributesW FindFirstFileW FindNextFileW MoveFileExW GetWindowsDirectoryW MoveFileW WriteFile GetLogicalDriveStringsW GetDriveTypeW GetSystemDirectoryW GetDiskFreeSpaceExW GetFileSizeEx OutputDebugStringA OutputDebugStringW CreateProcessW GetStartupInfoW GetTempPathA GetTempFileNameA CreateFileA DeleteFileA InterlockedExchange InterlockedCompareExchange WaitForMultipleObjects DeviceIoControl LocalAlloc IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList

user32

KillTimer CharNextW PeekMessageW DispatchMessageW TranslateMessage GetMessageW DefWindowProcW OffsetRect GetActiveWindow EndDialog DialogBoxParamW GetMonitorInfoW SendMessageW RegisterWindowMessageW SendMessageTimeoutW PostMessageW FindWindowW CopyRect UnionRect EqualRect PtInRect DrawFocusRect SetCursor MoveWindow UnregisterClassA MonitorFromWindow GetWindow MapWindowPoints SetForegroundWindow IsIconic IsWindowVisible PostQuitMessage SetTimer GetWindowTextLengthW GetWindowTextW SetWindowTextW DrawTextW GetFocus SetFocus LoadCursorW SetWindowPos ShowWindow GetClassInfoExW RegisterClassExW UnregisterClassW GetParent SetWindowLongW GetWindowLongW ScreenToClient GetWindowRect GetClientRect InvalidateRect EndPaint BeginPaint ReleaseDC GetDC ReleaseCapture SetCapture GetAsyncKeyState UpdateLayeredWindow DestroyWindow IsWindow CreateWindowExW CallWindowProcW FindWindowExW GetWindowThreadProcessId FillRect SendNotifyMessageW GetShellWindow wsprintfW IsDialogMessageW

gdi32

SelectObject SetViewportOrgEx SetTextColor SetBkMode GetStockObject GetObjectW CreateDIBSection SelectClipRgn SaveDC RestoreDC DeleteObject DeleteDC CreateRectRgnIndirect CreateCompatibleDC CreateCompatibleBitmap BitBlt RectVisible OffsetViewportOrgEx CreateFontW EnumFontFamiliesW

advapi32

OpenProcessToken RegOpenKeyExA RegEnumKeyExA GetTokenInformation CryptContextAddRef CryptDecrypt CryptEncrypt CryptImportKey CryptGenRandom CryptSetKeyParam RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey CryptDestroyKey AdjustTokenPrivileges LookupPrivilegeValueW DuplicateTokenEx RegEnumValueW RegQueryValueExW CloseServiceHandle ControlService DeleteService OpenSCManagerW OpenServiceW QueryServiceStatus GetUserNameW ChangeServiceConfigW ChangeServiceConfig2W CreateServiceW LockServiceDatabase QueryServiceConfigW QueryServiceConfig2W QueryServiceLockStatusW StartServiceW UnlockServiceDatabase CryptAcquireContextW CryptReleaseContext RegQueryValueExA

shell32

SHFileOperationW SHChangeNotify SHGetFolderPathW SHGetSpecialFolderPathW ord165 CommandLineToArgvW ShellExecuteExW SHCreateDirectoryExW ShellExecuteW

ole32

CoSetProxyBlanket CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateGuid CoUninitialize CoInitialize CoCreateInstance OleRun CoInitializeSecurity CreateStreamOnHGlobal CoInitializeEx

oleaut32

VariantCopy SysStringByteLen SysAllocStringByteLen SysAllocString VariantClear VariantInit SysStringLen GetErrorInfo VariantChangeType SetErrorInfo CreateErrorInfo SysFreeString VarUI4FromStr

shlwapi

PathIsRootW PathIsRelativeW PathFindExtensionW SHDeleteValueW SHSetValueW PathCombineW SHGetValueW AssocQueryStringW PathFileExistsW PathAppendW PathFindFileNameW StrStrIW StrToIntExW SHGetValueA StrCmpIW StrStrIA wnsprintfW SHDeleteKeyW StrTrimA PathFindFileNameA PathRenameExtensionA PathIsPrefixW SHSetValueA StrCmpNIW PathRemoveFileSpecW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdiplusStartup GdiplusShutdown GdipSetStringFormatTrimming GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipAlloc GdipFree GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipGetImageWidth GdipGetImageHeight GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateFromHDC GdipDeleteGraphics GdipSetTextRenderingHint GdipDrawRectangleI GdipFillRectangleI GdipDrawImagePointRectI GdipDrawImageRectRect GdipDrawImageRectRectI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

EnumProcesses GetModuleFileNameExW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

secur32

GetUserNameExW

setupapi

SetupIterateCabinetW

crypt32

CertGetNameStringW CryptStringToBinaryA CryptStringToBinaryW CryptBinaryToStringA CryptBinaryToStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

generic

count=17, id=241, version=40116,

count=163, id=243, version=40116,

count=30, id=242, version=40116,

count=1, id=261, version=27054,

count=4, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=2, id=264, version=27045,

count=1, productName=Unmarked objects (old),

count=2, id=199, version=41118,

count=24, id=259, version=26706,

count=9, id=261, version=27048,

count=35, id=260, version=26706,

count=22, id=261, version=27051,

count=74, id=261, version=26706,

count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=435, id=1, productName=Unmarked objects,

count=1, id=260, version=27045,

count=76, id=261, version=27045,

count=1, id=255, version=27045,

count=1, id=151,

count=1, id=258, version=27045,