4451397a689bd354fb2e8ef9ee15d1225aca97fe017892640e2bfb78fcac7402

Sharing

Copy URL Twitter E-mail

General

Target
4451397a689bd354fb2e8ef9ee15d1225aca97fe017892640e2bfb78fcac7402
Size 2.1MB
Sample261020-jfvb3sw18l
SHA256 4451397a689bd354fb2e8ef9ee15d1225aca97fe017892640e2bfb78fcac7402
MD5 b72dfcf797cf8dcadb7cfe3bd70f06b3
SHA1 f122fe36980bed2b051dad78a20716e14fdd1cda
SHA512 890383bdfd6714e5b0f80fca89694e41aeb64c654f897efddd10f6070ee715a60c49f6c38000d3b2c0e9e994738df44a660cc5e36a91323124cc9b43228550f7
SSDEEP 49152:M7w6qLBw1Xv7NbaDhIXwT1VAXB5n5PURiuu1wO8DfPsSt1FP:M7w1Bw1fyII+n5PldIfPsCXP
TLSH
T1ACA5D0207A82C132E5B281709D7DDB7A54B97B750B7580CBA3D81E2E09705C36F3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4451397a689bd354fb2e8ef9ee15d1225aca97fe017892640e2bfb78fcac7402

File Explorer

4451397a689bd354fb2e8ef9ee15d1225aca97fe017892640e2bfb78fcac7402

.exe 2.1MB

4451397a689bd354fb2e8ef9ee15d1225aca97fe017892640e2bfb78fcac7402

IMPHASH 8a220d4cd616a18910618572783b0931
SHA256 4451397a689bd354fb2e8ef9ee15d1225aca97fe017892640e2bfb78fcac7402
MD5 b72dfcf797cf8dcadb7cfe3bd70f06b3
SHA1 f122fe36980bed2b051dad78a20716e14fdd1cda
SHA512 890383bdfd6714e5b0f80fca89694e41aeb64c654f897efddd10f6070ee715a60c49f6c38000d3b2c0e9e994738df44a660cc5e36a91323124cc9b43228550f7
SSDEEP 49152:M7w6qLBw1Xv7NbaDhIXwT1VAXB5n5PURiuu1wO8DfPsSt1FP:M7w1Bw1fyII+n5PldIfPsCXP
TLSH
T1ACA5D0207A82C132E5B281709D7DDB7A54B97B750B7580CBA3D81E2E09705C36F3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

672635

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\WeiDuanGame\WdGameBox\WdGameBox\Release\LiteGameBox2.pdb

shell32

Shell_NotifyIconW SHBrowseForFolderW SHGetPathFromIDListW ord165 ShellExecuteExW SHFileOperationW ShellExecuteW SHChangeNotify SHGetSpecialFolderPathW SHCreateDirectoryExW

wininet

InternetCrackUrlW InternetGetCookieExW

iphlpapi

GetAdaptersInfo

kernel32

GetSystemDirectoryW GetTempPathW GetTempFileNameW CreateFileW Process32FirstW Process32NextW SleepEx OutputDebugStringA LocalAlloc LocalFree WaitForMultipleObjects GetStartupInfoW Module32FirstW Module32NextW MapViewOfFile UnmapViewOfFile CreateFileMappingW lstrcmpW GetLocalTime CreateThread GetSystemWindowsDirectoryW SetEvent CreateEventW DeleteFileA GetStringTypeW EncodePointer GetStdHandle GetFileSize SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LCMapStringW GetLocaleInfoW GetCPInfo VirtualFree VirtualAlloc Thread32Next Thread32First CreateToolhelp32Snapshot FlushInstructionCache SetThreadContext GetThreadContext ResumeThread SuspendThread OpenThread CompareStringW FreeResource DebugBreak VirtualQuery IsBadReadPtr GetModuleFileNameW LoadLibraryExW lstrcmpiW WaitForSingleObject SetErrorMode SetUnhandledExceptionFilter VirtualProtect InterlockedDecrement InterlockedIncrement GetVersionExW MoveFileExW FindNextFileW FindFirstFileW DeleteFileW GetFileAttributesW SetFileAttributesW GetFullPathNameW SetFilePointer RemoveDirectoryW GetModuleHandleW LoadLibraryW lstrlenW lstrcpynW GetTickCount CloseHandle FindClose Sleep SetLastError GetProcessId GetCurrentThread TerminateProcess GetCurrentProcessId GetCurrentProcess OpenProcess GetShortPathNameW GetProcAddress FreeLibrary WideCharToMultiByte CopyFileW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetCurrentThreadId FindResourceExW FindResourceW SizeofResource LoadResource DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException GetProcessHeap IsDebuggerPresent GetACP HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy LockResource DecodePointer HeapCreate OutputDebugStringW FlushFileBuffers ReadFile GlobalAlloc ExitProcess GlobalLock GlobalUnlock MulDiv InterlockedExchange InterlockedCompareExchange ResetEvent GetVersion MultiByteToWideChar GlobalFree SetEndOfFile UnhandledExceptionFilter IsProcessorFeaturePresent GetExitCodeThread WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW QueryPerformanceCounter InitializeSListHead SetFileTime SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LocalFileTimeToFileTime GetFileType SetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind CreateFileA lstrcmpiA lstrcmpA DeviceIoControl DosDateTimeToFileTime WriteFile

user32

GetParent FindWindowExW SystemParametersInfoW IsWindow SetWindowPos MapWindowPoints PostMessageW DestroyIcon LoadImageW PostQuitMessage DefWindowProcW CharNextW MessageBoxW SetWindowsHookExW SendMessageW ShowWindow IsWindowVisible SetFocus GetSystemMetrics UpdateWindow SetWindowTextW SetForegroundWindow RegisterWindowMessageW GetDC PtInRect GetWindow GetIconInfo PeekMessageW PostThreadMessageW GetMessageW IsRectEmpty GetWindowRect SwitchToThisWindow EnableWindow KillTimer SetTimer IsZoomed MoveWindow DestroyWindow ReleaseDC GetCursorPos wvsprintfW SetCursor InflateRect OffsetRect LoadCursorW TranslateMessage DispatchMessageW CreateWindowExW IsChild UpdateLayeredWindow GetFocus GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect ScreenToClient GetWindowLongW SetWindowLongW GetClassNameW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW GetMenu SetPropW GetPropW IntersectRect RemovePropW IsIconic SetWindowRgn MonitorFromWindow GetMonitorInfoW CopyRect CharPrevW DrawTextW SetRect DrawIconEx CreateCaret HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen GetSysColor CreateAcceleratorTableW InvalidateRgn FillRect SetLayeredWindowAttributes RedrawWindow GetWindowTextW GetWindowTextLengthW GetWindowDC AdjustWindowRectEx

gdi32

GetTextMetricsW SaveDC RestoreDC SelectObject GetTextExtentPoint32W GetStockObject GetDIBits DeleteObject LineTo RoundRect SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor CreateDIBSection SetWindowOrgEx TextOutW ExtTextOutW GetDeviceCaps CreateSolidBrush CreateDCW SetDIBitsToDevice Rectangle DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateRoundRectRgn GetObjectW CombineRgn CreateRectRgnIndirect GetCharABCWidthsW MoveToEx GetClipBox

advapi32

RegQueryValueExW OpenServiceW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA QueryServiceStatus OpenProcessToken OpenThreadToken GetTokenInformation EqualSid AllocateAndInitializeSid FreeSid RegCloseKey RegOpenKeyExW RegCreateKeyExW CloseServiceHandle RegDeleteKeyW DuplicateTokenEx GetLengthSid CreateWellKnownSid SetTokenInformation GetUserNameW RegCreateKeyW LookupPrivilegeValueW AdjustTokenPrivileges RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW OpenSCManagerW

ole32

OleLockRunning CreateStreamOnHGlobal CoCreateInstance CLSIDFromString CLSIDFromProgID CoInitialize CoUninitialize CoTaskMemAlloc CoInitializeSecurity CoCreateGuid CoTaskMemFree CoTaskMemRealloc

oleaut32

SafeArrayPutElement VariantChangeType SysAllocStringLen VariantInit VarUI4FromStr VariantClear SysFreeString SysAllocString SafeArrayCreate

shlwapi

PathFileExistsW PathIsDirectoryW PathCombineW SHSetValueW PathRemoveFileSpecW SHDeleteKeyW PathFindExtensionW PathFindFileNameW PathAppendW PathCanonicalizeW SHGetValueW wnsprintfW StrCmpIW StrStrIW StrStrIA StrTrimA StrCmpNIW SHSetValueA SHGetValueA AssocQueryStringW

comctl32

ord17 InitCommonControlsEx _TrackMouseEvent

psapi

EnumProcessModules EnumProcesses GetModuleFileNameExW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipGetPropertyItemSize GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectRectI GdipDrawImagePointsI GdipFillPath GdipGraphicsClear GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipLoadImageFromStream GdipCloneImage GdipDisposeImage GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipFillEllipseI GdipCreatePath GdipDeletePath ord1 GdipCreatePen1 GdipDeletePen GdipDrawPath GdipDrawEllipseI GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipLoadImageFromStreamICM GdipGetPropertyItem GdipDrawImageRectI GdipClosePathFigure GdipAddPathArcI GdipCreateTexture GdipSaveImageToFile GdipGetImageGraphicsContext GdipSetInterpolationMode GdipBitmapUnlockBits GdipBitmapLockBits GdipCloneBitmapAreaI GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap

urlmon

URLDownloadToCacheFileA

secur32

GetUserNameExW

winmm

timeGetTime

crypt32

CryptBinaryToStringW CryptStringToBinaryW CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

msimg32

GradientFill AlphaBlend

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

generic

count=32, id=241, version=40116,

count=178, id=243, version=40116,

count=34, id=242, version=40116,

count=2, id=264, version=27031,

count=1, productName=Unmarked objects (old),

count=15, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=261, version=27032,

count=4, id=199, version=41118,

count=24, id=259, version=26706,

count=81, id=261, version=26706,

count=35, id=260, version=26706,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=18, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=570, id=1, productName=Unmarked objects,

count=1, id=260, version=27043,

count=26, id=261, version=27043,

count=4, id=260, productName=VS2017 v15.8.5 build 26732, version=26732,

count=76, id=261, version=27031,

count=1, id=255, version=27031,

count=1, id=151,

count=1, id=258, version=27031,