销售如何通过聊天促进成交v1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
销售如何通过聊天促进成交v1.exe
Size 2.5MB
Sample261024-nts4dstyey
SHA256 b719e7d31d91426530b8daa0ac4a93fb9ebc0a7d91e028f7c2a534c90758bf17
MD5 4f3b05d2431d4fe1ac802437f96b1e89
SHA1 800ca1eea5446644a2b0937e023a5fb8c896de45
SHA512 f65c3735ec553637b9bf3426938cd054b2d67639a07948e6e47c38c1728a1ae8877ca02b5d6daa78933ff7da08ac8bef78d525dae8f2e60bd54504bd0cb5338f
SSDEEP 49152:nThyCNieIWGidGwh8+njpoZhZ7mp7epFs7/lR5FgaFjdnG34RGssktgBWTtgwd3L:NCWjJZd0sskmD94p
TLSH
T1BCC57C21BC408531FBE312FBC5FCB92559ED9610072952D7875C092EAFA06E36B329B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
销售如何通过聊天促进成交v1.exe

File Explorer

销售如何通过聊天促进成交v1.exe

.exe 2.5MB

销售如何通过聊天促进成交v1.exe

IMPHASH 6fc282fdd39bf7e08e336e60b92c9d3f
SHA256 b719e7d31d91426530b8daa0ac4a93fb9ebc0a7d91e028f7c2a534c90758bf17
MD5 4f3b05d2431d4fe1ac802437f96b1e89
SHA1 800ca1eea5446644a2b0937e023a5fb8c896de45
SHA512 f65c3735ec553637b9bf3426938cd054b2d67639a07948e6e47c38c1728a1ae8877ca02b5d6daa78933ff7da08ac8bef78d525dae8f2e60bd54504bd0cb5338f
SSDEEP 49152:nThyCNieIWGidGwh8+njpoZhZ7mp7epFs7/lR5FgaFjdnG34RGssktgBWTtgwd3L:NCWjJZd0sskmD94p
TLSH
T1BCC57C21BC408531FBE312FBC5FCB92559ED9610072952D7875C092EAFA06E36B329B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1693310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\liebao_src_pool\release.b57_stable_8003\src_import\build\Release\DesktopTips.pdb

psapi

QueryWorkingSet GetProcessMemoryInfo GetPerformanceInfo GetMappedFileNameW EnumProcessModules EnumProcesses GetModuleFileNameExW

dbghelp

SymGetModuleBase64 SymSetOptions SymFunctionTableAccess64 SymInitialize SymFromAddr SymGetLineFromAddr64 StackWalk64

winmm

timeGetTime timeBeginPeriod timeEndPeriod

kernel32

FindNextFileW GetFileAttributesW OutputDebugStringW GetCurrentProcessId GetExitCodeProcess CreateProcessW GetStartupInfoW OpenProcess GetTickCount GetVersionExW LocalFree WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW SetLastError GlobalAlloc GlobalLock GlobalUnlock MulDiv lstrcmpW GetCurrentProcess VirtualAllocEx VirtualFreeEx ReadProcessMemory WriteProcessMemory QueryDosDeviceW WaitForSingleObject TerminateProcess CreateDirectoryW Sleep CreateThread FindClose ExpandEnvironmentStringsW GetFullPathNameW GetLongPathNameW SetFileAttributesW DeviceIoControl FindResourceExW LockResource GetWindowsDirectoryW GetCurrentThread GetTempFileNameW GetTempPathW GetCommandLineW GetVolumeInformationW RemoveDirectoryW GetVolumePathNameW GetLogicalDriveStringsW GetFileAttributesExW GetCurrentDirectoryW SetCurrentDirectoryW MoveFileExW ReplaceFileW CopyFileW MoveFileW GetFileSizeEx SetFileTime LockFile SetEndOfFile DuplicateHandle GetFileInformationByHandle UnlockFile SetFilePointerEx FlushFileBuffers TryEnterCriticalSection SetThreadPriority TzSpecificLocalTimeToSystemTime FileTimeToSystemTime QueryPerformanceFrequency GetThreadPriority SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime QueryPerformanceCounter IsDebuggerPresent WaitForMultipleObjects CreateEventW SetEvent ResetEvent OutputDebugStringA OpenFileMappingW FormatMessageA VirtualQuery SetPriorityClass FindFirstFileW FindResourceW SetHandleInformation GetStdHandle AssignProcessToJobObject CreatePipe ResumeThread AttachConsole AllocConsole FindFirstFileExW GetProcessId SwitchToThread GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort GetModuleHandleExW GetDiskFreeSpaceExW GlobalMemoryStatusEx QueueUserWorkItem GetNativeSystemInfo RtlCaptureStackBackTrace SetUnhandledExceptionFilter TlsSetValue TlsAlloc TlsGetValue TlsFree VirtualFree VirtualAlloc SetEnvironmentVariableW GetEnvironmentVariableW HeapLock HeapWalk HeapUnlock GetModuleHandleA GetUserDefaultLangID GetModuleHandleExA GetProcessIoCounters GetSystemInfo GetProcessTimes VirtualQueryEx RegisterWaitForSingleObject UnregisterWaitEx InitializeCriticalSection HeapSetInformation DeleteFileA ReleaseMutex CreateMutexA GetModuleFileNameA CreateFileMappingA GetPrivateProfileIntA GetPrivateProfileStringA GetTempPathA GetComputerNameA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetACP ReadConsoleW ExitProcess GetConsoleMode GetConsoleCP GetFileType SetStdHandle GetFullPathNameA FreeLibraryAndExitThread ExitThread VirtualProtect InterlockedFlushSList RtlUnwind LoadLibraryExA FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetStringTypeW FormatMessageW GetPriorityClass MultiByteToWideChar CreateFileMappingW GetCurrentThreadId DeleteCriticalSection lstrcmpiW SizeofResource LoadResource LoadLibraryExW GetModuleFileNameW LeaveCriticalSection EnterCriticalSection LoadLibraryW lstrlenW FreeLibrary GetSystemDirectoryW GetProcAddress GetModuleHandleW UnmapViewOfFile SetInformationJobObject MapViewOfFile InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException CloseHandle DecodePointer WriteFile SetFilePointer ReadFile GetFileSize DeleteFileW CreateFileW SetConsoleCtrlHandler GetDriveTypeW WriteConsoleW GetTimeZoneInformation FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetLocalTime WaitForSingleObjectEx

user32

LoadCursorW FillRect GetSysColor ScreenToClient ClientToScreen PostMessageW UpdateWindow SetRect PtInRect FindWindowW FindWindowA GetAncestor wsprintfW UnregisterClassW GetMessageW TranslateMessage GetActiveWindow PeekMessageW DefWindowProcW DestroyWindow CharNextW GetDesktopWindow MonitorFromWindow GetMonitorInfoW ShowWindow AnimateWindow SetLayeredWindowAttributes MoveWindow GetClientRect RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus PostQuitMessage KillTimer GetQueueStatus CallMsgFilterW MsgWaitForMultipleObjectsEx SetTimer MessageBoxW SetCursor MapWindowPoints LoadImageW GetWindowDC SetWindowTextW GetWindowPlacement OffsetRect UpdateLayeredWindow CreateDialogParamW DispatchMessageW SetFocus GetDlgItem IsChild SetWindowPos IsIconic IsZoomed MsgWaitForMultipleObjects GetSystemMetrics GetForegroundWindow GetWindowTextW GetWindowTextLengthW GetWindowRect GetCursorPos WindowFromPoint GetWindowLongW SetWindowLongW GetParent SetParent FindWindowExW GetWindow GetClassNameW GetWindowThreadProcessId SendMessageW CallWindowProcW RegisterClassExW GetClassInfoExW CreateWindowExW IsWindow

gdi32

DeleteObject CreateSolidBrush GetStockObject SelectObject GetObjectW CreateCompatibleDC GetDeviceCaps DeleteDC BitBlt GetObjectA CreateDIBSection CreateCompatibleBitmap

advapi32

OpenProcessToken RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW AddAce CopySid GetAce GetAclInformation GetLengthSid GetSidLengthRequired GetSidSubAuthority InitializeAcl InitializeSid IsValidSid GetNamedSecurityInfoW SetNamedSecurityInfoW CreateProcessAsUserW DuplicateTokenEx SetTokenInformation LookupAccountSidW ConvertStringSidToSidW SetThreadToken OpenThreadToken ImpersonateSelf RevertToSelf AdjustTokenPrivileges SystemFunction036 RegEnumValueW RegNotifyChangeKeyValue RegQueryValueExW RegOpenKeyW GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCloseKey LookupPrivilegeValueW

shell32

ShellExecuteW SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteExW SHGetSpecialFolderPathA CommandLineToArgvW

ole32

CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoUninitialize CoGetClassObject CLSIDFromString CLSIDFromProgID StringFromGUID2 OleLockRunning CoGetMalloc CoInitializeEx CoCreateGuid CreateStreamOnHGlobal

oleaut32

SysStringLen LoadTypeLi LoadRegTypeLi DispCallFunc OleCreateFontIndirect VariantCopy VariantClear VariantInit SysFreeString SysAllocStringLen SysAllocString VarUI4FromStr

shlwapi

StrCpyNW StrCmpIW StrRChrW StrCmpNIW StrCmpNW ord12 PathRemoveExtensionW PathAppendW PathRemoveFileSpecW PathCombineW SHSetValueA PathFindFileNameA PathRemoveFileSpecA SHGetValueW SHSetValueW SHGetValueA StrChrW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipReleaseDC GdipGetDC GdipGraphicsClear GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipDrawString GdipSetTextRenderingHint GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipTranslateWorldTransform GdipSaveGraphics GdipDeleteStringFormat GdipSetClipRectI GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipSetImageAttributesColorMatrix GdipRestoreGraphics GdipCreateImageAttributes GdipCreateFontFromDC GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDeleteFont GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdipDrawImageRectRectI GdipGetImageHeight GdipGetImageWidth GdiplusShutdown GdiplusStartup GdipDisposeImageAttributes GdipDrawImageRectI GdipMeasureString GdipCreateStringFormat GdipDeleteGraphics GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipCreateFontFromLogfontA

urlmon

CoInternetGetSession URLDownloadToFileW

oleacc

GetRoleTextW AccessibleChildren AccessibleObjectFromWindow

version

GetFileVersionInfoSizeA VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueA GetFileVersionInfoA

userenv

UnloadUserProfile CreateEnvironmentBlock DestroyEnvironmentBlock LoadUserProfileW

mpr

WNetGetResourceInformationW

wininet

DeleteUrlCacheEntryW

iphlpapi

GetAdaptersInfo

ws2_32

ioctlsocket inet_addr

generic

count=22, id=241, version=40116,

count=171, id=243, version=40116,

count=32, id=242, version=40116,

count=4, id=261, version=23013,

count=6, id=199, version=41118,

count=26, id=259, version=24123,

count=67, id=261, version=24123,

count=35, id=260, version=24123,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=495, id=1, productName=Unmarked objects,

count=196, id=265, version=24215,

count=21, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=77, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=3, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,