888a77049d800abcdf24fab7cddef56a5cbd9803daf1d76e642ee6e6eabe7c19

General

Target
888a77049d800abcdf24fab7cddef56a5cbd9803daf1d76e642ee6e6eabe7c19
Size 133KB
Sample261027-e6x4fabt9p
SHA256 888a77049d800abcdf24fab7cddef56a5cbd9803daf1d76e642ee6e6eabe7c19
MD5 11bc7a2d26763cb0d85edf001f734fda
SHA1 fa6bda9a8bf632d854da520502374d7ec1864e82
SHA512 2f8b41543dc955cbbaa6f8c456ff866e94e0e5680f714f1e78d5a622e4749ff38348cd5b3560c66834c1f717550ae6276439c7bc30450195c8847025d0d70cc7
SSDEEP 3072:6RFaHlycZOgiTptaQihWc2lbpRHPmmRRI4cm33:CFwllOJTbaDhulbk83
TLSH
T110D37B06B180C072D8BE16385470C7B65B7EB830DF546DDB67940ABAAE706C1DE35E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
888a77049d800abcdf24fab7cddef56a5cbd9803daf1d76e642ee6e6eabe7c19

File Explorer

888a77049d800abcdf24fab7cddef56a5cbd9803daf1d76e642ee6e6eabe7c19

.dll 133KB

888a77049d800abcdf24fab7cddef56a5cbd9803daf1d76e642ee6e6eabe7c19

IMPHASH cdd42c264bacf432f4003380d6c8ce27
SHA256 888a77049d800abcdf24fab7cddef56a5cbd9803daf1d76e642ee6e6eabe7c19
MD5 11bc7a2d26763cb0d85edf001f734fda
SHA1 fa6bda9a8bf632d854da520502374d7ec1864e82
SHA512 2f8b41543dc955cbbaa6f8c456ff866e94e0e5680f714f1e78d5a622e4749ff38348cd5b3560c66834c1f717550ae6276439c7bc30450195c8847025d0d70cc7
SSDEEP 3072:6RFaHlycZOgiTptaQihWc2lbpRHPmmRRI4cm33:CFwllOJTbaDhulbk83
TLSH
T110D37B06B180C072D8BE16385470C7B65B7EB830DF546DDB67940ABAAE706C1DE35E27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16956

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\HWSignature.pdb

ws2_32

WSAStartup

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

EnterCriticalSection CreateFileW DecodePointer GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte HeapFree DeviceIoControl lstrcatA CopyFileA CreateFileA GetSystemDirectoryA CloseHandle HeapAlloc GetProcessHeap lstrcpyA lstrlenA GlobalAlloc LocalAlloc GetLastError LoadLibraryA GetVersionExA GetProcAddress LocalFree FreeLibrary HeapReAlloc SetLastError GlobalFree GetTickCount GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind WriteConsoleW LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException ExitProcess GetModuleHandleExW GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetFilePointerEx GetStringTypeW SetStdHandle HeapSize

user32

IsCharAlphaNumericA wsprintfA

Sharing

General

Malware Config

Signatures

File Explorer

888a77049d800abcdf24fab7cddef56a5cbd9803daf1d76e642ee6e6eabe7c19

ws2_32

version

kernel32

user32

generic