ed591c30ec74cf4c102ccbcb796595f25ddc268624846e88e0b297af02b8ae51

Sharing

Copy URL Twitter E-mail

General

Target
ed591c30ec74cf4c102ccbcb796595f25ddc268624846e88e0b297af02b8ae51
Size 1.5MB
Sample261027-jcc9dsda27
SHA256 ed591c30ec74cf4c102ccbcb796595f25ddc268624846e88e0b297af02b8ae51
MD5 c0384c0ea4977e529a58be1959fcd594
SHA1 78fe81e89c008dd9fb2e93fa3bc01cd51c0eb138
SHA512 17db86c64703624ef22618d7f9918ead3e44ff92d5e9252e8b3868a7ad6ec78bfe00032a30740bdfb476ea3c11448a57fc735e172eec3e8d0aecdd3f47f46102
SSDEEP 24576:KiqK+5ykG32nuMGUAOHnVAYsqjnhMgeiCl7G0nehbGZpbD:R65lG32nuxUzHVAEDmg27RnWGj
TLSH
T1D075E0217789C236CA6141B0176DDF5A94AE7E288FB005CB63C53E7E99309E25A31F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed591c30ec74cf4c102ccbcb796595f25ddc268624846e88e0b297af02b8ae51

File Explorer

ed591c30ec74cf4c102ccbcb796595f25ddc268624846e88e0b297af02b8ae51

.exe 1.5MB

ed591c30ec74cf4c102ccbcb796595f25ddc268624846e88e0b297af02b8ae51

IMPHASH 5904630d4234b0e82e44508adb8ba4d6
SHA256 ed591c30ec74cf4c102ccbcb796595f25ddc268624846e88e0b297af02b8ae51
MD5 c0384c0ea4977e529a58be1959fcd594
SHA1 78fe81e89c008dd9fb2e93fa3bc01cd51c0eb138
SHA512 17db86c64703624ef22618d7f9918ead3e44ff92d5e9252e8b3868a7ad6ec78bfe00032a30740bdfb476ea3c11448a57fc735e172eec3e8d0aecdd3f47f46102
SSDEEP 24576:KiqK+5ykG32nuMGUAOHnVAYsqjnhMgeiCl7G0nehbGZpbD:R65lG32nuxUzHVAEDmg27RnWGj
TLSH
T1D075E0217789C236CA6141B0176DDF5A94AE7E288FB005CB63C53E7E99309E25A31F37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

161752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\zhanlue\2345uninst\bin\Win32\Release\pdb\2345Uninst.pdb

kernel32

FindFirstFileW GetLongPathNameW CreateFileW GetFileAttributesExW CreateMutexW WaitForSingleObject ReleaseMutex GetCurrentProcess TerminateProcess OpenProcess GetCurrentProcessId LoadLibraryW FreeLibrary EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection FindNextFileW FindClose ReadFile WriteFile SetFilePointer SetEndOfFile GetFileSize FormatMessageW LocalFree CreateDirectoryW GetFullPathNameW lstrlenW RemoveDirectoryW GetTempPathW GetFileAttributesW SetFileAttributesW DeleteFileW MoveFileExW MoveFileW HeapFree GetCurrentThreadId HeapAlloc GetProcessHeap QueryDosDeviceW GetModuleFileNameW InitializeCriticalSectionAndSpinCount RaiseException DecodePointer GetLastError GetLogicalDriveStringsW GetACP MultiByteToWideChar WideCharToMultiByte ExpandEnvironmentStringsW LoadLibraryA lstrcatW lstrcpyW GetFileSizeEx CreateProcessW GetExitCodeProcess LoadLibraryExW GetEnvironmentVariableW WriteConsoleW FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP HeapReAlloc HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW Sleep SearchPathW lstrcmpiW GetModuleHandleW GetProcAddress FindResourceW LoadResource LockResource GetVersionExW SetErrorMode CloseHandle GetPrivateProfileStringW LCMapStringW GetFileType GetStringTypeW GetStdHandle GetModuleHandleExW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RtlUnwind SetLastError

advapi32

RegOpenKeyExW RegEnumKeyExW RegDeleteKeyW RegOpenCurrentUser RegCloseKey

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW CommandLineToArgvW

ole32

CoTaskMemFree

imm32

ImmDisableIME

shlwapi

SHDeleteKeyW

Sharing

General

Malware Config

Signatures

File Explorer

ed591c30ec74cf4c102ccbcb796595f25ddc268624846e88e0b297af02b8ae51

kernel32

advapi32

shell32

ole32

imm32

shlwapi

generic