375d7b0cf50c26c8c68f52a1b75b6092f96b1df050b306013a88807e06ade8e6

General

Target
375d7b0cf50c26c8c68f52a1b75b6092f96b1df050b306013a88807e06ade8e6
Size 1.2MB
Sample261027-jcdj6ay12m
SHA256 375d7b0cf50c26c8c68f52a1b75b6092f96b1df050b306013a88807e06ade8e6
MD5 bbe1e0a71d0ad23524cd2aae093c8853
SHA1 6a121ec479bd7a496102b3bec4b7fff626a84f68
SHA512 f10742637e1ec68b375a9134f714f508c61c57c0b188854dc29e3b70ec04187404cf344e4a0f030eb70f107340d38f94e3401995bf042fe966a890ee97b146a8
SSDEEP 24576:Oi2ERFNHJq9IjLiKCeT2FI0oshkuXsqjnhMgeiCl7G0nehbGZpbD:h2rIXQeT23oukurDmg27RnWGj
TLSH
T18A45C0243682C23BD67211B0493CDAAA502EBE250F651DDBB3D83E3D69B45E21E35D37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
375d7b0cf50c26c8c68f52a1b75b6092f96b1df050b306013a88807e06ade8e6

File Explorer

375d7b0cf50c26c8c68f52a1b75b6092f96b1df050b306013a88807e06ade8e6

.exe 1.2MB

375d7b0cf50c26c8c68f52a1b75b6092f96b1df050b306013a88807e06ade8e6

IMPHASH b1e0fcce597e11c5a549ce4c9871a6be
SHA256 375d7b0cf50c26c8c68f52a1b75b6092f96b1df050b306013a88807e06ade8e6
MD5 bbe1e0a71d0ad23524cd2aae093c8853
SHA1 6a121ec479bd7a496102b3bec4b7fff626a84f68
SHA512 f10742637e1ec68b375a9134f714f508c61c57c0b188854dc29e3b70ec04187404cf344e4a0f030eb70f107340d38f94e3401995bf042fe966a890ee97b146a8
SSDEEP 24576:Oi2ERFNHJq9IjLiKCeT2FI0oshkuXsqjnhMgeiCl7G0nehbGZpbD:h2rIXQeT23oukurDmg27RnWGj
TLSH
T18A45C0243682C23BD67211B0493CDAAA502EBE250F651DDBB3D83E3D69B45E21E35D37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

312024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\zhanlue\pdfconverter\bin\Win32\release_green_static\pdb\2345PdfTool.pdb

imm32

ImmDisableIME

kernel32

GetCurrentThreadId GetVersionExW OpenProcess HeapAlloc GetProcAddress LocalFree GetProcessHeap LockResource LoadResource FindResourceW GetModuleHandleW lstrcmpiW GetCurrentProcess GetModuleFileNameW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection LoadLibraryW FreeLibrary FindFirstFileW GetLongPathNameW CreateFileW GetFileAttributesExW ReadFile WriteFile SetFilePointer SetEndOfFile GetFileSize CreateDirectoryW SearchPathW GetFullPathNameW lstrlenW GetTempPathW GetFileAttributesW SetFileAttributesW DeleteFileW GetWindowsDirectoryW GetTempFileNameW FindNextFileW FindClose GetTickCount WideCharToMultiByte GetModuleFileNameA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle ReleaseSemaphore GetCurrentProcessId CreateSemaphoreW GetSystemTimeAsFileTime CreateDirectoryA HeapFree SetErrorMode MultiByteToWideChar FormatMessageW GetStringTypeW SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo LoadLibraryExW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW RaiseException CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetACP GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx GetConsoleMode ReadConsoleW GetTimeZoneInformation FlushFileBuffers GetConsoleCP HeapReAlloc OutputDebugStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle WriteConsoleW HeapSize GetEnvironmentVariableW GetFileSizeEx InterlockedExchange CreateMutexW WaitForSingleObject ReleaseMutex Sleep GetLastError CloseHandle RtlUnwind

shlwapi

PathIsDirectoryA

Sharing

General

Malware Config

Signatures

File Explorer

375d7b0cf50c26c8c68f52a1b75b6092f96b1df050b306013a88807e06ade8e6

imm32

kernel32

shlwapi

generic