e2d7daebcd44f97c45f03da0efc6d6d9d813405b6045381a677253891fe7e3b3

General

Target
e2d7daebcd44f97c45f03da0efc6d6d9d813405b6045381a677253891fe7e3b3
Size 1.5MB
Sample261030-3ftkbsfx7w
SHA256 e2d7daebcd44f97c45f03da0efc6d6d9d813405b6045381a677253891fe7e3b3
MD5 33a13a68d9ee1c555fa24b61894a00fa
SHA1 190f5cd07ba49883966440ec4ee4c6a164812b99
SHA512 08507380e5db7f861b942ab5594a41756ca6b61b57b3b2247aaea12de1d418f10c7bbb2931f43f62799d2f48177db9e8d5a43028e0b2aedfe865e330baa1620a
SSDEEP 24576:LGRoNSYb9Bo/YIV7cz6G7B1hMnJrJaQ0ox1MZiY4v+l486JjN4Zinrj:ZboYPz6G7B1SnJrT0oxOZiYDl48lQnrj
TLSH
T11B65BF607356D232E86180B20DB9EFAAA06CAD3A5F720ACFB3C42B3D55355D16B31D17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e2d7daebcd44f97c45f03da0efc6d6d9d813405b6045381a677253891fe7e3b3

File Explorer

e2d7daebcd44f97c45f03da0efc6d6d9d813405b6045381a677253891fe7e3b3

.dll 1.5MB

e2d7daebcd44f97c45f03da0efc6d6d9d813405b6045381a677253891fe7e3b3

IMPHASH f9cddeff2d7a268035cd49ec94eaa573
SHA256 e2d7daebcd44f97c45f03da0efc6d6d9d813405b6045381a677253891fe7e3b3
MD5 33a13a68d9ee1c555fa24b61894a00fa
SHA1 190f5cd07ba49883966440ec4ee4c6a164812b99
SHA512 08507380e5db7f861b942ab5594a41756ca6b61b57b3b2247aaea12de1d418f10c7bbb2931f43f62799d2f48177db9e8d5a43028e0b2aedfe865e330baa1620a
SSDEEP 24576:LGRoNSYb9Bo/YIV7cz6G7B1hMnJrJaQ0ox1MZiY4v+l486JjN4Zinrj:ZboYPz6G7B1SnJrT0oxOZiYDl48lQnrj
TLSH
T11B65BF607356D232E86180B20DB9EFAAA06CAD3A5F720ACFB3C42B3D55355D16B31D17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

575310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

H:\rc_v12_i18n_202511_branch\Build\Release\WPSOffice\office6\wpscloudsvr.pdb

kernel32

SetCurrentDirectoryW FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW GetCommandLineW CloseHandle GetLastError Sleep GetCurrentProcessId TerminateProcess GetCurrentThreadId OpenProcess GetSystemDirectoryW GetSystemWow64DirectoryW GetModuleHandleW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject WaitForMultipleObjects CreateThread QueueUserWorkItem UnregisterWaitEx LocalFree GetEnvironmentVariableW SetEnvironmentVariableW GetDriveTypeW GetTempPathW GetStartupInfoW GetTickCount SetDllDirectoryW GetDllDirectoryW CopyFileW GetSystemTime SystemTimeToFileTime GetExitCodeProcess VerSetConditionMask GetCurrentProcess LocalAlloc VerifyVersionInfoW FindClose FindFirstFileW FindNextFileW SetEvent CreateEventW CreateFileW ReadFile WriteFile SetNamedPipeHandleState WaitNamedPipeW GetOverlappedResult CancelIo FlushFileBuffers ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateDirectoryW GetFileAttributesW ReadProcessMemory WideCharToMultiByte SetUnhandledExceptionFilter LoadLibraryExW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar GetFileAttributesExW GetModuleHandleExW VirtualAlloc VirtualFree lstrlenW GetPrivateProfileIntW GetPrivateProfileStringW CreateProcessW ExpandEnvironmentStringsW GetLongPathNameW GetCurrentThread ProcessIdToSessionId SetLastError OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency SetStdHandle GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetStringTypeW FindFirstFileExW SetEndOfFile SetFilePointerEx EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetLocaleInfoEx CompareStringEx GetCPInfo ResetEvent WaitForSingleObjectEx InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter OutputDebugStringW RtlUnwind InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree SetConsoleCtrlHandler GetStdHandle ExitProcess GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode GetFileSizeEx ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

Name

.text

Size

784KB

Virtual Size

783KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

173KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.itext

Size

446KB

Virtual Size

445KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e2d7daebcd44f97c45f03da0efc6d6d9d813405b6045381a677253891fe7e3b3

kernel32

generic