05b7b519f442349bacb812a02298ec83[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
05b7b519f442349bacb812a02298ec83.exe
Size 1006KB
Sample261113-pcqsdabt4p
SHA256 225dd954f741acd9f69ba002e87bc11ccdf488e2e0421e09b5f0fa0c7112e39b
MD5 05b7b519f442349bacb812a02298ec83
SHA1 1a101508ab6d20a7af48fc3cd1e43780c70195d2
SHA512 62b03020a66543f19102ad959414458a7796d564ebbc619297ce6a8ba806282930f95ff58749b81d2301ffe1d7338d0d7f89bac0d4b697ddb499e261ef537f7d
SSDEEP 24576:yYErI/ksbST57gIXbJ7F5yXmHy9GR7dyI4veG/P8s/TTgdm:yhI/ks+57tXbppUI4Ln8Agdm
TLSH
T1B2259D213267C176E09211F0A97AB7E6787FAA32872741C7F3C5192D5E606D0AA3C35F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05b7b519f442349bacb812a02298ec83.exe

File Explorer

05b7b519f442349bacb812a02298ec83.exe

.exe 1006KB

05b7b519f442349bacb812a02298ec83.exe

IMPHASH c2c143721a4b100c6c8859fd8be08865
SHA256 225dd954f741acd9f69ba002e87bc11ccdf488e2e0421e09b5f0fa0c7112e39b
MD5 05b7b519f442349bacb812a02298ec83
SHA1 1a101508ab6d20a7af48fc3cd1e43780c70195d2
SHA512 62b03020a66543f19102ad959414458a7796d564ebbc619297ce6a8ba806282930f95ff58749b81d2301ffe1d7338d0d7f89bac0d4b697ddb499e261ef537f7d
SSDEEP 24576:yYErI/ksbST57gIXbJ7F5yXmHy9GR7dyI4veG/P8s/TTgdm:yhI/ks+57tXbppUI4Ln8Agdm
TLSH
T1B2259D213267C176E09211F0A97AB7E6787FAA32872741C7F3C5192D5E606D0AA3C35F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

129680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\laughing_project\广告弹窗\Release\AdPopup.pdb

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

LoadResource LockResource SizeofResource FindResourceW CloseHandle CreateFileW SetEvent WaitForSingleObject GetModuleFileNameW OutputDebugStringW CreateFileA WriteFile Sleep GetCurrentDirectoryA CreateDirectoryA CreateProcessW FreeResource DeleteFileA GetComputerNameA GlobalLock GlobalUnlock OpenEventA OutputDebugStringA EnterCriticalSection GetLastError LoadLibraryW GetProcAddress FreeLibrary GetTickCount LoadLibraryExW EnumResourceNamesW GetFileSize ReadFile CreateMailslotW CreateThread GetCurrentProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLogicalDriveStringsW QueryDosDeviceW OpenProcess DeleteCriticalSection DeleteFileW GetCurrentProcessId CreateMutexW InitializeCriticalSection WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalAlloc CompareStringW LeaveCriticalSection TerminateProcess GetPrivateProfileStringW GetPrivateProfileStringA LoadLibraryA GetProcessHeap SetEndOfFile SetStdHandle WriteConsoleW GetSystemTimeAsFileTime HeapFree EncodePointer DecodePointer HeapAlloc ExitThread GetCurrentThreadId GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind InterlockedExchange UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError LCMapStringW IsProcessorFeaturePresent GetTimeZoneInformation HeapCreate SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType ExitProcess GetConsoleCP GetConsoleMode SetFilePointer FlushFileBuffers HeapSize GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetLocaleInfoW GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc SetEnvironmentVariableA

user32

GetMessageW wsprintfW SystemParametersInfoW DispatchMessageW TranslateMessage

advapi32

LookupPrivilegeValueW RegQueryValueExW RegOpenKeyW OpenProcessToken RegCloseKey RegQueryValueExA RegOpenKeyA AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathA

ole32

CoInitializeEx CoCreateGuid

shlwapi

StrStrIW

urlmon

URLDownloadToCacheFileA URLDownloadToCacheFileW

psapi

GetProcessImageFileNameW GetModuleFileNameExW EnumProcessModules