51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052

Sharing

Copy URL Twitter E-mail

General

Target
51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052
Size 889KB
Sample240307-ynd3dsdc4t
SHA256 51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052
MD5 510d6a07e897edab0b610f996347a119
SHA1 b4a72561df0be4fc5579e1a7ad4ef460e4b4adb6
SHA512 f88dbd47f0d60848deeb0bfcea4f4f49e621ed27788cc317b2a81da09c27ee7fefa65fe6def57583757ef60f2b5e3b79efeb0b1e203830db8e0aaa5b3ed0012a
SSDEEP 24576:65F1ZpAxvbpT0rdwQWOwN7PPpgyqn4zh:20xv9QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052

File Explorer

51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052

.exe 889KB

51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052

IMPHASH eb1c495be288126717b6d0745b9395b3
SHA256 51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052
MD5 510d6a07e897edab0b610f996347a119
SHA1 b4a72561df0be4fc5579e1a7ad4ef460e4b4adb6
SHA512 f88dbd47f0d60848deeb0bfcea4f4f49e621ed27788cc317b2a81da09c27ee7fefa65fe6def57583757ef60f2b5e3b79efeb0b1e203830db8e0aaa5b3ed0012a
SSDEEP 24576:65F1ZpAxvbpT0rdwQWOwN7PPpgyqn4zh:20xv9QrtWOs6Q
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

86432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Build\PSIKey\BRANCH_ACTIVATOR_3_3_0\Parts\bin\ReleaseAntiCrack_x64\PSIService_2.pdb

rpcrt4

RpcServerListen RpcServerRegisterIf RpcServerUseProtseqEpA NdrServerCall2 RpcMgmtStopServerListening

kernel32

RtlPcToFileHeader HeapReAlloc HeapSize HeapQueryInformation Sleep ExitProcess EncodePointer DecodePointer FlsGetValue FlsSetValue FlsFree FlsAlloc GetACP IsValidCodePage LCMapStringA LCMapStringW HeapSetInformation HeapCreate GetStdHandle RaiseException GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetLocaleInfoW GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW RtlUnwindEx GetCommandLineA HeapAlloc HeapFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetOEMCP GetCPInfo GetLocaleInfoA GlobalFlags CreateFileA GetCurrentProcess FlushFileBuffers SetFilePointer WriteFile ReadFile GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpW lstrcmpA GlobalGetAtomNameA GetModuleHandleW CompareStringA GetCurrentThreadId CloseHandle FormatMessageA MultiByteToWideChar lstrlenA GetCurrentProcessId WideCharToMultiByte FindResourceA LoadResource LockResource SizeofResource GlobalFree DeleteCriticalSection LocalReAlloc TlsSetValue GlobalAlloc GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock TlsAlloc InitializeCriticalSection EnterCriticalSection TlsGetValue LeaveCriticalSection GetLastError SetLastError FreeLibrary LoadLibraryA GetSystemInfo GetVersionExA LocalFree LocalAlloc GetModuleHandleA GetProcAddress FindFirstFileA SetEvent WaitForSingleObject CreateThread CreateEventA lstrcmpiA GetModuleFileNameA FreeEnvironmentStringsA

user32

PostQuitMessage GrayStringA DrawTextExA DrawTextA TabbedTextOutA DestroyMenu ClientToScreen SetWindowTextA RegisterWindowMessageA LoadIconA WinHelpA GetCapture GetClassLongA GetClassNameA SetPropA RemovePropA IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetWindowLongPtrA SetWindowLongPtrA GetMessageTime GetMessagePos MapWindowPoints SetMenu UnhookWindowsHookEx MessageBoxA EnableWindow IsWindowEnabled SetForegroundWindow GetClientRect PostMessageA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx CopyRect GetDlgCtrlID PtInRect DefWindowProcA CallWindowProcA GetMenu SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetClassLongPtrA GetLastActivePopup GetParent GetWindowLongA SendMessageA GetWindowThreadProcessId GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA GetFocus ModifyMenuA EnableMenuItem CheckMenuItem GetWindowTextA LoadCursorA GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExA CallNextHookEx DispatchMessageA GetKeyState PeekMessageA ValidateRect GetPropA

gdi32

SetViewportExtEx GetStockObject DeleteDC ScaleWindowExtEx SetWindowExtEx GetClipBox CreateBitmap GetDeviceCaps OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape TextOutA RectVisible PtVisible SetMapMode RestoreDC SaveDC ExtTextOutA DeleteObject SetBkColor SetTextColor ScaleViewportExtEx

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

ReportEventA DeregisterEventSource RegSetValueExA RegCreateKeyExA RegCloseKey QueryServiceConfigA UnlockServiceDatabase LockServiceDatabase DeleteService StartServiceA CreateServiceA ControlService CloseServiceHandle OpenServiceA OpenSCManagerA SetServiceStatus RegisterServiceCtrlHandlerA StartServiceCtrlDispatcherA RegisterEventSourceA

oleaut32

VariantClear VariantChangeType VariantInit

oleacc

LresultFromObject CreateStdAccessibleObject

Name

.text

Size

210KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

51fe13836ed60fd02e8b66e3c854ad77ed5a3c834f0b1993c39e1777c1682052

rpcrt4

kernel32

user32

gdi32

winspool.drv

advapi32

oleaut32

oleacc

generic