C:\Users\Tle\Downloads\Lock\Lock\Lock\main\main\x64\Release\Protections.pdb
Overview
overview
7Static
static
3Hope_weapon_1.rar
windows7-x64
3Hope_weapon_1.rar
windows10-2004-x64
7Hope_weapo...on.exe
windows7-x64
1Hope_weapo...on.exe
windows10-2004-x64
1Hope_weapo...ck.exe
windows7-x64
7Hope_weapo...ck.exe
windows10-2004-x64
7Hope_weapo.../3.png
windows7-x64
1Hope_weapo.../3.png
windows10-2004-x64
3Hope_weapo...��.txt
windows7-x64
1Hope_weapo...��.txt
windows10-2004-x64
1Hope_weapo...��.txt
windows7-x64
1Hope_weapo...��.txt
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Hope_weapon_1.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Hope_weapon_1.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Hope_weapon_1/Hope weapon/Hope Weapon.exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
Hope_weapon_1/Hope weapon/Hope Weapon.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Hope_weapon_1/Hope weapon/main_crack.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Hope_weapon_1/Hope weapon/main_crack.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Hope_weapon_1/Hope weapon/ตัวเสริมความรำเเละจม/3.png
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
Hope_weapon_1/Hope weapon/ตัวเสริมความรำเเละจม/3.png
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Hope_weapon_1/Hope weapon/ตัวเสริมความรำเเละจม/วิธีใช้.txt
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Hope_weapon_1/Hope weapon/ตัวเสริมความรำเเละจม/วิธีใช้.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Hope_weapon_1/Hope weapon/วิธีใช้.txt
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Hope_weapon_1/Hope weapon/วิธีใช้.txt
Resource
win10v2004-20240226-en
General
-
Target
Hope_weapon_1.rar
-
Size
8.8MB
-
MD5
d9249a51324a7bd49928cc6fca9af532
-
SHA1
115689d97905e1931c86ec873fe6cd0b3d453009
-
SHA256
2f860269f8357175d9981ef8478679df57bb0897d71d77b6ed19e0f8f64dadbf
-
SHA512
5707260c20ddbfaabbff2af5ec74239101a69685770db2a5c5f58e14b5d446d6a2cc72a42ca7da02238738f2c499a9fb708d3a9ea3a2565bf984f9f3210e3309
-
SSDEEP
196608:e+6pThl3qxRpp4poFyfjX5EHMFoNN+I3hSGLbC9b0dSuY8UI:e+6pThlabp4oiFo7/b4YdSuY8UI
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Hope_weapon_1/Hope weapon/Hope Weapon.exe unpack001/Hope_weapon_1/Hope weapon/main_crack.exe
Files
-
Hope_weapon_1.rar.rar
-
Hope_weapon_1/Hope weapon/Hope Weapon.exe.exe windows:6 windows x64 arch:x64
42283ff04903e0770899f9a3afe58e76
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
SleepEx
EnterCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
VerifyVersionInfoA
QueryPerformanceCounter
GetTickCount
MoveFileExA
WaitForSingleObjectEx
LocalFree
GetEnvironmentVariableA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
WideCharToMultiByte
IsDebuggerPresent
OutputDebugStringW
FormatMessageA
SetLastError
CreateThread
GetCurrentProcess
LeaveCriticalSection
GetStdHandle
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetCurrentProcessId
GetProcAddress
CloseHandle
GetModuleHandleA
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetModuleHandleW
GetSystemTimeAsFileTime
InitializeSListHead
GetConsoleWindow
GetProcessHeap
DeleteCriticalSection
Beep
HeapDestroy
HeapAlloc
HeapReAlloc
GetLastError
Sleep
HeapSize
InitializeCriticalSectionEx
GetModuleFileNameA
SetConsoleTitleA
HeapFree
MultiByteToWideChar
user32
GetWindowLongA
MessageBoxA
SetWindowLongA
SetLayeredWindowAttributes
advapi32
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
IsValidSid
GetTokenInformation
CryptHashData
GetLengthSid
CopySid
OpenProcessToken
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
msvcp140
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?good@ios_base@std@@QEBA_NXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
ntdll
VerSetConditionMask
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord211
ord46
ord217
ord143
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
crypt32
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CryptStringToBinaryA
PFXImportCertStore
CertCreateCertificateChainEngine
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertFindCertificateInStore
CryptDecodeObjectEx
ws2_32
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
accept
htonl
listen
ioctlsocket
select
getaddrinfo
freeaddrinfo
recvfrom
sendto
gethostname
ntohl
__WSAFDIsSet
rpcrt4
RpcStringFreeA
UuidCreate
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
memset
strchr
strrchr
strstr
__C_specific_handler
__current_exception
__current_exception_context
__std_exception_destroy
__std_exception_copy
memcmp
memchr
_CxxThrowException
__std_terminate
memcpy
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_set_app_type
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_getpid
terminate
_cexit
_initterm_e
system
_initterm
strerror
__sys_nerr
_crt_atexit
_register_onexit_function
_invalid_parameter_noinfo
_beginthreadex
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_resetstkoflw
_get_initial_narrow_environment
abort
exit
_exit
_errno
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
_callnewh
realloc
malloc
free
api-ms-win-crt-time-l1-1-0
strftime
_localtime64_s
_time64
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtoul
atoi
strtol
strtoull
strtod
strtoll
api-ms-win-crt-stdio-l1-1-0
fopen
__stdio_common_vsscanf
fclose
fflush
fseek
fputs
_open
_close
fwrite
_write
_read
fputc
__stdio_common_vsprintf
_popen
_pclose
fgets
__p__commode
_set_fmode
_lseeki64
feof
__stdio_common_vfprintf
__acrt_iob_func
fread
ftell
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_unlink
_access
_stat64
api-ms-win-crt-string-l1-1-0
strncmp
tolower
strcmp
strcspn
strpbrk
strncpy
strspn
isupper
_strdup
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
__setusermatherr
shell32
ShellExecuteA
Sections
.text Size: 420KB - Virtual size: 420KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Hope_weapon_1/Hope weapon/main_crack.exe.exe windows:4 windows x64 arch:x64
e44f44f1060dd800fd861c4e5ad59e21
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
CopyFileW
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateProcessW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FindResourceA
FormatMessageA
FreeLibrary
GenerateConsoleCtrlEvent
GetCommandLineW
GetCurrentProcessId
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetProcessId
GetStartupInfoW
GetSystemTimeAsFileTime
GetTempPathW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadResource
LockResource
MapViewOfFile
MultiByteToWideChar
ReadFile
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__iob_func
__set_app_type
__setusermatherr
__wargv
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_lock
_onexit
_unlock
_wcmdln
_wcsdup
_wcsicmp
_wrename
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
mbstowcs
memcpy
memmove
memset
puts
signal
strerror
strlen
strncmp
vfprintf
wcscmp
wcslen
wcsncmp
shell32
SHFileOperationW
SHGetFolderPathW
Sections
.text Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 71KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8.5MB - Virtual size: 8.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Hope_weapon_1/Hope weapon/ตัวเสริมความรำเเละจม/3.png.png
-
Hope_weapon_1/Hope weapon/ตัวเสริมความรำเเละจม/วิธีใช้.txt
-
Hope_weapon_1/Hope weapon/วิธีใช้.txt