47c9b3d2c419658d79587d0a2088e6c0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

47c9b3d2c419658d79587d0a2088e6c0N.exe
Size

23KB
MD5

47c9b3d2c419658d79587d0a2088e6c0
SHA1

c79b01c2266c7288074daa51cc1094b2d9f224b7
SHA256

d05ea070d5bbc24f3273e154f924ae3adc6e9a3d1a2e1430079bcce39fe2e735
SHA512

8014386f5947141aacaf5afcca9290ef23ac4fb4b0254dbd628fd2aca033dbc72993fc6947f144b1537767f77b5f721e26269cb8fe070eeb98544c88c0d87184
SSDEEP

384:fAGZz3LuOoArtSm+V1HixMxoIIP0qWeu1LZ5qMW:4CbtXGV1Nxz8oLZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
47c9b3d2c419658d79587d0a2088e6c0N.exe

Files

47c9b3d2c419658d79587d0a2088e6c0N.exe
.dll windows:6 windows x64 arch:x64

046dd69cd6f1b6a025778e13f45e9be3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\khali\Desktop\BChax\vcpkg\buildtrees\minhook\x64-windows-rel\minhook.x64.pdb

Imports

kernel32

GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
CloseHandle
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
GetProcAddress
CreateToolhelp32Snapshot
Thread32First
Thread32Next
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
QueryPerformanceCounter
RtlCaptureContext

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memset
memcpy

api-ms-win-crt-runtime-l1-1-0

_cexit
_execute_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_initialize_onexit_table

Exports

Exports

MH_ApplyQueued
MH_CreateHook
MH_CreateHookApi
MH_CreateHookApiEx
MH_DisableHook
MH_EnableHook
MH_Initialize
MH_QueueDisableHook
MH_QueueEnableHook
MH_RemoveHook
MH_StatusToString
MH_Uninitialize

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

046dd69cd6f1b6a025778e13f45e9be3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 924B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 44B

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 924B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 44B