1aa185051429eeb524766150cc1002505ca3a8970fc873c31af93e6f34a91a04

Sharing

Copy URL Twitter E-mail

General

Target
1aa185051429eeb524766150cc1002505ca3a8970fc873c31af93e6f34a91a04
Size 936KB
Sample241213-h8elnaskdw
SHA256 1aa185051429eeb524766150cc1002505ca3a8970fc873c31af93e6f34a91a04
MD5 2f0c594c48f5a47b219a3a42e1ef3292
SHA1 7c4bb57aa9979e28f6b849590af0ed6f6d71254d
SHA512 f97d7ba61c4b1a800bf181731e3aaa6dd9d1d80d27fcb2d040f28b3c977a211683824d82ad49eb299632c29e7b291422304a918fa10df8328318e916787f0940
SSDEEP 24576:I/FVqv41A9uY+EKcw1PHgbWZAweF0KKK0CfsZU+CM+gbOwEaomIU/wMzkiy:UAroEKcw+bzwJK0Y5aoLU/wlh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1aa185051429eeb524766150cc1002505ca3a8970fc873c31af93e6f34a91a04

File Explorer

1aa185051429eeb524766150cc1002505ca3a8970fc873c31af93e6f34a91a04

.exe 936KB

1aa185051429eeb524766150cc1002505ca3a8970fc873c31af93e6f34a91a04

IMPHASH ecd889b4ee637abdc321ac090937c1a3
SHA256 1aa185051429eeb524766150cc1002505ca3a8970fc873c31af93e6f34a91a04
MD5 2f0c594c48f5a47b219a3a42e1ef3292
SHA1 7c4bb57aa9979e28f6b849590af0ed6f6d71254d
SHA512 f97d7ba61c4b1a800bf181731e3aaa6dd9d1d80d27fcb2d040f28b3c977a211683824d82ad49eb299632c29e7b291422304a918fa10df8328318e916787f0940
SSDEEP 24576:I/FVqv41A9uY+EKcw1PHgbWZAweF0KKK0CfsZU+CM+gbOwEaomIU/wMzkiy:UAroEKcw+bzwJK0Y5aoLU/wlh
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

280892

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\MGame\general_user\DumpUper\Release\DumpReport.pdb

kernel32

SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentThreadId FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW lstrcmpiW CreateDirectoryW CreateFileW OutputDebugStringW CloseHandle InitializeCriticalSection TerminateProcess OpenProcess GetVersionExW ReadProcessMemory LoadLibraryW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCommandLineW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileSizeEx GetPrivateProfileStringW WritePrivateProfileStringW RemoveDirectoryW CopyFileW WideCharToMultiByte GetCurrentProcessId ReleaseMutex GetTempFileNameW GetLastError RaiseException DecodePointer WriteConsoleW FlushFileBuffers OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler SetStdHandle ReadConsoleW EnumSystemLocalesW MultiByteToWideChar LocalFree FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetProcessHeap HeapSize GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCurrentThread GetACP GetStdHandle GetModuleFileNameA GetModuleHandleExW GetTempPathW DosDateTimeToFileTime FileTimeToDosDateTime LocalFileTimeToFileTime ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType HeapFree HeapReAlloc ReadFile InterlockedFlushSList RtlUnwind CreateMutexW FileTimeToLocalFileTime SystemTimeToFileTime HeapAlloc HeapDestroy IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetStringTypeW FormatMessageW CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo MapViewOfFile UnmapViewOfFile CreateFileMappingW Sleep InitializeCriticalSectionEx GetSystemWindowsDirectoryW FreeResource DeviceIoControl lstrcmpA UnhandledExceptionFilter SetUnhandledExceptionFilter SetEvent ResetEvent WaitForSingleObjectEx GetStartupInfoW QueryPerformanceCounter GetFileSize WriteFile SetEndOfFile SetFilePointer GetFileTime SetFileTime GetSystemTime WaitForSingleObject

user32

TranslateMessage GetMessageW DispatchMessageW IsWindow SendMessageW GetWindowLongW CallWindowProcW PostQuitMessage PostMessageW wsprintfW LoadCursorW SetWindowLongW CharNextW DestroyWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW DefWindowProcW PeekMessageW

advapi32

GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegQueryValueExW

shell32

CommandLineToArgvW ord165

ole32

CoTaskMemAlloc CoInitialize CoTaskMemFree CoCreateGuid CoCreateInstance CoUninitialize CoTaskMemRealloc

oleaut32

SysStringLen SysFreeString SysAllocStringLen VarUI4FromStr

shlwapi

StrStrIW StrCmpIW PathRenameExtensionW PathAppendW PathRemoveFileSpecW PathFileExistsW wnsprintfW StrStrIA PathCombineW StrTrimA StrCmpNIW PathFindFileNameW PathIsDirectoryW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

psapi

GetModuleFileNameExW

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

1aa185051429eeb524766150cc1002505ca3a8970fc873c31af93e6f34a91a04

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

psapi

iphlpapi

generic