1PC No Restart[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
1PC No Restart.exe
Size 458KB
Sample260620-rlgbeagy2s
SHA256 fac9f6dead4cf9cd23731f407472b6f1e34f84dfd820122163af3a2c959ce119
MD5 162b1e53151c75624205f3af850c16b6
SHA1 2b2331bddc0fe7ba3bc8b73fbd34d5226b628e9d
SHA512 5aacc16c9c02328ca3a1ba3b19ac1aa300619981bf042bab4ed663b73f705de5049a5be7b98093bbd7f8f32c55cdebe55b455e5c0b93ad0a78fc4a963cf332e7
SSDEEP 6144:bmPtn2fk1aZkJJYr4GzZgvlhCqhdWbz25XXCDUm/pASzZuzKPUikgisnZI0t:bggWsrgDCqhdWbz25SjpASAYisny
TLSH
T173A4AF82F1E450F8D02B9138D687BA0FFE763408131056DB63D4E5782FE76E5ABB6612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1PC No Restart.exe

File Explorer

1PC No Restart.exe

.exe 458KB

1PC No Restart.exe

IMPHASH 03e1901477224497c8c583fe94c0a09a
SHA256 fac9f6dead4cf9cd23731f407472b6f1e34f84dfd820122163af3a2c959ce119
MD5 162b1e53151c75624205f3af850c16b6
SHA1 2b2331bddc0fe7ba3bc8b73fbd34d5226b628e9d
SHA512 5aacc16c9c02328ca3a1ba3b19ac1aa300619981bf042bab4ed663b73f705de5049a5be7b98093bbd7f8f32c55cdebe55b455e5c0b93ad0a78fc4a963cf332e7
SSDEEP 6144:bmPtn2fk1aZkJJYr4GzZgvlhCqhdWbz25XXCDUm/pASzZuzKPUikgisnZI0t:bggWsrgDCqhdWbz25SjpASAYisny
TLSH
T173A4AF82F1E450F8D02B9138D687BA0FFE763408131056DB63D4E5782FE76E5ABB6612
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

363232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\jinx9\Desktop\1PC No Restart\bin\x64\Release\1PC No Restart.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute

kernel32

WriteFile CreateNamedPipeW LeaveCriticalSection InitializeCriticalSection Sleep GetLastError CloseHandle GetLocalTime Beep DeleteCriticalSection GetModuleHandleW ConnectNamedPipe FlushFileBuffers OutputDebugStringA MultiByteToWideChar InitializeSListHead ReadFile GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive EnterCriticalSection GetCurrentProcessId GetCurrentThreadId GlobalFree GetSystemTimeAsFileTime GlobalAlloc

user32

GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW GetForegroundWindow SetCapture SetCursor GetClientRect TranslateMessage ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW PostMessageW DestroyWindow CreateWindowExW ScreenToClient GetSystemMetrics IsWindowUnicode PostQuitMessage UpdateWindow PeekMessageW DispatchMessageW ShowWindow RegisterClassExW UnregisterClassW

shell32

ShellExecuteW

msvcp140

?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ _Cnd_signal ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Cnd_wait _Thrd_id _Thrd_detach _Thrd_join _Mtx_unlock _Cnd_broadcast ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

wininet

InternetOpenA InternetCloseHandle HttpSendRequestA InternetReadFile InternetConnectA HttpQueryInfoA HttpOpenRequestA

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp memmove memset memchr memcpy _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _exit system __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initialize_narrow_environment _beginthreadex _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit _set_app_type _initterm _seh_filter_exe terminate

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf fread _wfopen fwrite __stdio_common_vfprintf fseek fclose fflush __p__commode _set_fmode ftell __stdio_common_vsprintf __acrt_iob_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

cosf fmodf __setusermatherr ceilf sqrtf sinf acosf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strlen strcmp strncmp strncpy