AmongUsCosmetics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AmongUsCosmetics.exe
Size 30KB
Sample260622-cayc8ahs8s
SHA256 b11c4c4629295fe7736014362734c6514061dd867ee5b88d8a4ba8d19a28eee5
MD5 f0f6492ac9e6c3424ad579713ea38058
SHA1 1d282f53d5d15025d925b7f12107a9558f39ed54
SHA512 fd287212d093ebfd16c95ea7dd0fe7b893dbb30b287641dcb162dba63b22fe3938fa3f94d951d6c509f4b1126d6fc1234dbe28763f2234ab57c74b075bcd01dd
SSDEEP 384:6z3H8PceIaCxWZCd1OXBHor9E/3zmfI1RQGgMUHcce5DEjEL0/GnKDCIfY7+zray:6wihW/3zmQ4MUo5DEwQGn8tY7srmH1
TLSH
T187E27C4B279501F8D2A792BDD1536A17E2767C260B6397CF4380613A1F223E86E3F742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AmongUsCosmetics.exe

File Explorer

AmongUsCosmetics.exe

.exe 30KB

AmongUsCosmetics.exe

IMPHASH 8ce4b73fd2eebac65702f93d8732ef20
SHA256 b11c4c4629295fe7736014362734c6514061dd867ee5b88d8a4ba8d19a28eee5
MD5 f0f6492ac9e6c3424ad579713ea38058
SHA1 1d282f53d5d15025d925b7f12107a9558f39ed54
SHA512 fd287212d093ebfd16c95ea7dd0fe7b893dbb30b287641dcb162dba63b22fe3938fa3f94d951d6c509f4b1126d6fc1234dbe28763f2234ab57c74b075bcd01dd
SSDEEP 384:6z3H8PceIaCxWZCd1OXBHor9E/3zmfI1RQGgMUHcce5DEjEL0/GnKDCIfY7+zray:6wihW/3zmQ4MUo5DEwQGn8tY7srmH1
TLSH
T187E27C4B279501F8D2A792BDD1536A17E2767C260B6397CF4380613A1F223E86E3F742
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\HanMan\source\repos\AmongUsCosmetics\x64\Release\AmongUsCosmetics.pdb

kernel32

WriteProcessMemory SetConsoleTextAttribute SetConsoleTitleA GetStdHandle OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW QueryFullProcessImageNameA Process32FirstW CloseHandle Module32FirstW VirtualProtectEx ReadProcessMemory Module32NextW RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext

user32

GetWindowThreadProcessId FindWindowW

msvcp140

?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException memset __std_terminate __std_exception_copy __std_exception_destroy memcpy memmove __C_specific_handler memcmp

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __p__commode _set_fmode

api-ms-win-crt-runtime-l1-1-0

_c_exit _get_initial_narrow_environment terminate __p___argv _initterm _initterm_e __p___argc _register_thread_local_exe_atexit_callback system _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _exit exit _invalid_parameter_noinfo_noreturn

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale