tmpyu4y3y80
- SHA256 e00c1f2f368d2841059a120dea5633a2bbbe65303ba853d4400d324e014f6356
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmpyu4y3y80.zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpyu4y3y80.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpyu4y3y80.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target tmpyu4y3y80
- Size 644KB
- Sample260702-rmrtjacz4m
- SHA256 e00c1f2f368d2841059a120dea5633a2bbbe65303ba853d4400d324e014f6356
- MD5 492481d8410bacfb9543f18c279d0f1f
- SHA1 b1898e2dcfd88be7bd084c6480a8ed47d4023b04
- SHA512 34592b3b6ed901f2c9f6cddf2df1bac0756f1247501de031107513555ed615a06620037611bda509f1bd7ffa9339e8b5949ea9735787aaddff4fbd19ba48a021
- SSDEEP 12288:qM95maGG5DS6waV0uE7Rx/hTtkkL5fQZEQxtnjpF6XH6vo++2sz3t:hdK2OuyRx/hTt/5fQmQ376310sbt
- TLSH T185E423F84B705901E614F1FDCDCA58B8999EAE36F3A0CA86BC1E93C917141AD93C34B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PekoraPlayerLauncher.exe
File Explorer
-
tmpyu4y3y80.zip 644KB
-
PekoraPlayerLauncher.exe.exe 1.4MB
PekoraPlayerLauncher.exe
- IMPHASH ee5703b05ca4e3694504a5c6cfe1248c
- SHA256 a3b3a175d5f15c7794cf51412dd54073efaa0b98376ba0b906245128f72015b3
- MD5 f745edf5a96ba145ca392df6aa67fe6e
- SHA1 a6c3eddf363ad26c17121d4ed4d41fc7fe6153e9
- SHA512 ee89006b29fc8fd32cbf8c446d36fd56a325d8e5771dd0e4b423225e43995b572248faf715dc371ebc95b0a45606350d0e8c9f12a8d7205e4849eba0eb07acf9
- SSDEEP 24576:6r1tT1Gq71jvmhom9yjYpADVoEUmCHQCt:6rb1Xdjm9yjYpADqmCwCt
- TLSH T158655AC2EE4E11E8E07584F5C5224855E26F3C2AB2609ACB128172D64F77D537B3AF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
288524
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\Korone-Bootstrapper\Korone-Bootstrapper\BootstrapperClient\bin\Release\x64\PekoraPlayerLauncher.pdb
kernel32
GetTempPathW
DeleteFileW
GetSystemTime
lstrcmpW
VerifyVersionInfoW
VerSetConditionMask
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
ReleaseMutex
CreateMutexW
SetEvent
ResetEvent
OpenEventW
CreateEventW
CloseHandle
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
SetEndOfFile
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileType
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
HeapReAlloc
GetLastError
HeapSize
ExitThread
CreateThread
InitializeCriticalSectionAndSpinCount
HeapFree
Sleep
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
LocalFree
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
CreateProcessW
RaiseException
GetTickCount
CompareFileTime
FindFirstFileW
FindNextFileW
FindClose
lstrlenW
GetLocalTime
CreateDirectoryW
GetDiskFreeSpaceExW
SetFileAttributesW
RemoveDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetShortPathNameW
FormatMessageW
LoadLibraryW
FreeLibrary
CreateFileW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
MulDiv
OpenProcess
InitializeCriticalSectionEx
WaitForSingleObjectEx
GetExitCodeProcess
TerminateProcess
lstrcpyW
lstrcatW
WriteFile
GetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetTickCount64
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetSystemTimeAsFileTime
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
SetLastError
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetCommandLineA
GetCommandLineW
user32
LoadBitmapW
CallWindowProcW
GetParent
GetWindowRect
SendMessageW
GetWindowLongPtrW
AllowSetForegroundWindow
SetWindowTextW
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
SetFocus
CharNextW
MessageBoxW
PostThreadMessageW
GetWindowThreadProcessId
EnumWindows
GetDlgItem
PostQuitMessage
BeginPaint
FillRect
EndPaint
CreateWindowExW
RegisterClassW
GetSystemMetrics
GetDC
ReleaseDC
SetTimer
KillTimer
DestroyWindow
EnableWindow
LoadIconW
SetForegroundWindow
PostMessageW
GetWindowTextW
CharUpperW
MessageBoxA
DefWindowProcW
SetWindowLongPtrW
ShowWindow
InvalidateRect
SetWindowPos
IsWindowVisible
gdi32
CreateFontW
GetDeviceCaps
DeleteObject
Rectangle
SelectObject
CreatePen
SetBkMode
SetTextColor
GetStockObject
CreateSolidBrush
advapi32
OpenThreadToken
InitializeSid
GetSidSubAuthority
CheckTokenMembership
DuplicateToken
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegFlushKey
CryptAcquireContextW
CryptCreateHash
IsValidSid
GetLengthSid
CopySid
OpenProcessToken
CryptReleaseContext
CryptDestroyHash
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetUserNameW
CryptHashData
CryptGetHashParam
GetTokenInformation
GetSidLengthRequired
shell32
SHGetFolderPathAndSubDirW
ShellExecuteExW
ShellExecuteW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
CoCreateGuid
oleaut32
VariantClear
VariantInit
RegisterTypeLi
SysFreeString
SysAllocString
shlwapi
PathFileExistsW
StrCmpNW
SHDeleteKeyW
StrStrW
StrCpyW
StrCmpW
PathAddBackslashW
StrDupW
StrRChrW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
wininet
HttpAddRequestHeadersW
InternetReadFile
HttpSendRequestW
HttpEndRequestW
HttpQueryInfoW
HttpSendRequestExW
InternetWriteFile
InternetCloseHandle
InternetOpenW
InternetConnectW
HttpOpenRequestW
InternetQueryDataAvailable
ws2_32
WSAStartup
getaddrinfo
closesocket
freeaddrinfo
WSACleanup
connect
socket
recv
send
sensapi
IsNetworkAlive
userenv
UnloadUserProfile
comctl32
InitCommonControlsEx
_TrackMouseEvent
psapi
GetProcessImageFileNameW
EnumProcesses
iphlpapi
GetAdaptersInfo
Name
.text
Size
488KB
Virtual Size
487KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
711KB
Virtual Size
710KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=180, id=261, version=33145,
count=8, id=259, version=33145,
count=1, id=253, version=35207,
count=12, id=259, version=35207,
count=18, id=260, version=35207,
count=99, id=261, version=35207,
count=8, id=260, version=35222,
count=20, id=260, version=33145,
count=1, id=263, version=33145,
count=2, id=262, version=33145,
count=33, id=257, version=33145,
count=329, id=1, productName=Unmarked objects,
count=25, id=265, version=35222,
count=1, id=255, version=35222,
count=1, id=151,
count=1, id=258, version=35222,