a5074391ffd07ce8986bf7c184b3c4ed5de3fd30b163d043edc03ec8003ca7c9

Sharing

Copy URL Twitter E-mail

General

Target
a5074391ffd07ce8986bf7c184b3c4ed5de3fd30b163d043edc03ec8003ca7c9
Size 3.7MB
Sample260703-mlnchafv3x
SHA256 a5074391ffd07ce8986bf7c184b3c4ed5de3fd30b163d043edc03ec8003ca7c9
MD5 cb566f5fe67aa9a242e295d2189ebe9d
SHA1 8e46c403729309e6c44bc83647511e01e7a6eaad
SHA512 267263b65186b5ecda25faac790f9f5d6841590b83b63b61d1f36c8d09bef284d69ca19d1c112ac65d93506bba4f59cd32893acf6448b08e21bea0e34f3412cc
SSDEEP 49152:LhEHcDjnO8CjI7TrS7PffKWJprCVTG77Bz312X5GcLu33fEbT9MndoGRJzpR8FC/:LhE83bApiToNzl2X5BMD
TLSH
T1C6066B34A65281B1CD800670B01AB73E5F2DEE345B2B46C3B3F07A7D6970EE25976A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5074391ffd07ce8986bf7c184b3c4ed5de3fd30b163d043edc03ec8003ca7c9

File Explorer

a5074391ffd07ce8986bf7c184b3c4ed5de3fd30b163d043edc03ec8003ca7c9

.exe 3.7MB

a5074391ffd07ce8986bf7c184b3c4ed5de3fd30b163d043edc03ec8003ca7c9

IMPHASH 3a7331a93529712ee6ea45debe5b86c1
SHA256 a5074391ffd07ce8986bf7c184b3c4ed5de3fd30b163d043edc03ec8003ca7c9
MD5 cb566f5fe67aa9a242e295d2189ebe9d
SHA1 8e46c403729309e6c44bc83647511e01e7a6eaad
SHA512 267263b65186b5ecda25faac790f9f5d6841590b83b63b61d1f36c8d09bef284d69ca19d1c112ac65d93506bba4f59cd32893acf6448b08e21bea0e34f3412cc
SSDEEP 49152:LhEHcDjnO8CjI7TrS7PffKWJprCVTG77Bz312X5GcLu33fEbT9MndoGRJzpR8FC/:LhE83bApiToNzl2X5BMD
TLSH
T1C6066B34A65281B1CD800670B01AB73E5F2DEE345B2B46C3B3F07A7D6970EE25976A17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2194112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\disk\touhou\TH\thprac\thprac\Release\thprac.pdb

kernel32

AddVectoredExceptionHandler VirtualAlloc GetModuleHandleA QueryPerformanceFrequency ExitThread DeleteFileW FindFirstFileW FindNextFileW GetFileAttributesW GetTempPathW GetLastError WaitForSingleObject Sleep CreateThread TerminateThread GetExitCodeThread CopyFileW MoveFileW GetEnvironmentVariableA GetEnvironmentVariableW FindClose GetFullPathNameW CreateRemoteThread ResumeThread CreateProcessW OpenProcess VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx lstrcmpW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW OpenMutexA GetCurrentThreadId GetCurrentDirectoryW CreateMutexW VirtualProtectEx LoadLibraryA GetUserDefaultUILanguage ExpandEnvironmentStringsW GetFileAttributesA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetACP GetStdHandle GetCurrentProcessId HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW GetTimeZoneInformation HeapReAlloc GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode QueryPerformanceCounter FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapFree HeapAlloc GetModuleHandleExW FreeLibraryAndExitThread GetCommandLineW GetCommandLineA LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind GetVersionExA CreateFileA CreateFileMappingA InitializeSListHead GetStartupInfoW IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent GetCPInfo GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable GetProcAddress VirtualProtect ExitProcess GlobalAlloc WriteFile SetFilePointer SetEndOfFile ReadFile CreateDirectoryW GetModuleHandleW AttachConsole AcquireSRWLockExclusive ReleaseSRWLockExclusive LocalFree LoadLibraryW GetModuleFileNameW UnmapViewOfFile MapViewOfFile GetSystemTimeAsFileTime LCMapStringEx CreateFileMappingW GetCurrentProcess OpenMutexW CloseHandle GetFileSize CreateFileW SetCurrentDirectoryW WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GetConsoleOutputCP RaiseException GetSystemInfo VirtualQuery FreeLibrary LoadLibraryExA WaitForSingleObjectEx InitializeCriticalSectionEx EncodePointer DecodePointer WriteConsoleW

ntdll

NtQueryInformationProcess

user32

CloseClipboard OpenClipboard CreateDialogParamW SetClipboardData GetClipboardData EmptyClipboard SetWindowPos GetAsyncKeyState GetSystemMetrics GetDC MonitorFromWindow EnumDisplaySettingsW LoadIconW FindWindowW AdjustWindowRectEx UpdateWindow GetKeyState IsIconic CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW GetWindowThreadProcessId SetForegroundWindow SetActiveWindow SetFocus AttachThreadInput CallNextHookEx GetClientRect SetWindowsHookExW IsDialogMessageW SetWindowTextW GetDlgItem UnhookWindowsHookEx ShowWindow DestroyWindow SendMessageW PeekMessageW DispatchMessageW TranslateMessage LoadCursorW GetDesktopWindow ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetForegroundWindow ReleaseCapture SetCapture GetCapture GetKeyNameTextA IsChild CallWindowProcW DefWindowProcA MessageBoxA SetWindowLongW GetWindowLongW MessageBoxW GetWindowRect

gdi32

DeleteDC CreateCompatibleDC CreateFontW DeleteObject EnumFontFamiliesExW GetFontData EnumFontFamiliesExA SelectObject GetStockObject CreateFontA

winmm

joyGetDevCapsW PlaySoundW timeGetTime

dinput8

DirectInput8Create

shlwapi

PathIsRelativeW PathRelativePathToW PathFileExistsW PathRemoveFileSpecW

ole32

CoCreateInstance CoInitializeEx CoInitialize CoUninitialize CoTaskMemFree

comdlg32

GetOpenFileNameW GetSaveFileNameW

shell32

SHGetPathFromIDListW SHParseDisplayName SHFileOperationW ShellExecuteW CommandLineToArgvW SHGetFolderPathW SHBrowseForFolderW

advapi32

RegQueryValueExW OpenProcessToken GetTokenInformation RegCloseKey RegOpenKeyW

dsound

ord11

imm32

ImmSetCompositionWindow ImmAssociateContext ImmReleaseContext ImmGetContext

Sharing

General

Malware Config

Signatures

File Explorer

a5074391ffd07ce8986bf7c184b3c4ed5de3fd30b163d043edc03ec8003ca7c9

kernel32

ntdll

user32

gdi32

winmm

dinput8

shlwapi

ole32

comdlg32

shell32

advapi32

dsound

imm32

generic