patcher-v1[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
patcher-v1.1.exe
Size 74KB
Sample260704-s19f6sc19m
SHA256 37ed5e6c310093f7789891f7cbb0a7edd1f810a216f623879c7c3afe511fb761
MD5 34b1368c1ae45fa51f1934e895226ae1
SHA1 a44be2588ed90f1acb7d02ee9ed006e93e3005dd
SHA512 74b7254937712d90006ff61b51c10ffdd2cffaadfb054466b92e92c7ff10548d02802f358628ec74ce13da8662183cd4152898b532d25b2269dcc535c609a456
SSDEEP 768:j50J9FSeuGbkbAM5cBRIyxnIInrdZ9FggHC1Bx53KAiHp:j5cS6MgRZlnr/gFBDal
TLSH
T19573E65B779920F7D076C13D89926226BBB270A403320BDF51054ABA5F707E87C3E79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
patcher-v1.1.exe

File Explorer

patcher-v1.1.exe

.exe 74KB

patcher-v1.1.exe

IMPHASH 97265741184d77cc32b678c1fda09020
SHA256 37ed5e6c310093f7789891f7cbb0a7edd1f810a216f623879c7c3afe511fb761
MD5 34b1368c1ae45fa51f1934e895226ae1
SHA1 a44be2588ed90f1acb7d02ee9ed006e93e3005dd
SHA512 74b7254937712d90006ff61b51c10ffdd2cffaadfb054466b92e92c7ff10548d02802f358628ec74ce13da8662183cd4152898b532d25b2269dcc535c609a456
SSDEEP 768:j50J9FSeuGbkbAM5cBRIyxnIInrdZ9FggHC1Bx53KAiHp:j5cS6MgRZlnr/gFBDal
TLSH
T19573E65B779920F7D076C13D89926226BBB270A403320BDF51054ABA5F707E87C3E79A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\TheGreen\source\repos\c\x64\Debug\c.pdb

kernel32

ExitProcess OpenProcess VirtualProtectEx ReadProcessMemory WriteProcessMemory GetModuleFileNameA GetCurrentProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModules K32GetModuleBaseNameA IsDebuggerPresent Sleep GetLastError CloseHandle SetConsoleTitleW GetFileAttributesA RaiseException MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW HeapAlloc HeapFree GetProcAddress FreeLibrary VirtualQuery GetProcessHeap

advapi32

GetTokenInformation AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueA

shell32

ShellExecuteExA

vcruntime140d

__current_exception_context __current_exception __std_type_info_destroy_list __vcrt_GetModuleHandleW __C_specific_handler memset memmove __vcrt_GetModuleFileNameW __C_specific_handler_noexcept __vcrt_LoadLibraryExW memcpy strstr

ucrtbased

_seh_filter_exe _set_app_type __setusermatherr _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _exit _set_fmode __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode strcpy_s strcat_s __stdio_common_vsprintf_s _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit terminate _wmakepath_s _wsplitpath_s wcscpy_s _CrtDbgReportW _CrtDbgReport __stdio_common_vfscanf __stdio_common_vfprintf getchar fopen fgets fclose __acrt_iob_func strtoul atoi exit free strlen _stricmp _strdup tolower isdigit __stdio_common_vsscanf strncpy strcat isspace _wcsicmp wcslen wcscat_s

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

824B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

454B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

748B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

patcher-v1.1.exe

kernel32

advapi32

shell32

vcruntime140d

ucrtbased

generic