HMADE XITERS.rar
- SHA256 228f28bbe4b324d9a640c77a141bfc51b0819e74b97a48613a794703f0957d85
Password
12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HMADE XITERS.rar
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target HMADE XITERS.rar
- Size 2.2MB
- Sample260705-v6awxaev7x
- SHA256 228f28bbe4b324d9a640c77a141bfc51b0819e74b97a48613a794703f0957d85
- MD5 862c2dda2c7aaa4e82eff73b0addf044
- SHA1 a7a9bbdc413e59abc99a10e1cbc5db7a02e1d263
- SHA512 da6b7770327dc162291844783cafcf118c37d07c2dc0ab543e3076335341d961f9f246e8712863e2d1ac2e6bfc3c1e05f44126dc13e4ea710e29aeed59b0e74f
- SSDEEP 49152:lA/04l1NshNrVJlNrfdR0eOYxRyBRN2CHNezydRSgDVD:lA/N1+3nPH1xIRNxNeuSgDN
- TLSH T136B53335DC27F8757829A18D68A5F8DD231C7D7027F28A75E22A9841027EFFEA8F1015
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Extreme Injector v3.exe unpack001/HMADE XITERS.dll
File Explorer
-
HMADE XITERS.rar.rar 2.2MB
-
Extreme Injector v3.exe.exe 1.9MB
-
HMADE XITERS.dll.dll 1.9MB
Extreme Injector v3.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
- MD5 ec801a7d4b72a288ec6c207bb9ff0131
- SHA1 32eec2ae1f9e201516fa7fcdc16c4928f7997561
- SHA512 a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac
- SSDEEP 49152:NNEVtO1U1y1DDDDDD7Llngq7NNMqU0p2Vhk9a:NNEVJyZlng4p2V
- TLSH T1B8956D997650B69EC89BC932CAE51C2CF760A07B571BC343A46325EC9D4DA9BCF041B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
12
Minor OS version
0
Major OS version
4
Entry point
1955422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
HMADE XITERS.dll
- IMPHASH 49c15af340838dc8cfd76bd4f59380f0
- SHA256 c53c0f09f8c79556e61f2f0d742988004464d11f1dfd0e41d8466714f89812ac
- MD5 057c64b73f48d471332aff32eeb811a6
- SHA1 0d4d6c5c164f1166658901528af195fa689e8f83
- SHA512 c0f8448b9b45ec69d6a4f948bd4d7103d33b1fe12dc053edf40e287bafa53b3c56d6cb8c84ec8eec9703f4ca79eea9c4057ed716ae9c79d2581e04c30725d4fa
- SSDEEP 49152:XpqJnhwjHzzTn691/2a2nq4y2d7n2TttYoPW8EyU:cLkbyTttYoPD
- TLSH T11395C043E2D54299CF678178C1A7933BD7317C851720C7CB66A40A69AFA3BE06B7E314
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
12
Minor OS version
0
Major OS version
6
Entry point
950856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\LWA3AR\Downloads\GOTEN PRIME\examples\example_win32_directx11\Final\HMADE XITERS.pdb
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
GetLastError
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
ReadFile
GetModuleFileNameA
GlobalFree
WriteProcessMemory
GetTickCount
WriteFile
TerminateProcess
CreatePipe
WaitForSingleObject
OpenProcess
SetCurrentDirectoryA
DisableThreadLibraryCalls
TerminateThread
Process32Next
CreateThread
VirtualProtectEx
Beep
ReadProcessMemory
CreateProcessA
VirtualQueryEx
CreateFileA
GetFileSizeEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GlobalAlloc
SleepConditionVariableSRW
WakeAllConditionVariable
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
SetHandleInformation
GlobalLock
MultiByteToWideChar
Process32First
user32
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
GetAsyncKeyState
GetDC
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetWindowThreadProcessId
DispatchMessageA
GetWindowRect
DestroyWindow
EnumChildWindows
PostMessageA
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
GetActiveWindow
ShowWindow
SetWindowLongA
FindWindowExA
GetWindowTextA
GetWindowLongA
SetWindowDisplayAffinity
MessageBoxA
SetLayeredWindowAttributes
TranslateMessage
LoadIconA
PeekMessageA
GetWindowLongPtrA
PostQuitMessage
SetWindowLongPtrA
FindWindowA
UpdateWindow
GetKeyState
GetMessageExtraInfo
LoadCursorA
DefWindowProcW
GetCapture
ClientToScreen
ScreenToClient
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
gdi32
GetPixel
ole32
CoUninitialize
CoInitialize
CoCreateInstance
CoInitializeEx
windivert
WinDivertClose
WinDivertOpen
WinDivertRecv
WinDivertSend
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?good@ios_base@std@@QEBA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
imm32
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
_CxxThrowException
__intrinsic_setjmp
__C_specific_handler
memcmp
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
strrchr
longjmp
memcpy
memmove
memset
memchr
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fflush
__stdio_common_vsscanf
fclose
fseek
ftell
fread
__stdio_common_vfprintf
fwrite
__stdio_common_vsprintf
_wfopen
__stdio_common_vsprintf_s
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
exit
_beginthreadex
_initterm_e
terminate
system
_wassert
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-string-l1-1-0
strlen
strncpy
strncmp
strcpy_s
strcmp
strcpy
_stricmp
api-ms-win-crt-heap-l1-1-0
_callnewh
free
_msize
malloc
api-ms-win-crt-convert-l1-1-0
strtol
strtoull
atof
api-ms-win-crt-math-l1-1-0
ceilf
sqrtf
cos
atan2f
acosf
cosf
floorf
fmod
fmodf
log
logf
pow
powf
sinf
sqrt
sin
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
Name
.text
Size
933KB
Virtual Size
933KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
468KB
Virtual Size
467KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
508KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=253, version=35207,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=24, id=261, version=35207,
count=6, id=257, version=35207,
count=6, productName=Unmarked objects (old),
count=2, id=260, version=33145,
count=27, id=260, version=35727,
count=19, id=257, version=33145,
count=310, id=1, productName=Unmarked objects,
count=15, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,