564c393a2d06540fbb0563261ef4934704e51190748ac17d6fa1dfa131e71c0c
- SHA256 564c393a2d06540fbb0563261ef4934704e51190748ac17d6fa1dfa131e71c0c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
โครงการพระราชดําริปี2568/version.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
โครงการพระราชดําริปี2568/version.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 564c393a2d06540fbb0563261ef4934704e51190748ac17d6fa1dfa131e71c0c
- Size 959KB
- Sample260706-e5q9hadv7r
- SHA256 564c393a2d06540fbb0563261ef4934704e51190748ac17d6fa1dfa131e71c0c
- MD5 e913d0015fd51a140a92639ed8f68199
- SHA1 eddeb0a63b24bb235f78aa48443a869b69bc480b
- SHA512 7447f190e5c6f2af47a39c8ece26cb102b59a0fb581938ec876c84028ed19663fd0119a07294bcf97f45a60b0bde81129828789a26f2fbacb95182b850df53eb
- SSDEEP 24576:rN66orc50KJZp9SX2Lgz2R63IDrc3mQ5nFh7YzQD:g6orc50Ep9Sms2Y3IDAx5nv7uQD
- TLSH T18125235A3104D23D2B7528EFAA6B6BDF70DDEB36321C64903466A31659BFF439C31488
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/โครงการพระราชดําริปี2568/version.dll
File Explorer
-
564c393a2d06540fbb0563261ef4934704e51190748ac17d6fa1dfa131e71c0c.zip 959KB
-
โครงการพระราชดําริปี2568/version.dll.dll 9.2MB
โครงการพระราชดําริปี2568/version.dll
- IMPHASH 19783d37d9f30a76a291dde9d0b02ae5
- SHA256 c4d4d48407687cdef237603d85d3b0d87c9e53b47da0b9b5829e3f26e3d0d7cf
- MD5 23220df27a6a338e06971f09532c9801
- SHA1 fd269b190265eb86ecfa91afa29a87829043cdc6
- SHA512 345c9448b5ba570fc0324a8d3d75450bb3425bb28cfe519e1b90ab54ac29f9def0add747810547a910024a88934c57135f8dee0b9d690e74b2706ed30e69224f
- SSDEEP 24576:IzM0ayAujgUzJ17guZshyvjYTJ4qGeVnp85kqUsR9dHbk9pp7lDC10xqgrWCHoP:I40ayV17lAqqGeFCkqUsTZIv3xnrW6k
- TLSH T173A683D79C0796EEF686FB3875A23317B86737AB193CCA3E08D41D61961938015C728E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9357328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
d:\- C++ PROJECT\[CANDYAUTH] - NEXUS2.0\Dll1\build\x64\version.pdb
kernel32
LoadLibraryW
GetThreadContext
GetProcAddress
ExitProcess
GetCurrentProcessId
GetModuleHandleW
QueryPerformanceCounter
IsDebuggerPresent
CheckRemoteDebuggerPresent
GetExitCodeProcess
WriteProcessMemory
GetModuleHandleA
VirtualProtectEx
GetModuleHandleExA
GetModuleFileNameA
FindFirstFileW
GetFileSizeEx
FindFirstFileA
SetConsoleTitleA
FindNextFileW
WriteFile
DeviceIoControl
RemoveDirectoryW
GetDriveTypeA
FindNextFileA
SetThreadPriority
GetEnvironmentVariableA
FindClose
GetVolumeInformationA
UnmapViewOfFile
K32EnumProcessModulesEx
SetFileAttributesW
CreateEventW
MultiByteToWideChar
GetExitCodeThread
GetTempPathA
K32GetModuleFileNameExA
MoveFileExA
CreateFileA
SetEvent
CloseHandle
GetSystemDirectoryA
GetThreadPriority
DeleteFileA
DeleteFileW
FreeConsole
CreateThread
SetFileAttributesA
Module32FirstW
GetLocalTime
Beep
CreateFileMappingA
MoveFileExW
GetThreadId
RemoveDirectoryA
CreateProcessW
FreeLibrary
GetConsoleWindow
CreateEventA
MapViewOfFile
GetTickCount
AllocConsole
OpenThread
VirtualQueryEx
FlushFileBuffers
GetSystemInfo
Module32NextW
GetSystemTimeAsFileTime
WakeAllConditionVariable
InitializeSListHead
GetCurrentThreadId
SleepConditionVariableSRW
AcquireSRWLockExclusive
Process32FirstW
LoadLibraryA
GetCurrentThread
Process32NextW
GetLastError
GetTickCount64
Sleep
CreateToolhelp32Snapshot
OpenProcess
CreateFileW
WaitForSingleObject
GetWriteWatch
TerminateProcess
VirtualAlloc
OutputDebugStringA
GetCurrentProcess
VirtualFree
SetLastError
VirtualProtect
DisableThreadLibraryCalls
ReleaseSRWLockExclusive
QueryPerformanceFrequency
user32
ShowWindow
RegisterHotKey
wsprintfW
GetAsyncKeyState
PostMessageW
FindWindowW
GetMessageW
FindWindowA
MessageBoxA
advapi32
OpenServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegDeleteTreeA
RegNotifyChangeKeyValue
QueryServiceStatus
CloseServiceHandle
RegQueryValueExA
OpenSCManagerW
RegCreateKeyExA
ControlService
RegEnumKeyExW
RegDeleteTreeW
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey
RegQueryInfoKeyW
GetUserNameA
RegOpenKeyExW
msvcp140
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Throw_Cpp_error@std@@YAXH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?uncaught_exceptions@std@@YAHXZ
_Mtx_lock
_Mtx_unlock
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??Bios_base@std@@QEBA_NXZ
_Query_perf_frequency
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
_Query_perf_counter
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Random_device@std@@YAIXZ
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
??1_Lockit@std@@QEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0_Lockit@std@@QEAA@H@Z
wininet
InternetOpenW
ntdll
NtRaiseHardError
RtlAdjustPrivilege
bcrypt
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider
urlmon
URLOpenBlockingStreamA
wevtapi
EvtClearLog
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
__current_exception_context
__std_type_info_destroy_list
__RTDynamicCast
__C_specific_handler
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
wcsstr
__std_type_info_compare
memset
__std_type_info_name
strrchr
_CxxThrowException
memcmp
memcpy
memmove
_purecall
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
_beginthreadex
system
_seh_filter_dll
_configure_narrow_argv
_initterm_e
_initialize_onexit_table
_register_onexit_function
exit
_execute_onexit_table
terminate
_crt_atexit
_initialize_narrow_environment
_cexit
_errno
_initterm
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
fopen_s
freopen_s
__stdio_common_vfprintf
__stdio_common_vsprintf_s
__acrt_iob_func
fflush
fclose
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
fgetc
setvbuf
fgetpos
__stdio_common_vsprintf
fwrite
fputc
api-ms-win-crt-heap-l1-1-0
free
malloc
_aligned_malloc
_aligned_free
_callnewh
api-ms-win-crt-convert-l1-1-0
strtof
strtoul
api-ms-win-crt-string-l1-1-0
wcscmp
isalnum
_wcsicmp
tolower
strncmp
wcsncmp
strcmp
wcslen
strlen
wcscpy_s
strncpy_s
strcat_s
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
sinf
sin
cos
sqrt
tan
expf
Export_GetFileVersionInfoA
Export_GetFileVersionInfoByHandle
Export_GetFileVersionInfoExA
Export_GetFileVersionInfoExW
Export_GetFileVersionInfoSizeA
Export_GetFileVersionInfoSizeExA
Export_GetFileVersionInfoSizeExW
Export_GetFileVersionInfoSizeW
Export_GetFileVersionInfoW
Export_VerFindFileA
Export_VerFindFileW
Export_VerInstallFileA
Export_VerInstallFileW
Export_VerLanguageNameA
Export_VerLanguageNameW
Export_VerQueryValueA
Export_VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
Name
.text
Size
9.0MB
Virtual Size
9.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
229KB
Virtual Size
229KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.1337
Size
512B
Virtual Size
125B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=8, id=260, version=35721,
count=27, id=261, version=35721,
count=6, id=257, version=35721,
count=39, id=261, version=36247,
count=19, id=257, version=35215,
count=367, id=1, productName=Unmarked objects,
count=21, id=265, version=36247,
count=3, id=259, version=36247,
count=1, id=256, version=36247,
count=1, id=255, version=36247,
count=1, id=258, version=36247,