ConsoleApplication1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ConsoleApplication1.exe
Size 194KB
Sample260706-w2n4eabx31
SHA256 da0b844f5740a80fbf479e2d470c95c59e14e0050345f7e9cfbf99d314ce0357
MD5 fdb9359e72a014bcde396c75b71a4189
SHA1 396f878d866f07cd835aaf973faff40173e7b4db
SHA512 7673dbb5fb824ecbc82f225b9e6f859392c2e2ce972d945c7f31e3a8570a66886d835b8eeb28d8837d7678f3ba5c78b4e4bc5013269440b8ab51d246b5b14887
SSDEEP 3072:P/wp9/9MTDHRpR2XV8pNAfsoox78Gvv+EBao9uB:PA9YrXWVAy278Gv6quB
TLSH
T18A14189975940876E2B2C0BBDCCA8696CCE07816133D45FF9245C4CEBF31BEC6A39A15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ConsoleApplication1.exe

File Explorer

ConsoleApplication1.exe

.exe 194KB

ConsoleApplication1.exe

IMPHASH 2b22d795712c7df8ef8f9618694da637
SHA256 da0b844f5740a80fbf479e2d470c95c59e14e0050345f7e9cfbf99d314ce0357
MD5 fdb9359e72a014bcde396c75b71a4189
SHA1 396f878d866f07cd835aaf973faff40173e7b4db
SHA512 7673dbb5fb824ecbc82f225b9e6f859392c2e2ce972d945c7f31e3a8570a66886d835b8eeb28d8837d7678f3ba5c78b4e4bc5013269440b8ab51d246b5b14887
SSDEEP 3072:P/wp9/9MTDHRpR2XV8pNAfsoox78Gvv+EBao9uB:PA9YrXWVAy278Gv6quB
TLSH
T18A14189975940876E2B2C0BBDCCA8696CCE07816133D45FF9245C4CEBF31BEC6A39A15
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71067

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator.WIN-JKNBP8OB8HF\source\repos\ConsoleApplication1\x64\Debug\ConsoleApplication1.pdb

kernel32

InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter MoveFileExW MultiByteToWideChar RaiseException IsDebuggerPresent GetCurrentThreadId SetUnhandledExceptionFilter GetStartupInfoW GetProcAddress HeapAlloc CopyFileW GetModuleHandleW GetModuleFileNameW CreateProcessW GetCurrentProcess Sleep GetLastError CloseHandle WriteFile SetFileAttributesW HeapFree GetProcessHeap VirtualQuery FreeLibrary RemoveDirectoryW FindNextFileW FindFirstFileW FindClose DeleteFileW WideCharToMultiByte CreateFileW

user32

GetClientRect GetWindowRect MessageBoxW FillRect SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx BeginPaint LoadCursorW InvalidateRect TranslateMessage DispatchMessageW ExitWindowsEx DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW ShowWindow BringWindowToTop GetAsyncKeyState SetForegroundWindow UpdateWindow EndPaint GetMessageW SetTimer KillTimer GetSystemMetrics DrawTextW

gdi32

GetStockObject SetBkMode SetTextColor

advapi32

RegOpenKeyExW RegCloseKey LookupPrivilegeValueW GetTokenInformation AdjustTokenPrivileges OpenProcessToken RegQueryValueExW RegSetValueExW RegDeleteTreeW CloseServiceHandle CreateServiceW OpenSCManagerW OpenServiceW RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW RegCreateKeyExW

shell32

SHGetFolderPathW

msvcp140d

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z

gdiplus

GdipCloneImage GdipLoadImageFromStream GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageRectI GdiplusShutdown GdipDisposeImage GdipLoadImageFromStreamICM GdipFree GdipAlloc GdiplusStartup

crypt32

CryptStringToBinaryA

shlwapi

ord12

vcruntime140d

_CxxThrowException memcpy __C_specific_handler __C_specific_handler_noexcept __std_type_info_destroy_list __current_exception __current_exception_context __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW memmove memset __std_exception_copy __std_exception_destroy

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

exit _exit _set_fmode __p___argc __p___argv _cexit wcscmp _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode strcpy_s _initterm __stdio_common_vsprintf_s _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit terminate _wmakepath_s _wsplitpath_s wcscpy_s _get_initial_narrow_environment _CrtDbgReport _initialize_narrow_environment _configure_narrow_argv __setusermatherr _initterm_e _set_app_type _seh_filter_exe _CrtDbgReportW _free_dbg malloc _callnewh strlen strcmp strcat_s wcslen _c_exit

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

638B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ConsoleApplication1.exe

kernel32

user32

gdi32

advapi32

shell32

msvcp140d

gdiplus

crypt32

shlwapi

vcruntime140d

vcruntime140_1d

ucrtbased

generic