5bfc4af93dca737400b6f8a0f1efa6f30b22262e2665e1b91b76774c4e1aff68

Sharing

Copy URL Twitter E-mail

General

Target
5bfc4af93dca737400b6f8a0f1efa6f30b22262e2665e1b91b76774c4e1aff68
Size 1.4MB
Sample260708-csph2ahv9w
SHA256 5bfc4af93dca737400b6f8a0f1efa6f30b22262e2665e1b91b76774c4e1aff68
MD5 32e10f460d92818b0cf1b3691c1902b7
SHA1 991e6e6d022328c1e494216bf76299882062e12c
SHA512 b2574b2b0470bc1b4a194491fa6baf8868bff4e2ddc878863ac236503b439f4f1f9b669267f6b2d32b3fe6eeb3be17d797538a1a5f395b20dee94b66c7d39253
SSDEEP 24576:PrTT2/LqodWB7ySDq69MqRfHYZqIEkTmfvRL7T9iyQw11BkLGZSjrsl+:PrTT2Dqg+7yEq0GqINTmfvRnTTD1DkLI
TLSH
T1C1659D8666B401BDC5ABC174C96A4A1BD7B2B8450F30D7DF0ED09B5A2F33AE1527E324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bfc4af93dca737400b6f8a0f1efa6f30b22262e2665e1b91b76774c4e1aff68

File Explorer

5bfc4af93dca737400b6f8a0f1efa6f30b22262e2665e1b91b76774c4e1aff68

.dll 1.4MB

5bfc4af93dca737400b6f8a0f1efa6f30b22262e2665e1b91b76774c4e1aff68

IMPHASH 45347afd615e88536302be0c40ee7b74
SHA256 5bfc4af93dca737400b6f8a0f1efa6f30b22262e2665e1b91b76774c4e1aff68
MD5 32e10f460d92818b0cf1b3691c1902b7
SHA1 991e6e6d022328c1e494216bf76299882062e12c
SHA512 b2574b2b0470bc1b4a194491fa6baf8868bff4e2ddc878863ac236503b439f4f1f9b669267f6b2d32b3fe6eeb3be17d797538a1a5f395b20dee94b66c7d39253
SSDEEP 24576:PrTT2/LqodWB7ySDq69MqRfHYZqIEkTmfvRL7T9iyQw11BkLGZSjrsl+:PrTT2Dqg+7yEq0GqINTmfvRnTTD1DkLI
TLSH
T1C1659D8666B401BDC5ABC174C96A4A1BD7B2B8450F30D7DF0ED09B5A2F33AE1527E324
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

609856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

G:\Cocos\tools\BabeLua_mod\x64\Release\Decoda.pdb

kernel32

GetLocalTime lstrlenW DisableThreadLibraryCalls OpenProcess ReadFile CreateActCtxW ActivateActCtx SearchPathW TlsSetValue VirtualProtect SetLastError VirtualFree GetCommandLineW lstrcpynW GetModuleHandleExW OutputDebugStringA VirtualAlloc WaitForMultipleObjects FindActCtxSectionStringW WaitForSingleObject GetFileAttributesW DeactivateActCtx ResumeThread CreateEventW QueryActCtxW MultiByteToWideChar GetLastError GetFileAttributesExW SetEvent TlsAlloc RaiseException CreateThread DecodePointer SetCurrentDirectoryW VirtualAllocEx GetFileSize lstrcpynA GetModuleHandleW TlsGetValue TlsFree VirtualQuery IsDebuggerPresent CancelIoEx ReadDirectoryChangesW LoadLibraryExW GetExitCodeProcess DuplicateHandle TerminateProcess FormatMessageW GetFullPathNameW InitializeCriticalSectionEx SetHandleInformation ResetEvent CreateNamedPipeW ConnectNamedPipe QueueUserWorkItem FlushFileBuffers DisconnectNamedPipe WriteFile GetOverlappedResult CreateDirectoryW GetModuleFileNameA QueryDosDeviceW FindFirstFileW GetFileAttributesExA HeapFree WritePrivateProfileStringW FindNextFileW GetCurrentProcessId CreateMutexW FindClose GetVersionExW GetModuleHandleA GetExitCodeThread GetFileAttributesA OutputDebugStringW lstrcatW GetCurrentDirectoryW LocalFree VerSetConditionMask FlushInstructionCache VerifyVersionInfoW IsBadReadPtr lstrcmpW OpenThread HeapReAlloc HeapSize HeapDestroy WideCharToMultiByte GetTickCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleHandleExA InitializeCriticalSection RtlUnwindEx RtlRestoreContext ReleaseMutex GetEnvironmentVariableA MoveFileExW SleepEx QueryPerformanceFrequency GetSystemDirectoryW LoadLibraryExA InterlockedPushEntrySList InterlockedPopEntrySList EncodePointer InitializeSListHead QueryPerformanceCounter WaitForSingleObjectEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext FreeLibrary LoadLibraryW CreateFileW GetModuleFileNameW GetCurrentProcess GetProcAddress FindResourceW FindResourceExW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc InitializeCriticalSectionAndSpinCount GetCurrentThreadId GetSystemTimeAsFileTime Sleep FormatMessageA GetFileTime DosDateTimeToFileTime CloseHandle CreateFileA LocalFileTimeToFileTime IsBadWritePtr SetFileTime

user32

TranslateMessage DispatchMessageW UnregisterClassW FindWindowExW GetWindowThreadProcessId AttachThreadInput GetActiveWindow DialogBoxParamW IsWindow IsWindowVisible GetForegroundWindow SetForegroundWindow SetActiveWindow EnableWindow GetWindow PostQuitMessage SetWindowTextW MessageBoxW SetWindowLongPtrW EndDialog SendMessageW GetDlgItem SetDlgItemTextW GetLastActivePopup PeekMessageW MsgWaitForMultipleObjectsEx MessageBoxA IsWindowEnabled SetFocus GetClassNameW GetUserObjectInformationW GetDesktopWindow GetProcessWindowStation IsIconic GetParent IsDialogMessageW ShowWindow

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW CryptGenRandom OpenProcessToken

shell32

SHCreateItemFromParsingName SHGetSpecialFolderPathW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW

ole32

CoTaskMemFree MkParseDisplayName BindMoniker CreateBindCtx CoInitializeEx CoInitializeSecurity CoUninitialize CoCreateInstance

oleaut32

VariantChangeType SysReAllocString SysAllocString VariantClear VariantCopy SysAllocStringByteLen SysStringByteLen SysFreeString VariantInit GetErrorInfo

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shlwapi

PathFindFileNameW PathFindExtensionW PathFindFileNameA PathMatchSpecW PathCanonicalizeW PathIsRelativeW

ws2_32

inet_pton WSAIoctl WSASetLastError WSAEnumNetworkEvents ntohs WSACreateEvent WSAResetEvent WSAWaitForMultipleEvents WSAEventSelect WSACloseEvent gethostbyaddr ioctlsocket recvfrom sendto send accept listen bind select WSACleanup WSAStartup WSASocketW gethostbyname connect recv htons WSAGetLastError shutdown closesocket socket getsockopt getaddrinfo getpeername getsockname inet_ntoa htonl setsockopt getnameinfo freeaddrinfo gethostname __WSAFDIsSet

luainject

ord15 ord20 ord18 ord14 ord21 ord17 ord16 ord22 ord5 ord3 ord2 ord11 ord10 ord23 ord19 ord4 ord9 ord13 ord12 ord8 ord7

msvcr14x

ceilf _unlink __p__fmode strlen sqrt setlocale system tmpnam rename remove _mktime64 _difftime64 clock ungetc tmpfile setvbuf _popen _pclose getc clearerr putchar strcmp ldexp modf frexp fmod atan2 tanh cosh sinh atan acos asin tan cos sin exp log10 log pow memcmp memchr __DestructExceptionObject _ftelli64 _fseeki64 memcpy _gmtime64_s ferror strftime strspn strcspn _gmtime64 strtoll fgets fflush tolower _stat64 _access _wstat64 _waccess fputc ftell strtoul fputs qsort wcspbrk feof fseek strerror __sys_nerr wcstombs memmove __std_type_info_destroy_list _CxxThrowException memset _initterm_e _invalid_parameter_noinfo _initterm __current_exception_context __current_exception terminate _callnewh _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll rand strrchr fread strchr strstr _localtime64 _time64 wcsncpy __stdio_common_vsprintf_s isalpha _strdup realloc wcsncat strnlen _mbsstr _mbschr atoi _endthreadex getenv wcstoul _wcslwr_s __stdio_common_vswscanf iswspace wcstok_s strncmp _wcsnicmp _wgetenv wcschr _beginthreadex _wcsicmp wcstol __std_exception_destroy __std_exception_copy wcscpy_s _recalloc wcsstr wcsrchr wcsncmp _wfopen _invalid_parameter_noinfo_noreturn wcsnlen wmemcpy_s __stdio_common_vswprintf_s wcscmp __stdio_common_vswprintf calloc __std_terminate __C_specific_handler __CxxFrameHandler4 __stdio_common_vsscanf strtol __stdio_common_vsprintf malloc _mkdir free __stdio_common_vfscanf _errno exit fopen __acrt_iob_func fclose __stdio_common_vfprintf strncpy fwrite

Name

.text

Size

950KB

Virtual Size

949KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

197KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pcode0

Size

208KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=1, productName=Unmarked objects (old),

count=66, id=260, version=30148,

count=2, id=257, version=30148,

count=8, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=4, id=257, version=32216,

count=6, id=253, version=28518,

count=32, id=261, version=30034,

count=8, id=260, version=30034,

count=4, id=259, version=30034,

count=6, id=260, version=30795,

count=1, id=262, version=30795,

count=29, id=257, version=30795,

count=669, id=1, productName=Unmarked objects,

count=158, id=264, version=30148,

count=1, id=259, version=30148,

count=1, id=256, version=30148,

count=1, id=255, version=30148,

count=1, id=151,

count=1, id=258, version=30148,