27888b94c3fda22dd05fb2f438a770ff67ceae0d966ec6532a0fb9d44f605493

General

Target
27888b94c3fda22dd05fb2f438a770ff67ceae0d966ec6532a0fb9d44f605493
Size 208KB
Sample260710-bmydbabx2n
SHA256 27888b94c3fda22dd05fb2f438a770ff67ceae0d966ec6532a0fb9d44f605493
MD5 5daf9eb7dcbdc8ad333a457df03fab17
SHA1 67899794bb9c021912ac5ee1a700f0c63d7773ff
SHA512 c5295350bd132055df1ed669bec24b518b817c0033273ece84b4d6d3046ab2e41c5f401e83c6391074216e42a02de273b1ee31ef56997695435a208aef28e3d7
SSDEEP 3072:+JUwjUZWik1tksGCvZvW3SrN8uk56RMzO3zQxGDysMF6KYkD:GKZqesGCvZv9p8pC3KPj
TLSH
T1A5247D4973E404F8E5B39238CD514A46E776B8160760EB8F03B147BAEF276909D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27888b94c3fda22dd05fb2f438a770ff67ceae0d966ec6532a0fb9d44f605493

File Explorer

27888b94c3fda22dd05fb2f438a770ff67ceae0d966ec6532a0fb9d44f605493

.exe 208KB

27888b94c3fda22dd05fb2f438a770ff67ceae0d966ec6532a0fb9d44f605493

IMPHASH 34c56f7927b2cb2dff1eea44605d4ac6
SHA256 27888b94c3fda22dd05fb2f438a770ff67ceae0d966ec6532a0fb9d44f605493
MD5 5daf9eb7dcbdc8ad333a457df03fab17
SHA1 67899794bb9c021912ac5ee1a700f0c63d7773ff
SHA512 c5295350bd132055df1ed669bec24b518b817c0033273ece84b4d6d3046ab2e41c5f401e83c6391074216e42a02de273b1ee31ef56997695435a208aef28e3d7
SSDEEP 3072:+JUwjUZWik1tksGCvZvW3SrN8uk56RMzO3zQxGDysMF6KYkD:GKZqesGCvZv9p8pC3KPj
TLSH
T1A5247D4973E404F8E5B39238CD514A46E776B8160760EB8F03B147BAEF276909D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

27952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\C++\自用项目\SimpleRemoter-master\x64\Release\TestRun.pdb

kernel32

LoadLibraryA DeleteFileA CloseHandle SetFileAttributesA GetProcAddress Sleep FreeLibrary CreateProcessA GetPrivateProfileIntA GetPrivateProfileStringA GetExitCodeProcess WriteConsoleW WaitForSingleObject GetEnvironmentVariableA GetCurrentProcess MoveFileA SetConsoleCtrlHandler GetCurrentProcessId GetModuleFileNameA EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileAttributesExW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize CreateFileW RtlUnwind

advapi32

LookupPrivilegeValueA OpenProcessToken AdjustTokenPrivileges

Sharing

General

Malware Config

Signatures

File Explorer

27888b94c3fda22dd05fb2f438a770ff67ceae0d966ec6532a0fb9d44f605493

kernel32

advapi32

generic