ConsoleApplication1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ConsoleApplication1.exe
Size 1.1MB
Sample260714-pk4zzaey2z
SHA256 9910665bc28ccce91ec54b70fa90d878283653a39dca88661f75cdde0a24f8c3
MD5 d0f8dd7445b08eaeaa5d47b2eca85aea
SHA1 0def82ed1b0df21212e1c193b9316b83a99f541d
SHA512 ce192c7e8608a92dfbb7e370403296d5efc9674cdd9f600cdc9c3007e25b83174b81c9fcfb0921d74cdb5640273af6527b153882c2a31bf3ca7b4ecb0babc9aa
SSDEEP 24576:7mxLGOOQ8X0J8l+gFs+XlrXTUJhhmwAhVw6dvLMvoZYAzc6ThIy8iKnCNECKI:7KX8XXu+13Yhm7BdDMvoZYAzc6ThIy5P
TLSH
T12345AE56A3B841F5C07FD178C646920FEAB23458132097EB13E48EA93F63AE15B7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ConsoleApplication1.exe

File Explorer

ConsoleApplication1.exe

.exe 1.1MB

ConsoleApplication1.exe

IMPHASH 54d0aa0b786b4a72b2248b6e0b37238f
SHA256 9910665bc28ccce91ec54b70fa90d878283653a39dca88661f75cdde0a24f8c3
MD5 d0f8dd7445b08eaeaa5d47b2eca85aea
SHA1 0def82ed1b0df21212e1c193b9316b83a99f541d
SHA512 ce192c7e8608a92dfbb7e370403296d5efc9674cdd9f600cdc9c3007e25b83174b81c9fcfb0921d74cdb5640273af6527b153882c2a31bf3ca7b4ecb0babc9aa
SSDEEP 24576:7mxLGOOQ8X0J8l+gFs+XlrXTUJhhmwAhVw6dvLMvoZYAzc6ThIy8iKnCNECKI:7KX8XXu+13Yhm7BdDMvoZYAzc6ThIy5P
TLSH
T12345AE56A3B841F5C07FD178C646920FEAB23458132097EB13E48EA93F63AE15B7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

885308

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\GloryX No Res Emu\ConsoleApplication1\x64\Release\ConsoleApplication1.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetSystemDirectoryW DeleteCriticalSection InitializeCriticalSectionEx GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive EnterCriticalSection LeaveCriticalSection LoadLibraryW SleepEx SetLastError QueryPerformanceCounter FlushFileBuffers VirtualQueryEx ConnectNamedPipe CreateProcessW GetCurrentProcessId ReadProcessMemory ExitProcess LocalFree CreateFileMappingA GetProcAddress Beep CancelIoEx GetSystemInfo GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA FreeLibrary PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx WakeAllConditionVariable RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW CloseHandle Process32FirstW DeleteFileW DeleteFileA Process32NextW GetLastError GetTickCount64 Sleep CreateToolhelp32Snapshot OpenProcess DisconnectNamedPipe GetModuleHandleA ReleaseMutex CreateFileW WaitForSingleObject CreateMutexA FindClose GetTempPathW CreateNamedPipeW VerSetConditionMask IsDBCSLeadByte QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar OutputDebugStringA GetModuleHandleW RtlLookupFunctionEntry InitializeCriticalSection GetFileType WriteConsoleOutputCharacterA TerminateProcess WriteFile GetStdHandle GetCurrentProcess FindNextFileW SetConsoleTextAttribute FindFirstFileW GetModuleFileNameA ReadFile FormatMessageW CreateProcessA

user32

ShowWindow ReleaseCapture IsWindowUnicode GetClientRect SetCursor PeekMessageA SetCursorPos RegisterClassExW CreateWindowExW PostQuitMessage UpdateWindow OpenClipboard GetForegroundWindow CloseClipboard DispatchMessageA EmptyClipboard SetCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetKeyState LoadCursorA DefWindowProcW GetCursorPos SetClipboardData GetMessageExtraInfo GetClipboardData TranslateMessage

advapi32

OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW OpenEventLogW CloseEventLog ClearEventLogW AdjustTokenPrivileges GetNumberOfEventLogRecords LookupPrivilegeValueW CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW GetOldestEventLogRecord

shell32

SHFileOperationW ShellExecuteW

msvcp140

_Strxfrm _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A _Mtx_lock _Strcoll _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpQueryDataAvailable WinHttpSetTimeouts

crypt32

CertFreeCertificateChainEngine CertGetCertificateChain CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertOpenStore CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateChain

ws2_32

recv htons getsockname getpeername connect bind WSASetLastError ntohs WSAGetLastError closesocket WSAEventSelect __WSAFDIsSet WSACreateEvent WSACloseEvent send getsockopt inet_ntop freeaddrinfo getaddrinfo select accept socket htonl listen recvfrom sendto ioctlsocket gethostname WSAEnumNetworkEvents WSAIoctl setsockopt inet_pton

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __current_exception_context __current_exception wcschr strstr strrchr memmove _CxxThrowException memset memcpy memcmp memchr strchr __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

fclose _lseeki64 __stdio_common_vsprintf_s fgetc _read _wopen _write __p__commode feof fputs __stdio_common_vsprintf _fileno _close fflush fgetpos fwrite __stdio_common_vswprintf_s setvbuf ungetc fsetpos fread fgets fputc __stdio_common_vsscanf _set_fmode _fseeki64 _get_stream_buffer_pointers ftell __acrt_iob_func fseek _wfopen __stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

malloc calloc _set_new_mode _callnewh free realloc

api-ms-win-crt-runtime-l1-1-0

exit __sys_errlist _invoke_watson __sys_nerr abort terminate system _beginthreadex _register_thread_local_exe_atexit_callback _c_exit _configure_narrow_argv _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _errno

api-ms-win-crt-string-l1-1-0

strncmp _wcsicmp isdigit strcmp wcsncmp strcspn wcspbrk isalnum strspn _strdup wcsncpy strpbrk

api-ms-win-crt-time-l1-1-0

strftime _gmtime64 _localtime64_s _time64

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _fstat64 _unlock_file _unlink _lock_file

api-ms-win-crt-convert-l1-1-0

atoi strtol strtoll wcstombs strtoul

api-ms-win-crt-math-l1-1-0

__setusermatherr sqrtf acosf ceilf cosf fmodf _fdopen sinf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale