b642a047aedc6b2bea6fc26329d0aa2e15ded0b5c1620d2936d364d1d4176c88

Sharing

Copy URL Twitter E-mail

General

Target
b642a047aedc6b2bea6fc26329d0aa2e15ded0b5c1620d2936d364d1d4176c88
Size 40KB
Sample260722-pyk41shr3w
SHA256 b642a047aedc6b2bea6fc26329d0aa2e15ded0b5c1620d2936d364d1d4176c88
MD5 b018791c9edb50f1e282f2489ce45bd1
SHA1 4c5982e5df4ecd016fe37443eb328628ec01a5e9
SHA512 6a5a9981af61f13a9548423bb82e518739733ff1756f68c493edd656508f062450e9dc261a057f60112c903298c55d55263f1c4ac628a2259236c2f78d2e5464
SSDEEP 384:CvvF3Rwab23THkCD+SAe4vRQtBEBNm6k9OoO+Xthz0RVCHpLzBDVmPrMhFS9yEhp:Cn3XCD+3vaZlHz0vCZNDIP4S9yypZHF
TLSH
T153134A0B739600E8C2A5937CD8DB5B1BC37278451712A7CF13E1D15A1F22BE5A9BEA90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b642a047aedc6b2bea6fc26329d0aa2e15ded0b5c1620d2936d364d1d4176c88

File Explorer

b642a047aedc6b2bea6fc26329d0aa2e15ded0b5c1620d2936d364d1d4176c88

.exe 40KB

b642a047aedc6b2bea6fc26329d0aa2e15ded0b5c1620d2936d364d1d4176c88

IMPHASH 1e192e96c01414043161d61db836838b
SHA256 b642a047aedc6b2bea6fc26329d0aa2e15ded0b5c1620d2936d364d1d4176c88
MD5 b018791c9edb50f1e282f2489ce45bd1
SHA1 4c5982e5df4ecd016fe37443eb328628ec01a5e9
SHA512 6a5a9981af61f13a9548423bb82e518739733ff1756f68c493edd656508f062450e9dc261a057f60112c903298c55d55263f1c4ac628a2259236c2f78d2e5464
SSDEEP 384:CvvF3Rwab23THkCD+SAe4vRQtBEBNm6k9OoO+Xthz0RVCHpLzBDVmPrMhFS9yEhp:Cn3XCD+3vaZlHz0vCZNDIP4S9yypZHF
TLSH
T153134A0B739600E8C2A5937CD8DB5B1BC37278451712A7CF13E1D15A1F22BE5A9BEA90
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\larry\source\repos\Bypass\x64\Release\Keylogger.pdb

kernel32

Sleep RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext

user32

MessageBoxW FindWindowA MapVirtualKeyExA SetWindowsHookExW GetForegroundWindow GetKeyboardLayout GetWindowTextA ShowWindow GetWindowThreadProcessId GetMessageW GetSystemMetrics GetKeyState CallNextHookEx

msvcp140

??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1_Lockit@std@@QEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset _CxxThrowException __C_specific_handler __current_exception_context __current_exception __std_terminate __std_exception_copy memcpy __std_exception_destroy memmove

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers fsetpos fread __p__commode _fseeki64 setvbuf fgetpos fwrite fputc _set_fmode ungetc fgetc fflush fclose

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s strftime

api-ms-win-crt-string-l1-1-0

tolower strcpy_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _initialize_narrow_environment _crt_atexit _get_initial_narrow_environment _configure_narrow_argv exit _exit _invalid_parameter_noinfo_noreturn __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initterm_e terminate _initialize_onexit_table _initterm _set_app_type

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

b642a047aedc6b2bea6fc26329d0aa2e15ded0b5c1620d2936d364d1d4176c88

kernel32

user32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic