PoolMaze-1[.]0[.]0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
PoolMaze-1.0.0.exe
Size 257KB
Sample260722-x2kawsshle
SHA256 b35a95683b7060bd02ed774262f9d4ad7f3378348b0f5ab36518d88d3bf7cabe
MD5 8aef422d62f5f3f2cb0fd649734fc107
SHA1 84890dd18db625a275a12a5a7180636ffb2206df
SHA512 6a4786c5a47ef017c9740bf6fd8406912a5771de61d494d8cd6f754de7ad7823509482d9df48f31f2fe28b77fcc9dade3a3079cae119c14025f2b5e84c014ec2
SSDEEP 1536:18851mxDK2K2L8Eb4/+M6gvWjgdCQn6CQDipSkOwB4IePs1y08rsdmGzLBckn5o2:1h8xDKOL8Eba6ydwWL5j
TLSH
T163441A43B4437EF3D5080E3B7F57C295F3A46299429A1B6A7A2910F30D019FE6EBAD41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PoolMaze-1.0.0.exe

File Explorer

PoolMaze-1.0.0.exe

.exe 257KB

PoolMaze-1.0.0.exe

IMPHASH 4778dabf7b995e19b96623ef806bc254
SHA256 b35a95683b7060bd02ed774262f9d4ad7f3378348b0f5ab36518d88d3bf7cabe
MD5 8aef422d62f5f3f2cb0fd649734fc107
SHA1 84890dd18db625a275a12a5a7180636ffb2206df
SHA512 6a4786c5a47ef017c9740bf6fd8406912a5771de61d494d8cd6f754de7ad7823509482d9df48f31f2fe28b77fcc9dade3a3079cae119c14025f2b5e84c014ec2
SSDEEP 1536:18851mxDK2K2L8Eb4/+M6gvWjgdCQn6CQDipSkOwB4IePs1y08rsdmGzLBckn5o2:1h8xDKOL8Eba6ydwWL5j
TLSH
T163441A43B4437EF3D5080E3B7F57C295F3A46299429A1B6A7A2910F30D019FE6EBAD41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

ChoosePixelFormat CreateFontA DeleteObject SelectObject SetPixelFormat SwapBuffers

kernel32

CloseHandle CreateThread DeleteCriticalSection EnterCriticalSection FreeLibrary GetLastError GetModuleHandleA GetProcAddress GetStartupInfoA InitializeCriticalSection LeaveCriticalSection LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject

msvcrt

__getmainargs __initenv __p__acmdln __p__commode __p__fmode __set_app_type __setusermatherr _amsg_exit _cexit _errno _initterm _iob _ismbblead _onexit abort calloc exit fprintf free fwrite malloc memcpy signal strlen strncmp vfprintf

opengl32

glBegin glBlendFunc glCallLists glClear glClearColor glColor3f glColor4f glColorMaterial glCullFace glDeleteLists glDisable glEnable glEnd glFogf glFogfv glFogi glFrustum glGenLists glHint glLightModelfv glLightfv glListBase glLoadIdentity glMatrixMode glMultMatrixf glNormal3f glOrtho glPopMatrix glPushMatrix glScalef glShadeModel glTranslatef glVertex2f glVertex3f glViewport wglCreateContext wglDeleteContext wglMakeCurrent wglUseFontBitmapsA

user32

AdjustWindowRect CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA GetDC LoadCursorA LoadIconA MessageBoxA PeekMessageA PostMessageA PostQuitMessage RegisterClassExA ReleaseDC ShowWindow TranslateMessage UpdateWindow

winmm

midiOutClose midiOutOpen midiOutShortMsg

Name

.text

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

236B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

1024B

Virtual Size

885B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/78

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/94

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/110

Size

512B

Virtual Size

422B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

PoolMaze-1.0.0.exe

gdi32

kernel32

msvcrt

opengl32

user32

winmm

generic