7q9k-External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
7q9k-External.exe
Size 841KB
Sample260724-bctblszhmc
SHA256 97a3914b13dd388cb8c54bf9371caf3ae0bb6a61959dd309b00bab4a5bf11f2b
MD5 5bc34591d526bee476170237772123de
SHA1 3bca6b7444626e07c5e0385d2bc2c47206e37207
SHA512 380494a7546ac0b6afb47298430ed5e0266da3e14eddba0028be90b68bbf9b14d6c3df6e570789eb53ff9c49750b5ae5d526a53dee703ee3e8f80f6dd9575eab
SSDEEP 24576:YO7zlz7MAC/Gaa12gf+dHeITiVn23F+/:N7zlz7XnHP2sIOVnU+/
TLSH
T14C05AF45B5B501F9C0BBD039D986B90BEA7138590B608ADB13F446A93FB37F05A7B312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7q9k-External.exe

File Explorer

7q9k-External.exe

.exe 841KB

7q9k-External.exe

IMPHASH 6a7c21adcbad5f9741a278c1a4b649cc
SHA256 97a3914b13dd388cb8c54bf9371caf3ae0bb6a61959dd309b00bab4a5bf11f2b
MD5 5bc34591d526bee476170237772123de
SHA1 3bca6b7444626e07c5e0385d2bc2c47206e37207
SHA512 380494a7546ac0b6afb47298430ed5e0266da3e14eddba0028be90b68bbf9b14d6c3df6e570789eb53ff9c49750b5ae5d526a53dee703ee3e8f80f6dd9575eab
SSDEEP 24576:YO7zlz7MAC/Gaa12gf+dHeITiVn23F+/:N7zlz7XnHP2sIOVnU+/
TLSH
T14C05AF45B5B501F9C0BBD039D986B90BEA7138590B608ADB13F446A93FB37F05A7B312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

123456789

Minor OS version

Major OS version

Entry point

469464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\paulg\OneDrive\Dokumente\CS2 External\bin\Release\7q9k-External.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

d3dcompiler_47

D3DCompile

kernel32

CloseHandle GetExitCodeProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW Module32FirstW Module32NextW GetModuleHandleW ReadProcessMemory WriteProcessMemory CreateFileW GetProcAddress MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetLastError HeapReAlloc ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess ReadFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount OpenProcess GetProcessHeap SetStdHandle SetLastError HeapSize WriteConsoleW SetEndOfFile GetCurrentThreadId Sleep RtlUnwind InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException

user32

GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData mouse_event DefWindowProcW DestroyWindow SetWindowPos CreateWindowExW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow MapVirtualKeyW GetWindowRect SetWindowLongPtrW GetWindowLongPtrW IsWindow GetKeyNameTextA GetAsyncKeyState MessageBoxA GetForegroundWindow FindWindowW SetForegroundWindow

shell32

ShellExecuteW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

639KB

Virtual Size

639KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7q9k-External.exe

d3d11

dwmapi

d3dcompiler_47

kernel32

user32

shell32

imm32

generic