25554332caa7ee354f1557730e23c8253381f230ab7e9d33697057f19ecd6ab7

Sharing

Copy URL Twitter E-mail

General

Target
25554332caa7ee354f1557730e23c8253381f230ab7e9d33697057f19ecd6ab7
Size 6.7MB
Sample260725-mw431awbme
SHA256 25554332caa7ee354f1557730e23c8253381f230ab7e9d33697057f19ecd6ab7
MD5 0f96bfcc387751eda8b352386e528a67
SHA1 f343983548ceea3edee558afc9c5ae904f881259
SHA512 30c72a483825b362edce3835bc7ebc5f09243edd62f97f229e6f2ff29e73f2360d0952dc885d131b90eb49ed99ddea299793623f99d177a7135d529235606d39
SSDEEP 98304:5kaWsAYtVm8xoZV/Cypkj2JY7kXeYfmFao4PWjJ8MjY0:5kaWsAYbZawypka4lYbMJ8MjY0
TLSH
T19B66AE10F6C3D0A6C596097011EE76BA56343F190F2497E3F790BF6AB871BD1983229E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25554332caa7ee354f1557730e23c8253381f230ab7e9d33697057f19ecd6ab7

File Explorer

25554332caa7ee354f1557730e23c8253381f230ab7e9d33697057f19ecd6ab7

.exe 6.7MB

25554332caa7ee354f1557730e23c8253381f230ab7e9d33697057f19ecd6ab7

IMPHASH 8de570c6f6a58a1f8da36bc81f19bf75
SHA256 25554332caa7ee354f1557730e23c8253381f230ab7e9d33697057f19ecd6ab7
MD5 0f96bfcc387751eda8b352386e528a67
SHA1 f343983548ceea3edee558afc9c5ae904f881259
SHA512 30c72a483825b362edce3835bc7ebc5f09243edd62f97f229e6f2ff29e73f2360d0952dc885d131b90eb49ed99ddea299793623f99d177a7135d529235606d39
SSDEEP 98304:5kaWsAYtVm8xoZV/Cypkj2JY7kXeYfmFao4PWjJ8MjY0:5kaWsAYbZawypka4lYbMJ8MjY0
TLSH
T19B66AE10F6C3D0A6C596097011EE76BA56343F190F2497E3F790BF6AB871BD1983229E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12746752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\（◆開発用ディレクトリ）\[▼作業用]プログラム\RPGドライブプログラム＋◆Editor - 20180525_ver2.24版_SteamKit版込\Rpgドライブプログラム\Release\Game2.25.pdb

shlwapi

PathFileExistsA PathIsDirectoryA

psapi

GetProcessMemoryInfo

kernel32

GetProcAddress LoadLibraryW GetModuleFileNameW GetVersionExA InterlockedExchange GetACP GetLocaleInfoA GetTickCount CreateDirectoryA SetCurrentDirectoryA FindClose FindNextFileA FindFirstFileA GetCurrentDirectoryA GetModuleFileNameA lstrcpyA GlobalAlloc GlobalUnlock GlobalLock DeleteFileA CopyFileA RemoveDirectoryA CloseHandle Sleep GetExitCodeThread GlobalMemoryStatusEx OpenProcess GetCurrentProcessId GetDiskFreeSpaceExA lstrlenA CreateFileA GetLastError FreeLibrary FlushFileBuffers InitializeCriticalSection DeleteCriticalSection RaiseException GetFileAttributesA SetUnhandledExceptionFilter InterlockedDecrement InterlockedIncrement SetEnvironmentVariableA CompareStringW CompareStringA GetLocaleInfoW SetEndOfFile GetSystemInfo VirtualProtect SetStdHandle IsBadCodePtr IsBadReadPtr GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA VirtualQuery UnhandledExceptionFilter GetTimeZoneInformation LCMapStringW WideCharToMultiByte LCMapStringA GetOEMCP GetCPInfo WriteFile IsBadWritePtr VirtualAlloc GetProcessHeap GetStringTypeW GetStringTypeA IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID RtlUnwind ExitProcess GetSystemTimeAsFileTime HeapFree HeapAlloc GetModuleHandleA TerminateProcess GetCurrentProcess MoveFileA MultiByteToWideChar LoadLibraryA DebugBreak ExitThread GetCurrentThreadId CreateThread GetStartupInfoA GetCommandLineA TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection ReadFile SetHandleCount GetStdHandle GetFileType SetFilePointer HeapReAlloc HeapSize HeapDestroy HeapCreate VirtualFree

user32

SendMessageA MessageBoxA ShowWindow SetWindowPos GetWindowRect CreateDialogParamA SendDlgItemMessageA GetDC ReleaseDC GetCursorPos MonitorFromPoint EnumDisplayMonitors GetMonitorInfoA ClientToScreen ClipCursor GetSystemMetrics GetScrollPos GetAsyncKeyState IsClipboardFormatAvailable GetClipboardData OpenClipboard EmptyClipboard SetClipboardData CloseClipboard DestroyWindow GetDlgItem SetFocus

gdi32

RemoveFontResourceExA AddFontResourceExA GetDeviceCaps

shell32

ShellExecuteA

wininet

InternetReadFile HttpQueryInfoA InternetOpenUrlA InternetCloseHandle InternetOpenA

winmm

timeGetTime

advapi32

RegCloseKey

generic

count=65, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=131, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=57, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=8, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=79, id=110, productName=VS2005 build 50727, version=50727,

count=2, id=105, version=2067,

count=32, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=58, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=187, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=93, version=2067,

count=12, id=93, version=2179,

count=5, id=25, version=9210,

count=161, id=1, productName=Unmarked objects,

count=2, id=97, version=3077,

count=3, id=98, version=3077,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,