HD-resolution-patch-v3.zip
- SHA256 10648cfa4f5ad34c59fe4a2687ad689f99ea6be6cfd70eee7d690ed6ff981df0
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AugurMS.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
AugurMS.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
dinput8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
dinput8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target HD-resolution-patch-v3.zip
- Size 6.7MB
- Sample260728-w3vycaer2x
- SHA256 10648cfa4f5ad34c59fe4a2687ad689f99ea6be6cfd70eee7d690ed6ff981df0
- MD5 5f1f940e064213b200b151c868d8a199
- SHA1 ad27b1acf52613e5396a1a43cfa0bf5c5bc3e136
- SHA512 a9bf23690b10f0cac578790fd4b34b275640094c64f743469313b5df6b91fe7ded4155084d0ad883ddc0191bc2b78f8c6c4011d79caf42e08ee76e75cf92aa6b
- SSDEEP 196608:p6oXQbGSWVjBmbgBYUl8kksPo+bBdknu60j9T:3yGSW7mkBivsPd4u60j9
- TLSH T166663300CEAAA0AFC7556FF125F4CD2360369B6E1D178A660CE4EB7235730B624B7D06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/AugurMS.exe unpack001/dinput8.dll
File Explorer
-
HD-resolution-patch-v3.zip.zip 6.7MB
-
AugurMS.exe.exe 9.5MB
-
config-1280x720.ini334B
-
config-1366x768.ini334B
-
config.ini334B
-
dinput8.dll.dll 2.7MB
AugurMS.exe
- SHA256 d4be83197bad0ff5f7a6b84bbb80ea006e6350e644f0b2ee1966ef5a81f925dc
- MD5 c93ff0490ad3b3b6547cfe1738bc0fee
- SHA1 6303273ecb7e448af16dc8f757a7610046725458
- SHA512 b3807e7da8e4b3005c20181be54e061d1eefbf0c22f6afb10a3ccc68c0cf6d8bb11b7ba123c6c7585afbe2cc3875419611488b05e22816c79b4ed4d94b20f0b1
- SSDEEP 98304:vMeDRBamHwHrDtBLSdOstjwa2geBz/R6yLgNDmkRNSoQBrkqWews7MFGO:+mQHr8ea2ZV6eEBR3QB4qWen7TO
- TLSH T16EA6D65C2590964FEF2ED333D38B394091E6B2E5993097628BF9E6C869FECC41285C1D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6701043
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
8.0MB
Virtual Size
8.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
125KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
1.3MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mackt
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=93, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=1, id=29, version=9178,
count=5, id=12, version=7291,
count=45, id=14, version=7299,
count=161, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=11, version=8798,
count=1, id=11, version=8047,
count=1, id=10, version=8966,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=11, id=11, version=8966,
count=6, id=28, version=9178,
count=2, id=37, version=8755,
count=27, id=25, version=9210,
count=234, id=1, productName=Unmarked objects,
count=280, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=7, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
config-1280x720.ini
- SHA256 fb2a48ef75bfcc569c90d622af591b9927b599da97c06ca11c0cf491bc7780e4
- MD5 7087e73fed62fcb9357cea05142410e0
- SHA1 0d6d1e463e600caf2bb0871f78ccd1baef9a6bd7
- SHA512 c97dd5558622ae17c4497f51d12c208361648993073eed03cd6a2d1b192e8a5db0f46c75a82de16391e5adaed02860253ea6439be65eb7d1b4e2044b31cb9cec
- TLSH T1B4E026E32238083DB75A5861242F424D4522A820EF89626DCB851A1FF6D989E6C21979
- MD5 SHA1 SHA512 TLSH
config-1366x768.ini
- SHA256 22af6d50a60b2cfa8d8966e9f87836a96edf569e34733b61cb23c7e0cf9de66b
- MD5 27346f8014dbf6719b9f67c3ad13a1eb
- SHA1 d36c52561dfa940ad1eae4d8e7cfad866e73ec9f
- SHA512 9dc071b478fafb335a4fe057f684d4023b25780c9866bf1aa2be43977f0e761e4e9b6bbeed233523e18bf819c077260dacb9632eae28cc1bb7ac344af17f57e1
- TLSH T165E078E32234043D75595470141F414D4511E434EFC9526DCF49155FF7DE4CE5C11975
- MD5 SHA1 SHA512 TLSH
config.ini
- SHA256 2880fc73f678104f54378d45c193636a5fb04997681e3425aac21ed5b4acc84c
- MD5 8da95dfb0f621ea53760162a7bc0ea19
- SHA1 33befc39abcf988342bec54eda466fd97c8480df
- SHA512 c0bba5b1f38eaac731b4baa97a4a337be84ce4c59d085281205f0b52ca7e38b296c83174622949484a1fb6c032d5cb75e99e560708c124d2ffea32b780214761
- TLSH T1B3E028E31234043D754A1430142F414D4511E430EFC5025DCF45181FF7DD4CF5C10434
- MD5 SHA1 SHA512 TLSH
dinput8.dll
- IMPHASH cb5314b9c618bf5a68c414af7c8234d6
- SHA256 1c0835181b529cfd7cea720688b294e6ae0cce83d72ebacbda003aeb7262a61a
- MD5 c4b8251dd950f70e2ea1a32ad3b76e03
- SHA1 28cc7ce4102f8651d43445639558a4069c4436dd
- SHA512 4579092ba0e4fc737c3f1a890b8a06c3dd1bf13b1a97371542f0970ef361e11f6743942fb0317b5d523e0c1009fae36c493e38d870ead03e315d231f00e47d0f
- SSDEEP 49152:2kfLY8q8ai9MF+aLVu5VqFeYgEEFb3kfLY8q8ai9MF+aLVu5VqFeYgEEFb3Fe:2kjY8qw9MF+WVuWcYgEUYjY8qw9MF+WE
- TLSH T15CD51208D1E1D554FCD7107E0AA42B93D323A0BBC65209CBB661A58C9C67CF98B758BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
71412
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
winmm
timeGetTime
ws2_32
WSAGetLastError
socket
connect
WSAAsyncSelect
WSAAddressToStringA
inet_addr
kernel32
FindFirstFileW
FindClose
CreateFileW
GetLocaleInfoEx
InitializeSListHead
GetSystemDirectoryA
Sleep
SuspendThread
ExitProcess
LoadLibraryA
GetProcAddress
CreateFileA
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
LockResource
WriteFile
CloseHandle
ResumeThread
GetProcessHeap
HeapAlloc
HeapFree
GetModuleFileNameW
GetCurrentProcessId
GetModuleFileNameA
CreateProcessA
GetCurrentThreadId
GetVersionExA
GetModuleHandleA
GetCurrentProcess
OpenThread
DisableThreadLibraryCalls
CreateThread
GetCurrentThread
VirtualProtect
GetLastError
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualFree
VirtualQuery
SetLastError
WakeAllConditionVariable
FormatMessageA
LocalFree
GetFileAttributesExW
SleepConditionVariableSRW
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
ReleaseSRWLockExclusive
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
MultiByteToWideChar
GetFileInformationByHandleEx
AreFileApisANSI
AcquireSRWLockExclusive
user32
SetFocus
SetForegroundWindow
MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
PostQuitMessage
MessageBoxW
TranslateMessage
oleaut32
GetErrorInfo
VariantInit
msvcp140
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?good@ios_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
_Mtx_unlock
_Mtx_lock
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Throw_Cpp_error@std@@YAXH@Z
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
vcruntime140
memmove
__CxxFrameHandler3
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
strchr
memcpy
memset
_except_handler4_common
__std_type_info_destroy_list
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
terminate
_seh_filter_dll
_configure_narrow_argv
_cexit
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_initterm
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_initterm_e
api-ms-win-crt-string-l1-1-0
tolower
strncpy_s
isspace
api-ms-win-crt-stdio-l1-1-0
fclose
fgets
__stdio_common_vsprintf_s
fopen_s
api-ms-win-crt-convert-l1-1-0
strtol
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
floor
DirectInput8Create
GetdfDIJoystick
Name
.text
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=32533,
count=4, id=259, version=32533,
count=21, id=261, version=32533,
count=4, id=257, version=32533,
count=3, id=261, productName=VS2019 v16.0.0 build 27508, version=27508,
count=11, id=257, version=30795,
count=191, id=1, productName=Unmarked objects,
count=7, id=265, version=32822,
count=1, id=256, version=32822,
count=1, id=255, version=32822,
count=1, id=151,
count=1, id=258, version=32822,