build.7z
- SHA256 aa2435a5b4106bdbc01bbb4caed129c9bac52bc00463c1e27c250ee53324272b
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Console32.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Console32.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
oc32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
oc32.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target build.7z
- Size 2.4MB
- Sample260730-2grxfs1yev
- SHA256 aa2435a5b4106bdbc01bbb4caed129c9bac52bc00463c1e27c250ee53324272b
- MD5 eed591fe3f92d362a7a69d4ce354f8cd
- SHA1 858f807ea976e7bc2ecc65fadf9b7d67f214b1a8
- SHA512 8d0a0c013d1d9c3e8601a2b0c7d2d6b3bdacc843ea4abe555a695f12c0ebc7b8d25dedb304c2a5d9177f675c505c4907676e6b47a70c7e0192baf4e036023105
- SSDEEP 49152:A0p4rL0Y3sg2pqijcZFIFoI6pSnxMmVKLhlK55tvE7IvL:pSrLZ3s9pqijcZOFx6pSnbGhIPtvm0L
- TLSH T123C533739FCB0940F7417E66CE26204760785A391E28FCD48783FB04D66B6269E527EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Console32.exe unpack001/oc32.dll
File Explorer
-
build.7z.7z 2.4MB
-
Console32.exe.exe 1.1MB
-
Console32.pdb12.0MB
-
oc32.dll.dll 681KB
-
oc32.pdb7.0MB
Console32.exe
- IMPHASH c84f1367da95cdd898b7aa07ce2aa5d2
- SHA256 7f7c877971b4f7684bb780079377743c8a675008c847e62fb7f1038b23969c39
- MD5 8496fd94c9058892a9fa3e980134e416
- SHA1 6dc959f83377673d18e4cf3917f09c2101340cea
- SHA512 d36e47914bc95ccfb0d824ca27f19b17b6332771033887dd0b29610f006d795f821f2e024e2808817998287827d666bd779034dc8c16e239ba0f1c3cc437e630
- SSDEEP 24576:K0jdtUywVgHg+ui2DP+KL5IjVw5iH2wh4:lC+ui2D95IjVw4H2wh4
- TLSH T1EF454925BA81C033C821247609BEEBAD377DE4500F6657CBB79877BE1E255C01E3826E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
209904
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Ren\Documents\GitHub\OreansCrack\build\Console32.pdb
ntdll
RtlUnwind
NtFlushInstructionCache
RtlPcToFileHeader
NtRemoveProcessDebug
NtResumeProcess
NtSetInformationProcess
NtQueryInformationProcess
kernel32
CloseHandle
GetLastError
WaitForSingleObject
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateThread
CreateRemoteThread
TerminateThread
SuspendThread
ResumeThread
CreateProcessW
GetThreadId
GetThreadContext
SetThreadContext
FlushInstructionCache
OpenProcess
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
CreateFileMappingW
MapViewOfFile
VirtualFreeEx
UnmapViewOfFile
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
K32EnumProcessModules
K32GetModuleFileNameExW
K32GetMappedFileNameW
K32GetProcessImageFileNameW
ReadFile
WriteFile
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
ConnectNamedPipe
CreateNamedPipeW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForDebugEvent
OpenMutexW
CreateEventW
OpenEventW
OpenSemaphoreW
CreateSemaphoreW
GetCurrentProcessId
GetCurrentThreadId
OpenThread
GetExitCodeThread
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
OpenFileMappingW
GetLargePageMinimum
GetModuleHandleA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertThreadToFiber
PulseEvent
InitializeContext2
GetEnabledXStateFeatures
GetXStateFeaturesMask
LocateXStateFeature
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetStdHandle
HeapAlloc
HeapFree
WriteConsoleW
AllocConsole
FreeConsole
GetConsoleMode
SetConsoleMode
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfoEx
SetConsoleScreenBufferInfoEx
SetConsoleCursorPosition
SetConsoleTextAttribute
ScrollConsoleScreenBufferW
GetConsoleWindow
OutputDebugStringW
SetConsoleCtrlHandler
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindNextFileW
FindFirstFileExW
ContinueDebugEvent
QueryDosDeviceW
GetLogicalDriveStringsW
GetFileSizeEx
GetFileAttributesW
CreateFileW
SearchPathW
GetCommandLineW
FlushFileBuffers
GetConsoleOutputCP
SetFilePointerEx
HeapSize
HeapReAlloc
SetEndOfFile
CreateMutexW
GetProcessHeap
FindClose
ReadConsoleW
PeekConsoleInputA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
DuplicateHandle
SetStdHandle
GetFileType
GetConsoleCP
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCurrentThread
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsThreadAFiber
InitializeCriticalSectionEx
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
DecodePointer
GetCPInfo
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetNumberOfConsoleInputEvents
ReadConsoleInputW
user32
ShowWindow
SetWindowLongW
GetWindowLongW
SetWindowPos
DestroyWindow
advapi32
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
shell32
ShellExecuteExW
Name
.text
Size
597KB
Virtual Size
596KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
524KB
Virtual Size
524KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.load
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33140,
count=166, id=261, version=33140,
count=19, id=260, version=33140,
count=24, id=259, version=35207,
count=20, id=260, version=35207,
count=43, id=261, version=35207,
count=11, id=257, version=33140,
count=210, id=1, productName=Unmarked objects,
count=3, id=261, version=35217,
count=1, id=255, version=35217,
count=1, id=258, version=35217,
Console32.pdb
- SHA256 53dacc3e1fdb2bee2a6b51afe0d352e2f7f5b6d17f7e5efa4c406871671bd80d
- MD5 b133522dbd619c7f0f1ff2f54eb68723
- SHA1 5d3cd42cb8e88cf40c99a302a2b897d271646115
- SHA512 c0ff86ceaad21f595241b8d6149b8b8eca7e489033e6a4d1fbf8fa9adaa2688c58d2b775d0f8bc439541fdc2323590d1e506a047bcb5a6b54ae4b4e1bbad1f2b
- SSDEEP 49152:RMmTo8B6K1NoHzIws32aeGmMxLZmseumyxJJsxkJQmp+H1CNDzV7PoAoiAYARSys:loYNo20UcxCiaonnHPi17
- TLSH T13EC67E11FA0D8DA2D48B0775B29F4F1C71E0A546ABAF3A5B400ED23C2DC934DAF6B651
- MD5 SHA1 SHA512 SSDEEP TLSH
oc32.dll
- IMPHASH 8756a17b0abdd621860f3f1f9561ef46
- SHA256 b41f51d7b8fd23fc2549dc587228b7d78dbf8f85ae66d744c6546aee801dcfa0
- MD5 1ddd1f8bc6bdccc121499d5fa43a0427
- SHA1 28997a9a5d6dc7f5f7250909b4ec996dd370e519
- SHA512 ccb0bd50bb712029312fd1a7a49144ba7ff0b8327f93095d3340f4a392a6fd04fe326d516ac4efbfe130bb354854d1d3dfdbb2702e57c290eec6f3746c00cbe0
- SSDEEP 12288:pS+G2WqAXKk/eSSSSSSSF9w5Ij7Opzzxpk:pS+LWqCKk/s5IjenD
- TLSH T1E3E4E618BB40C16FD82C657708AABBBD337DA844AE6187DB7369B37F1C251C81D185AC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
63121
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ren\Documents\GitHub\OreansCrack\build\oc32.pdb
kernel32
CreateFileW
ReadFile
WriteFile
CloseHandle
GetLastError
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
VirtualQueryEx
GetLargePageMinimum
GetModuleHandleW
GetProcAddress
InitializeContext2
GetEnabledXStateFeatures
GetXStateFeaturesMask
LocateXStateFeature
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetThreadId
GetStdHandle
HeapAlloc
HeapFree
GetProcessHeap
GetConsoleMode
HeapReAlloc
HeapSize
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
InterlockedFlushSList
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
SetStdHandle
GetFileType
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
DecodePointer
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetTimeZoneInformation
GetCPInfo
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
Name
.text
Size
146KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
493KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33140,
count=175, id=261, version=33140,
count=19, id=260, version=33140,
count=24, id=259, version=35207,
count=16, id=260, version=35207,
count=37, id=261, version=35207,
count=5, id=257, version=33140,
count=169, id=1, productName=Unmarked objects,
count=5, id=261, version=35217,
count=1, id=258, version=35217,
oc32.pdb
- SHA256 0a98c5aeb02521a36726f2466d5e693c283a0177d42b2598d8dbf5018fdc8651
- MD5 9720410cbf781f4815f89a30098ca50c
- SHA1 7518f2b7de8f96d81e2d3d9f82551db01178c7ac
- SHA512 a13881e1d9689d130d031c3eb502ca717191756a0bf98d1ebeb20e0e2f26dfdbe30eb4445e0df42661073593f36b016b503c1931ea521531ee3f5fb52558bb63
- SSDEEP 49152:xT+L2vWteomgxwZNebmWxMJH1RNESgKaiS0EjzehmF76Z+ssgQY3hX/6e3e6SeWV:cSQu/3MV7Yxh9BPpnHvKhqao8CjT
- TLSH T1C5766C15FE199EDBE18B8974821F971D7320F74A5F6B36AB810161391CEC30A6EDE231
- MD5 SHA1 SHA512 SSDEEP TLSH