2ebd64bb21cd217dcfb95a0eca6b805a7f88339872feca95c5080f1f4577e3f8

Sharing

Copy URL Twitter E-mail

General

Target
2ebd64bb21cd217dcfb95a0eca6b805a7f88339872feca95c5080f1f4577e3f8
Size 798KB
Sample260731-mtaflsgh72
SHA256 2ebd64bb21cd217dcfb95a0eca6b805a7f88339872feca95c5080f1f4577e3f8
MD5 440ea5caf8015317f7ee7fa9f105bb9c
SHA1 968a5975347074a45422c211aac10031fa3a61b1
SHA512 838d285870ea8eac5e869a8aca3bda1a9084609fe58965847f8b25014d8ed80c1ab8a9a21aa6da35ed172e6f67fb989963eb95cc8715305742623391044fbdf0
SSDEEP 24576:JYugd9XxZBEjLUlh8pWqn3JTQ+4uvKuXHFOm5:qXZBqxIu1Oq
TLSH
T1FC059E61BE41C0B3E26101759475EBF60C396D3887209ACBE3D07F75AA302D1AE3B65E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ebd64bb21cd217dcfb95a0eca6b805a7f88339872feca95c5080f1f4577e3f8

File Explorer

2ebd64bb21cd217dcfb95a0eca6b805a7f88339872feca95c5080f1f4577e3f8

.exe 798KB

2ebd64bb21cd217dcfb95a0eca6b805a7f88339872feca95c5080f1f4577e3f8

IMPHASH a18138d1541c2a4b30ab25102332298a
SHA256 2ebd64bb21cd217dcfb95a0eca6b805a7f88339872feca95c5080f1f4577e3f8
MD5 440ea5caf8015317f7ee7fa9f105bb9c
SHA1 968a5975347074a45422c211aac10031fa3a61b1
SHA512 838d285870ea8eac5e869a8aca3bda1a9084609fe58965847f8b25014d8ed80c1ab8a9a21aa6da35ed172e6f67fb989963eb95cc8715305742623391044fbdf0
SSDEEP 24576:JYugd9XxZBEjLUlh8pWqn3JTQ+4uvKuXHFOm5:qXZBqxIu1Oq
TLSH
T1FC059E61BE41C0B3E26101759475EBF60C396D3887209ACBE3D07F75AA302D1AE3B65E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

819200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\Users\Source\Desktop\WrathOfEternal\WrathOfEternal\SourceCodeVS2019\_bin\AllRelease\launcher.pdb

shlwapi

PathFileExistsA

ws2_32

freeaddrinfo getaddrinfo __WSAFDIsSet ioctlsocket ntohl WSAIoctl WSASetLastError setsockopt getsockopt WSACleanup ntohs inet_ntoa htonl accept bind closesocket gethostbyname select listen getpeername getsockname gethostbyaddr send socket connect recvfrom recv htons sendto WSAGetLastError WSAStartup gethostname

advapi32

CryptAcquireContextA CryptGenRandom CryptEncrypt CryptImportKey CryptDestroyKey CryptCreateHash CryptHashData CryptDestroyHash CryptReleaseContext CryptGetHashParam

crypt32

CertFindExtension CertAddCertificateContextToStore CryptQueryObject PFXImportCertStore CertCreateCertificateChainEngine CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertGetNameStringA CryptDecodeObjectEx CryptStringToBinaryA

wldap32

ord217 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord143 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord27

normaliz

IdnToAscii

kernel32

CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileAttributesExW GetCurrentDirectoryW GetFullPathNameW SetStdHandle FlushFileBuffers GetConsoleOutputCP ReadConsoleW GetConsoleMode GetModuleFileNameW ExitProcess SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW CreateFileW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetSystemTimeAsFileTime GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineW GetEnvironmentStringsW GetCurrentProcessId FreeEnvironmentStringsW SetEnvironmentVariableW DeleteFileW SetEndOfFile FormatMessageA GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter SizeofResource HeapFree SetLastError EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection OpenFile lstrlenA GetCurrentThreadId lstrcatA HeapSize Sleep GetLastError CreateFileA LockResource DeleteFileA lstrcpyA HeapReAlloc CloseHandle RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy GetFileSize DeleteCriticalSection GetProcessHeap WideCharToMultiByte CreateDirectoryA GetModuleFileNameA FindFirstFileA TerminateProcess FindNextFileA FindClose CreateMutexA lstrcmpA OpenProcess SetCurrentDirectoryA GetCommandLineA MultiByteToWideChar LoadLibraryA GetVersionExA SetFileAttributesA GetProcAddress RemoveDirectoryA FreeLibrary LocalFree WriteConsoleW ReadFile WriteFile SetFileTime SetFilePointer GetCurrentDirectoryA LocalFileTimeToFileTime GetFileAttributesA SystemTimeToFileTime OutputDebugStringA GetEnvironmentVariableA InitializeCriticalSectionEx SleepEx VerSetConditionMask QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA VerifyVersionInfoA QueryPerformanceCounter GetTickCount MoveFileExA WaitForSingleObjectEx GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects GetFileSizeEx GetModuleHandleW CreateEventW ResetEvent SetEvent GetCPInfo GetStringTypeW LCMapStringEx OutputDebugStringW IsDebuggerPresent LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer

user32

UnregisterClassA SendMessageA GetWindow GetWindowRect SetWindowPos MonitorFromWindow MapWindowPoints GetWindowLongA SetWindowTextA GetMonitorInfoA GetClientRect GetDlgItem GetParent EndDialog DialogBoxParamA wsprintfA GetActiveWindow MessageBoxA SetWindowLongA

shell32

ShellExecuteExA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

winmm

timeGetTime

Name

.text

Size

563KB

Virtual Size

563KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

o�ǣu�

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2ebd64bb21cd217dcfb95a0eca6b805a7f88339872feca95c5080f1f4577e3f8

shlwapi

ws2_32

advapi32

crypt32

wldap32

normaliz

kernel32

user32

shell32

version

winmm

generic