MapHackDesu3.rar
- SHA256 7950c810cd998c3980f98a14fc9f512e062284ba4fa71f4dce44fb5bc1ba8ade
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
MapHack Desu3/MapHackDLon.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
MapHack Desu3/MapHackDLon.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
MapHack Desu3/uninstall.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target MapHackDesu3.rar
- Size 485KB
- Sample260731-ph549aad77
- SHA256 7950c810cd998c3980f98a14fc9f512e062284ba4fa71f4dce44fb5bc1ba8ade
- MD5 c0c3b4f0257f339530075baf056c436f
- SHA1 75b751f9021a024b206cb7a012de3bc041bc3374
- SHA512 483874e09a7af1605070d7ed68ffbbae36b408ed3b37712d8a3d86a8e5d132c384f785b98a25e591db515a113f7869f63c62ea32dad6e66402a3155d1c40b3f2
- SSDEEP 12288:DsmWHz1aDTzwz4crmwbPOUbY4oiUo7Z4ERqnAHK:QmWT1akzNrmwKUNmsOTWK
- TLSH T1D5B423FE532F8083A63DBF11563EA6AB95C841CA288C1B5B75DDD01D548F1B7A36E032
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/MapHack Desu3/uninstall.exe Nirsoft - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/MapHack Desu3/MapHackDLon.exe autoit_exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/MapHack Desu3/MapHackDLon.exe unpack001/MapHack Desu3/uninstall.exe
File Explorer
-
MapHackDesu3.rar.rar 485KB
-
MapHack Desu3/MapHackDLon.exe.exe 713KB
-
MapHack Desu3/uninstall.exe.exe 229KB
MapHack Desu3/MapHackDLon.exe
- SHA256 7b7870040b46909121d61c2787b32aeee66251d46ca999a858b78c7617efa44d
- MD5 d23fb4526b26ad38290a5221d29f7b62
- SHA1 fb0cc50d97e1ca185be15a215f3f2610e5bed354
- SHA512 e23c6703ea7e9fc1bcc44dba3f4db3755ccbb842a48d421b2aa60867913ea907d628b292e14571d5e7106f5e08b128343a42b69453b4f0ac81d59033716ebec3
- SSDEEP 12288:9hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcbNMQ4PNlX41:LRmJkcoQricOIQxiZY1WNMQ4jX41
- TLSH T19DF4A021B5C69036C2B323B19E7EF76A9A3D79360336D19737C82D315EA05816B29733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
514KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
37KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
MapHack Desu3/uninstall.exe
- IMPHASH 39eecaf4fef95b14142fd807de9962fd
- SHA256 4c61edd1aa6e941d0b5b144a7fffddf39732f8797c7ffa82dd88a924e1eb6e58
- MD5 1244be3e3fcd6cd8da85f899165d72a3
- SHA1 7e91bc24a60b10e9d6ada75abbdbaef07c3a5bc8
- SHA512 4e889aafced810f07ec2410d507e65fbe9ccc6b6697da99ea019dfee2d37dfd2cca2c060c629a26d3bddceb95a618e1d866ccdf562b62e9fc72ba61c5d5ea05b
- SSDEEP 6144:UfkIfjOzixt5AB57JobKnHE4J/HS9EvkP:Uf9jIixxs/HJvkP
- TLSH T1E834BE2373D1CC3FD4AB05B05EAB3B696DF5BA101631C45716E82D89AE70192EA3E317
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
176048
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\Projects\VS2005\ChromePass\Release\ChromePass.pdb
msvcrt
realloc
_ftol
isalnum
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
__wgetmainargs
strcmp
tolower
toupper
_gmtime64
_purecall
_wcslwr
_itow
malloc
wcschr
free
modf
isspace
atoi
strftime
isdigit
isxdigit
wcstoul
_memicmp
wcsrchr
??2@YAPAXI@Z
??3@YAXPAX@Z
memcmp
strlen
abs
_wcsicmp
wcscmp
wcslen
log
memcpy
wcscpy
memset
wcscat
_snwprintf
wcsncat
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
comctl32
ord17
ImageList_ReplaceIcon
ImageList_Create
ImageList_SetImageCount
ImageList_AddMasked
CreateStatusWindowW
CreateToolbarEx
kernel32
InitializeCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
LockFileEx
GetTickCount
LockFile
UnlockFile
DeleteFileA
AreFileApisANSI
QueryPerformanceCounter
GetSystemTime
FlushFileBuffers
GetTempPathA
InterlockedIncrement
SetEndOfFile
GetFileAttributesA
LeaveCriticalSection
GetCurrentThreadId
GetFullPathNameW
Sleep
CreateFileA
DeleteCriticalSection
GetModuleHandleA
GetStartupInfoW
GetFullPathNameA
CloseHandle
FileTimeToLocalFileTime
DeleteFileW
LocalFree
SystemTimeToFileTime
CopyFileW
CreateFileW
WriteFile
WideCharToMultiByte
CompareFileTime
FreeLibrary
LoadLibraryW
GetProcAddress
GetLastError
LocalAlloc
GetFileSize
FileTimeToSystemTime
GetWindowsDirectoryW
GetDateFormatW
GetTimeFormatW
GetTempFileNameW
GetFileAttributesW
GetModuleHandleW
FindFirstFileW
ReadFile
LockResource
SetFilePointer
GetModuleFileNameW
MultiByteToWideChar
GlobalAlloc
GlobalUnlock
FindResourceW
GetTempPathW
LoadResource
LoadLibraryExW
FindNextFileW
SizeofResource
FormatMessageW
FindClose
GlobalLock
GetVersionExW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetPrivateProfileStringW
SetErrorMode
GetCurrentProcess
ReadProcessMemory
GetCurrentProcessId
ExitProcess
OpenProcess
EnumResourceTypesW
user32
TranslateMessage
IsDialogMessageW
GetMessageW
PostQuitMessage
BeginDeferWindowPos
TrackPopupMenu
RegisterWindowMessageW
EndDeferWindowPos
DispatchMessageW
SetCursor
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
SendDlgItemMessageW
EndDialog
GetDlgItem
InvalidateRect
SetDlgItemInt
SetWindowTextW
GetClientRect
UpdateWindow
SetDlgItemTextW
GetDlgItemTextW
GetSystemMetrics
DeferWindowPos
CreateWindowExW
GetWindowRect
GetDlgItemInt
SetMenu
SetWindowPos
GetWindowPlacement
LoadAcceleratorsW
PostMessageW
DefWindowProcW
SendMessageW
TranslateAcceleratorW
RegisterClassW
MessageBoxW
LoadImageW
LoadIconW
SetWindowLongW
GetWindowLongW
SetFocus
MoveWindow
GetMenuItemCount
GetParent
CheckMenuItem
GetCursorPos
GetSysColor
GetMenu
GetSubMenu
SetClipboardData
EnableWindow
MapWindowPoints
GetDC
EmptyClipboard
EnableMenuItem
ReleaseDC
GetClassNameW
OpenClipboard
GetMenuStringW
CloseClipboard
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
DialogBoxParamW
GetDlgCtrlID
DestroyMenu
CreateDialogParamW
DestroyWindow
EnumChildWindows
LoadStringW
GetWindowTextW
DrawTextExW
gdi32
SetBkColor
SelectObject
GetDeviceCaps
SetTextColor
CreateFontIndirectW
SetBkMode
DeleteObject
GetTextExtentPoint32W
GetStockObject
comdlg32
FindTextW
GetSaveFileNameW
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
CryptCreateHash
CryptReleaseContext
CryptDeriveKey
CryptAcquireContextW
CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptDecrypt
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
ShellExecuteW
ole32
CoUninitialize
CoInitialize
Name
.text
Size
170KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=64, version=9210,
count=11, id=28, version=9178,
count=300, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=27, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,