5b234744c285a2b38817c5b3709785d83f5d863d8d9b83e1e9662512756d72f7

Sharing

Copy URL Twitter E-mail

General

Target
5b234744c285a2b38817c5b3709785d83f5d863d8d9b83e1e9662512756d72f7
Size 1.5MB
Sample260731-xy537afd86
SHA256 5b234744c285a2b38817c5b3709785d83f5d863d8d9b83e1e9662512756d72f7
MD5 bcaeddc3094b65bfef782eb5f396695d
SHA1 6345368475bd08f061771a0936159ee35bf5b5a3
SHA512 b9093d0716b09f6822951f37bce070e64d747850b72b3dad1a83709a23357fcbda97f3092b2bb44dbb2c6f0ae80492297390299b44382064db693c18d5fbf74a
SSDEEP 24576:Zo1wGWbVAq7n/arIaz+u2ZCl0umdkWQ965q1LHQ0o3qLDt6hdV7co:mMVfnyrIsWC/99uqZCUDtG
TLSH
T1F6757C9365E2EBE9C21FC8BE8552B91FA6E37C7D031661D34268E26D6F77E443220704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b234744c285a2b38817c5b3709785d83f5d863d8d9b83e1e9662512756d72f7

File Explorer

5b234744c285a2b38817c5b3709785d83f5d863d8d9b83e1e9662512756d72f7

.dll 1.5MB

5b234744c285a2b38817c5b3709785d83f5d863d8d9b83e1e9662512756d72f7

IMPHASH e7fba7f63e10f895f135e209ff9008f5
SHA256 5b234744c285a2b38817c5b3709785d83f5d863d8d9b83e1e9662512756d72f7
MD5 bcaeddc3094b65bfef782eb5f396695d
SHA1 6345368475bd08f061771a0936159ee35bf5b5a3
SHA512 b9093d0716b09f6822951f37bce070e64d747850b72b3dad1a83709a23357fcbda97f3092b2bb44dbb2c6f0ae80492297390299b44382064db693c18d5fbf74a
SSDEEP 24576:Zo1wGWbVAq7n/arIaz+u2ZCl0umdkWQ965q1LHQ0o3qLDt6hdV7co:mMVfnyrIsWC/99uqZCUDtG
TLSH
T1F6757C9365E2EBE9C21FC8BE8552B91FA6E37C7D031661D34268E26D6F77E443220704
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

397616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Delta Force\x64\Release\Delta Force.pdb

kernel32

VirtualProtect EnterCriticalSection GetCurrentProcess TerminateProcess LeaveCriticalSection InitializeCriticalSection WaitForSingleObject GetCurrentThreadId GetModuleHandleA CreateEventW GetTickCount64 CreateFileA SetEvent CloseHandle CreateThread ResetEvent GetProcAddress DeleteCriticalSection WideCharToMultiByte CreateEventA OpenThread OpenEventA GetVolumeInformationA GetLastError HeapAlloc HeapReAlloc HeapFree GetProcessHeap GetSystemTimeAsFileTime lstrcpynA lstrlenA lstrlenW MultiByteToWideChar GetFileAttributesA AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead LoadLibraryA ReadFile ReleaseSRWLockExclusive

user32

MessageBoxA MessageBoxW wsprintfA GetWindowThreadProcessId mouse_event IsIconic GetCursorPos GetAsyncKeyState GetForegroundWindow ScreenToClient

msvcp140

??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ

d3dcompiler_47

D3DCompile

winhttp

WinHttpReceiveResponse WinHttpQueryHeaders WinHttpOpenRequest WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSendRequest

shlwapi

StrStrIA StrChrA

imagehlp

ImageDirectoryEntryToData

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr memset memcpy __std_type_info_destroy_list __C_specific_handler __std_exception_destroy memmove memcmp __std_terminate strstr wcsrchr _CxxThrowException __std_exception_copy

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen _stricmp strncmp strncpy strcmp tolower

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-stdio-l1-1-0

fsetpos ungetc _get_stream_buffer_pointers fgetpos fgetc fputc setvbuf _fseeki64 ftell __stdio_common_vsnprintf_s __stdio_common_vsscanf fread __stdio_common_vsprintf fwrite fseek fclose fflush __acrt_iob_func fopen

api-ms-win-crt-math-l1-1-0

log fminf fmodf sqrtf cosf ceilf atan2f fmaxf sinf logf pow powf acosf

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc

api-ms-win-crt-convert-l1-1-0

strtoul _wtoi64 atof

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit _initterm_e _initterm

Name

.text

Size

394KB

Virtual Size

394KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vlizer

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

5b234744c285a2b38817c5b3709785d83f5d863d8d9b83e1e9662512756d72f7

kernel32

user32

msvcp140

d3dcompiler_47

winhttp

shlwapi

imagehlp

vcruntime140_1

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic