f2ec88f4bd3f8452dc208949d92ba8b78ffe99d47c376719a74a7657ea8da094

Sharing

Copy URL Twitter E-mail

General

Target
f2ec88f4bd3f8452dc208949d92ba8b78ffe99d47c376719a74a7657ea8da094
Size 36KB
Sample260801-evfp1sde46
SHA256 f2ec88f4bd3f8452dc208949d92ba8b78ffe99d47c376719a74a7657ea8da094
MD5 d8a2b443fc7550146307cbfb61b52ec3
SHA1 8d6b737e9683c41ae55c363717cad15f0cb06eca
SHA512 a7b94a3e2b6ab547576b2c9d16ec8d5d8428631c1f12a9305d66d98a09f516d8b7e5b3bfb4307f324bd2ad9954ae212359973bb524e58d1a2dbf30938ff25d50
SSDEEP 384:+C80VskihOoDJ9vjzkON4mC0JnsrA0swob/JD76CAuZ6/ARJu4X4VEGnrIWDY6sj:JTVTih19vjzkON1WAzudmI2GE6Y1K
TLSH
T1ACF2D75173E900C8F6B7CA78DBB9595BE47778169A01FA9F0614010B1F30E66EE38F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2ec88f4bd3f8452dc208949d92ba8b78ffe99d47c376719a74a7657ea8da094

File Explorer

f2ec88f4bd3f8452dc208949d92ba8b78ffe99d47c376719a74a7657ea8da094

.exe 36KB

f2ec88f4bd3f8452dc208949d92ba8b78ffe99d47c376719a74a7657ea8da094

IMPHASH 98b396bfa542bc5d28f14e899b63adb6
SHA256 f2ec88f4bd3f8452dc208949d92ba8b78ffe99d47c376719a74a7657ea8da094
MD5 d8a2b443fc7550146307cbfb61b52ec3
SHA1 8d6b737e9683c41ae55c363717cad15f0cb06eca
SHA512 a7b94a3e2b6ab547576b2c9d16ec8d5d8428631c1f12a9305d66d98a09f516d8b7e5b3bfb4307f324bd2ad9954ae212359973bb524e58d1a2dbf30938ff25d50
SSDEEP 384:+C80VskihOoDJ9vjzkON4mC0JnsrA0swob/JD76CAuZ6/ARJu4X4VEGnrIWDY6sj:JTVTih19vjzkON1WAzudmI2GE6Y1K
TLSH
T1ACF2D75173E900C8F6B7CA78DBB9595BE47778169A01FA9F0614010B1F30E66EE38F1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\吴昊轩\source\repos\Project57\x64\Release\Project57.pdb

kernel32

Process32FirstW CloseHandle CreateThread GetProcAddress SetFilePointerEx ExitProcess GetModuleHandleW CopyFileW GetDriveTypeW IsDebuggerPresent DeleteFileW RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId Process32NextW Sleep FindFirstFileW CreateEventW CreateToolhelp32Snapshot GetLogicalDriveStringsW SetFileAttributesW OpenProcess GetSystemDirectoryW CreateFileW WaitForSingleObject FindClose SetFilePointer SetProcessShutdownParameters GetModuleFileNameW TerminateProcess GetDiskFreeSpaceW WriteFile GetCurrentProcess GetCurrentThreadId GetSystemTimeAsFileTime FindNextFileW CheckRemoteDebuggerPresent GetStartupInfoW InitializeSListHead RtlCaptureContext

user32

ExitWindowsEx BlockInput SetWindowsHookExW wsprintfW CallNextHookEx

advapi32

OpenServiceW GetUserNameW CreateProcessAsUserW LookupPrivilegeValueW AdjustTokenPrivileges CreateServiceW RegCloseKey CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid RegCreateKeyExW RegSetValueExW OpenProcessToken FreeSid SetThreadToken StartServiceW CheckTokenMembership DuplicateTokenEx

shell32

ShellExecuteW

iphlpapi

GetAdaptersInfo

ws2_32

htons gethostname inet_ntoa sendto WSAStartup gethostbyname socket inet_addr closesocket WSACleanup

vcruntime140

wcsrchr strrchr __C_specific_handler __current_exception __current_exception_context memset memcpy strstr

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-string-l1-1-0

strcpy_s wcscat_s wcscpy_s _wcsicmp

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s _set_fmode __p__commode

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _c_exit _register_thread_local_exe_atexit_callback _get_narrow_winmain_command_line _configure_narrow_argv _exit exit _register_onexit_function _crt_atexit terminate _initterm_e _set_app_type _seh_filter_exe system _wsystem _initialize_onexit_table _initterm _cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

f2ec88f4bd3f8452dc208949d92ba8b78ffe99d47c376719a74a7657ea8da094

kernel32

user32

advapi32

shell32

iphlpapi

ws2_32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic