exp-table-maker.zip
- SHA256 52a23d5543cfc4a4f2558d8be73af9ce318289f9060847950b680e63f0f57aa3
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ExpGen.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
ExpGen.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target exp-table-maker.zip
- Size 170KB
- Sample260801-rexptabf26
- SHA256 52a23d5543cfc4a4f2558d8be73af9ce318289f9060847950b680e63f0f57aa3
- MD5 53a5fd4410236ab7daed06612c07cdf1
- SHA1 e0210fe5153d32b2eaa6a6ae379fbe290aa5bca0
- SHA512 709e981e14860b03163dadcc1ab9cd2e39275f98fb71d018e0dd4491e828bc590e7f3c19f1e2a12c9559196eee2facfc6c3c9c3d8d602bf08ce6084f68d3063f
- SSDEEP 3072:iey/pLSjevNabSWnIkQNaCYfaI5l9n5pneZmVKaV46pP7S3PO4GDc/tP:ibWjevkbIkQNvYJ5XHn6moEdt7uxGSN
- TLSH T11604125E458A94EB752113A99CA1A602D778A5F8D0CCFA13B6E1F33804D31DF5CA37E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ExpGen.exe
File Explorer
-
exp-table-maker.zip.zip 170KB
-
ExpGen.cpp17KB
-
ExpGen.exe.exe 544KB
-
ExpGen.txt1009B
-
exp.txt23KB
ExpGen.cpp
- SHA256 c394f1faf9a41380f78dee564c493f62cde2cf9e084d0e7cef35be409a32e6ef
- MD5 388f74fb4a00adf4fab6b5c06b920163
- SHA1 c54c89c75cf46fb191891336d72e3f7d1ee76804
- SHA512 95d53fa751682efdac6a93984b7c339a555d71923935c5b3cc318ec25800d35e132fa6587a769d9e2cf88953e58be17a43cfa4057701fc63ad5bd71ab8e586ab
- SSDEEP 384:DyYYbOJgAREZMceYlEZMceYPEZMceY+EZMceYJEZMceYXEZMceYlEZMceYhEZMcj:tREZMceYlEZMceYPEZMceY+EZMceYJE0
- TLSH T1A182D4EFB70D81A72CA523CEB47B00D6C85CC111BCFBE800DAC58CF5724556AB676AA5
- MD5 SHA1 SHA512 SSDEEP TLSH
ExpGen.exe
- IMPHASH a152f7b4b314e9e838ae658d2985816c
- SHA256 dc8fdb823c9c258d7388af47a6149ca9c7cb97b7c817e76537fd5b07b8d5d0a9
- MD5 e995c6481411332f15062b2e2ddc5133
- SHA1 a3c4d189dbc39ad2e29049bcde9b639454a5515a
- SHA512 1de67f2e3e4e20e27adabddbe5cb996fddd9882594c1e75c01f1b78770097f573fede39ba244a6fa86cb88b9297063c460b5afbde7a63b29042445dc89755059
- SSDEEP 12288:z7xmSiYuDkUohrhgn8Q68vH8QAL+2nHueJnuqBb1a:sSidDke0L+2HueJn1
- TLSH T13EC43B00E211A17AFDF340F78EFE296D5558AA30079814C3A1C899AED76ABF13E33557
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
226864
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\My Documents\Visual Studio Projects\292-Test1\Debug\Homework 1.pdb
kernel32
WideCharToMultiByte
MultiByteToWideChar
GetLocaleInfoA
RtlUnwind
RaiseException
IsBadWritePtr
IsBadReadPtr
HeapValidate
TerminateProcess
GetCurrentProcess
ExitProcess
GetProcAddress
GetModuleHandleA
GetCommandLineA
GetVersionExA
LCMapStringA
GetLastError
LCMapStringW
GetCPInfo
GetTimeFormatA
GetDateFormatA
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetFilePointer
FlushFileBuffers
CloseHandle
SetUnhandledExceptionFilter
HeapAlloc
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
IsBadCodePtr
IsValidLocale
IsValidCodePage
EnumSystemLocalesA
GetUserDefaultLCID
VirtualProtect
GetSystemInfo
VirtualQuery
SetConsoleCtrlHandler
GetTimeZoneInformation
GetProcessHeap
FreeLibrary
ReadFile
SetStdHandle
GetACP
GetOEMCP
CreateFileA
GetLocaleInfoW
SetEndOfFile
SetEnvironmentVariableA
Name
.textbss
Size
Virtual Size
211KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
456KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=31, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=152, id=28, productName=VS2002 (.NET) build 9466, version=9466,
count=3, id=25, version=9210,
count=77, id=1, productName=Unmarked objects,
count=33, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=61, productName=VS2002 (.NET) build 9466, version=9466,
ExpGen.txt
- SHA256 25ed20d6fde6b2e93a19ed1bc7f61e1025307f974121b47629000735aa0427f5
- MD5 abab8cc2de230afcbee0debc4bd56df7
- SHA1 b3e18e66d01f627d014c929f262b9c477c621ec1
- SHA512 8b30fadee903ad9c62db8eafc2cd1e487b74a996bd6880b5212cafcfe7c3ec6f117ed88eff1f5d4d3c53afa94a10db9816f2434988bc869ef9aa337cef131336
- TLSH T1EB110E32228B937A447524A17B8F41EBA349DADC5767B8E1709D817E829313A0B261D4
- MD5 SHA1 SHA512 TLSH
exp.txt
- SHA256 b35539d53ca9bcb5e61e7fa4a230f7d14a8577fb681af877977b55bce281194c
- MD5 0b5a83e203416ea2bd11cc6d8c9ee2e2
- SHA1 c22686d98a27f27757112717612f16ef6350ee4e
- SHA512 f0cf75a6521409246580a48949ab0d0ded7b1545d0016bcd7009406ecc2f4043abb2a083bcd6b0fbecfb17c06923454dba3d1d9d9af9a61f319c206b4c8c7527
- SSDEEP 384:ghputXXL6NDgqEEEVzz4gWmhlUuFpk9bihr5GVogHDEOzKbX8wnaJ:iputXXoDghW3ACbW5G65yJ
- TLSH T12AB2C9B022A857ED73C4875440A6716D04BA67777C46A2948792BABB6C3EFC38471FC3
- MD5 SHA1 SHA512 SSDEEP TLSH