GeniusTool.zip
- SHA256 1a6f854bdbed993590005c3e48add5cac1d6982adf2ced19dc9ee5fd48cc918c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GeniusTool.exe
Resource
win10v2004-20260513-de
windows10-2004-x64
28 signatures
900 seconds
Behavioral task
behavioral2
Sample
GeniusTool.exe
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target GeniusTool.zip
- Size 7.6MB
- Sample260802-j8fpdsfl3v
- SHA256 1a6f854bdbed993590005c3e48add5cac1d6982adf2ced19dc9ee5fd48cc918c
- MD5 ffdaaad9acd0a4d2dde79ef01633c195
- SHA1 4e1dc9a36809ca850f2b432e3867764321bb9670
- SHA512 67312b11900852c3d7c608c4dbd67a281b8ece7bf2d9624fd810cd8bfb2e5706000808b4238e5a511f0b32b14bf64f1ae045c1df661b550cd9465b96255f25e5
- SSDEEP 196608:a2F/tzaiDzaypo/N/Cdg/acMW3SJOX8YjIxJS3NbdJwHnq5xUdp8MHn:a2FpaiDZQNq9cY+jBbDAn4SQI
- TLSH T14E8633F8E194964BE8AFC613F073FA11B09A3F6673531DCE864AC348CE460961E65778
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/GeniusTool.dll unpack001/GeniusTool.exe
File Explorer
-
GeniusTool.zip.zip 7.6MB
-
GeniusTool.deps.json475B
-
GeniusTool.dll.exe 7.8MB
-
GeniusTool.exe.exe 183KB
-
GeniusTool.runtimeconfig.json429B
GeniusTool.deps.json
- SHA256 9fdb426727941d6c0857f82bd460b316399396682baa82601ec789642b09d0ef
- MD5 71e5167173129406dc68797087abaaa3
- SHA1 401b5395ad1235e1f6503dfc0af239dfe4d75bae
- SHA512 694db42bf1cc4928d40012522454614f03286f5773724a51f7da9a8d27904e7eeab0ecb32153ea84ef173b2eb8352c972c829b6b4b6e1542bd887a6da782810a
- TLSH T155F0E509E5840CA781F123B564364767F9736B730C252A0E79FE881C0F779174090F68
- MD5 SHA1 SHA512 TLSH
GeniusTool.dll
- SHA256 582592b0eeca45e6113a8d13bf97ddfa950cd51b1d0f859f29efc0d2dec7cbde
- MD5 5881832914e3216db52085bc80a2ef6e
- SHA1 6ba6658ce67da7aca14c4802d464d55ff4b49a24
- SHA512 5c176661598b0518dd2a47704a77069549726afc5fb08ee4045b4154dc5133dbbfbe964e7631b357a4e515a6b3a4017510cb334a9f90cdc8eed86765ac48c5cf
- SSDEEP 196608:6QjmLHa8j3a0L+RN5cl0jw2+a/Qh4f4YZmRFYlNX7H+vfMDVUfR+4:6Q4a8jhSNWV2cwZ7XTofWOk
- TLSH T12F8601DC726072DFC85BC462DEA82D68FA5178BB931B4603902755ADEE4D897CF180F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
}
Sd$
Size
199KB
Virtual Size
199KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
7.6MB
Virtual Size
7.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
GeniusTool.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 460960200fbb44f513951e998cee76ea303da31c8584770ccbc05b3794e654a6
- MD5 407945b601060096300dfcbc67b3bca0
- SHA1 d858bed669d060b65e84bff33a4884da2fbe3ec7
- SHA512 e8b1f0fe0666c809b43ce3c8870e97067b4c6f0e027ffbae8c3a064adb48d48bf6ac1c1e883a21c7e8ddac40ce0f4d25bb841fef7f28cfd95c9468e57d06c8a4
- SSDEEP 3072:QqeXA/4yIg9vkNPNu6H6xCYOiVUE265XJhiXpmbPx6dawDjQLTP:QvgvkNFNaxmNE3JepmLx6dNDjQLT
- TLSH T1FA046C07A2A851BDE1B7C679CDA24D41FB7378598B71A7CF07504A760E63BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
GeniusTool.runtimeconfig.json
- SHA256 73b37384bb001e78db2014d328750eb2990393712fd63cd00c0f41965b3dbe96
- MD5 1043e1e5e960609d014e56f638202c24
- SHA1 aaa1583e8c9809a39a52c73efff1e5e439cfd3df
- SHA512 5fe61affcddd7b6235270cc3f0e7fa7f2e890852de6f5c7759234870d244ee1b32f95dfd7efb5e2f410d12557593491c53a5323b68966918f92a545c1f10d66e
- TLSH T1BEE02A3ACA206DB714F02BBEC02AC187FA3023AB00040D16BAFC180C2F361A22001F88
- MD5 SHA1 SHA512 TLSH