9b9be01389980dc3a22c995773671364f8823cc5ffab96f9b701a5e6220bbbb2

General

Target
9b9be01389980dc3a22c995773671364f8823cc5ffab96f9b701a5e6220bbbb2
Size 585KB
Sample260803-dpwcvaxeqe
SHA256 9b9be01389980dc3a22c995773671364f8823cc5ffab96f9b701a5e6220bbbb2
MD5 f90738183c375f9df5cf274127bf28ca
SHA1 d3ce7b36b00b27408f8559830a236cfca87d677d
SHA512 77f94c175382b928d0dfff0ba5e321976be21832b0087a6150f3cf515f240422af0578cc65cfbcd385aa3ff5a68ccc0182272bb6c8c493d44d34c51ceb7f0221
SSDEEP 12288:07KCscbjNwgYmjcsFQ2z3iDzG0bbVM4u4RtrmUuxE6mWDWXV/Oqfqk1:1crYmQsFQk2NW4umrFuiqqFzqm
TLSH
T1EDD4CF12F991C032E1A305718E7ACFB95A7EBD201B6295CB73D41DFA9A30AC06B35717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b9be01389980dc3a22c995773671364f8823cc5ffab96f9b701a5e6220bbbb2

File Explorer

9b9be01389980dc3a22c995773671364f8823cc5ffab96f9b701a5e6220bbbb2

.exe 585KB

9b9be01389980dc3a22c995773671364f8823cc5ffab96f9b701a5e6220bbbb2

IMPHASH 7d40c61181d8e176ccdfe5442d20d220
SHA256 9b9be01389980dc3a22c995773671364f8823cc5ffab96f9b701a5e6220bbbb2
MD5 f90738183c375f9df5cf274127bf28ca
SHA1 d3ce7b36b00b27408f8559830a236cfca87d677d
SHA512 77f94c175382b928d0dfff0ba5e321976be21832b0087a6150f3cf515f240422af0578cc65cfbcd385aa3ff5a68ccc0182272bb6c8c493d44d34c51ceb7f0221
SSDEEP 12288:07KCscbjNwgYmjcsFQ2z3iDzG0bbVM4u4RtrmUuxE6mWDWXV/Oqfqk1:1crYmQsFQk2NW4umrFuiqqFzqm
TLSH
T1EDD4CF12F991C032E1A305718E7ACFB95A7EBD201B6295CB73D41DFA9A30AC06B35717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

160876

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Users\haoning\Documents\GitHub\@bitcookies\winrar-keygen\bin\Win32-Release\winrar-keygen.pdb

kernel32

GetLastError GetConsoleMode MultiByteToWideChar ExpandEnvironmentStringsW GetStdHandle SetEndOfFile WideCharToMultiByte CreateDirectoryW HeapSize ReadConsoleW CreateFileW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage LocalFree FormatMessageA GetLocaleInfoEx GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType CloseHandle SetStdHandle GetConsoleOutputCP GetFileSizeEx SetFilePointerEx HeapReAlloc FlushFileBuffers ReadFile FindClose FindFirstFileExW FindNextFileW WriteConsoleW

advapi32

CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW

ntdll

RtlComputeCrc32

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpOpen

Name

.text

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

205KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9b9be01389980dc3a22c995773671364f8823cc5ffab96f9b701a5e6220bbbb2

kernel32

advapi32

ntdll

winhttp

generic