6ae8e6ee995673727af2f74eda544861f73d0d273468e7d7a1ba76b9b7a66123
- SHA256 6ae8e6ee995673727af2f74eda544861f73d0d273468e7d7a1ba76b9b7a66123
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Mem Reduct/memreduct.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Mem Reduct/memreduct.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 6ae8e6ee995673727af2f74eda544861f73d0d273468e7d7a1ba76b9b7a66123
- Size 223KB
- Sample260803-pflylaap2t
- SHA256 6ae8e6ee995673727af2f74eda544861f73d0d273468e7d7a1ba76b9b7a66123
- MD5 7721472653cef0245c4e0d32822497f5
- SHA1 c8e6a606912ebbdcd1b8b8db4418587112e77fd0
- SHA512 10af5434b17ed35badc637d7bfa07e18f5245c53a6c15da85002a8a34f08cd4612af7e0385f6d8394fe48c512d384dad0b7b13959ce6f310a35f154d7c5ba9c8
- SSDEEP 6144:dsyY1r/xYCVWUkJmr6NbKUYyLUNDonvAsuRBvvk:dsyYd+A4mZgas8vk
- TLSH T1732423FAEDEF3DC0CE279D7B3358098529748104D774819E4429829B25BF7879AF0C6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Mem Reduct/memreduct.exe
File Explorer
-
6ae8e6ee995673727af2f74eda544861f73d0d273468e7d7a1ba76b9b7a66123.zip 223KB
-
Mem Reduct/History.txt6KB
-
Mem Reduct/License.txt34KB
-
Mem Reduct/Readme.txt787B
-
Mem Reduct/memreduct.exe.exe 387KB
-
Mem Reduct/memreduct.exe.sig566B
-
Mem Reduct/memreduct.lng112KB
-
Mem Reduct/portable.dat10B
Mem Reduct/History.txt
- SHA256 acd05334090b4267600f6c9cb3ae11f5c99adc1bff3071c04d7bc8b42660cc32
- MD5 03578467a8ecfa11e371a8772b9868d7
- SHA1 dec1e7111810c00fa03de39c73086f4475fe484d
- SHA512 bf1dde873a9817dc138faa4f706d078c754fcabb771163cc5a51386cda8f4c45755e9e0fa0d7896f691d8e4300d3bc6d05fccb01a93b18bb663e61b598e6854b
- SSDEEP 96:1MrfpKLCZOkYs9JbeBYGIeEft5N0Tv+UL0IcfLBnwJ4BhcJ:ofpmklzhGILfh0Tv+lnwJ4Bk
- TLSH T166E1516158E7F18D21F386E3A76779111F2AA05833A3289690C8807DB10D2BCF79F67C
- MD5 SHA1 SHA512 SSDEEP TLSH
Mem Reduct/License.txt
- SHA256 0b383d5a63da644f628d99c33976ea6487ed89aaa59f0b3257992deac1171e6b
- MD5 3c34afdc3adf82d2448f12715a255122
- SHA1 7713a1753ce88f2c7e6b054ecc8e4c786df76300
- SHA512 4937848b94f5b50ea16c51f9e98fdcd3953aca63d63ca3bb05d8a62c107e382b71c496838d130ae504a52032398630b957acaea6c48032081a6366d27cba5ea9
- SSDEEP 768:A7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0v:AVtNIq1uzZY1C
- TLSH T142F2825EB74513B205A202526E4FA8DEE31DD07A376A00657869C15C23B7E3483BFBAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Mem Reduct/Readme.txt
- SHA256 43f886bc0bf6f98d366bb02d49ba9ff763b4df591df9b32106d68b9b3d59cd08
- MD5 ea6e2848504de914b00d9c5c60b14733
- SHA1 d4c13760d573c6b85956f3f9a1af0ed2f20f5ce6
- SHA512 946bab9948d184fba685b8ca83bb5363d096917c766cfeae214c9a4e45554bbf1a3ca0c288deb3a9978ebc188fc075ce6db294cbc22a5007d05165a46789b35d
- TLSH T1A80141C30309B0AB2A464BFB214E8DA25A324409874D948024CCC40CA092A5FAB2EE39
- MD5 SHA1 SHA512 TLSH
Mem Reduct/memreduct.exe
- IMPHASH df513fa37df881a5e8aa55f4e1aff5c8
- SHA256 dd55a81d56e8c32918e5190b2ec2a1f2a7edbbca884627439b4b619fdfb5602d
- MD5 66f5c7ebe24abc9405e688c1597e1be9
- SHA1 39988b6f5b654475f786292e6859b067a388289d
- SHA512 226bb6f5fcd77d487aff2f378d87dfe8574e6331051b5c14fb8c767a6b7fc849e9299ab751e97ccfdbb7e199304b67ffb0b31626ce08c74153108a7471380673
- SSDEEP 6144:+0jxaVsVSJisMi/WHHg+KTzrUd+Mb+kNHvsP:+UaKxji/WvKTzrjM1g
- TLSH T14784F708A991C4A9D1EA8334C56383F2E535FC99DF6389EB6264FD693E33DC06938711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
178336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\projects\memreduct\bin\64\memreduct.pdb
kernel32
InitializeCriticalSectionEx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
HeapAlloc
HeapFree
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
WriteFile
GetStdHandle
RaiseException
EncodePointer
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringW
GetProcessHeap
SetFilePointerEx
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CloseHandle
CreateFileW
RegisterApplicationRestart
VirtualProtect
GlobalUnlock
CreateProcessW
UnregisterApplicationRestart
GlobalLock
WriteConsoleW
GlobalAlloc
OutputDebugStringW
GetPrivateProfileSectionNamesW
GetLocaleInfoW
GetPrivateProfileSectionW
SetDllDirectoryW
LocalFree
GlobalFree
GetPrivateProfileStringW
SetSearchPathMode
SetDefaultDllDirectories
RtlPcToFileHeader
WritePrivateProfileStringW
user32
DeleteMenu
MonitorFromWindow
GetPropW
IsWindowVisible
InsertMenuItemW
GetWindow
CheckMenuRadioItem
GetMenuItemInfoW
EnableWindow
EndPaint
BeginPaint
GetCursorPos
GetMessageW
GetWindowThreadProcessId
UpdateWindow
DrawFrameControl
PtInRect
RegisterWindowMessageW
GetParent
DrawEdge
EnableMenuItem
GetKeyNameTextW
DrawIconEx
SetRect
DrawTextW
GetDlgItem
GetClientRect
GetComboBoxInfo
GetWindowDC
DrawMenuBar
GetClassNameW
SetPropW
BringWindowToTop
SetFocus
IntersectRect
EnumWindows
PostQuitMessage
GetSysColor
DrawFocusRect
TrackMouseEvent
SetWindowPlacement
MapWindowPoints
GetDlgCtrlID
GetMonitorInfoW
RedrawWindow
SetTimer
GetCapture
OffsetRect
ShowWindow
GetSubMenu
GetWindowPlacement
GetMenuBarInfo
GetWindowLongPtrW
GetSystemMetrics
EndDialog
ScreenToClient
GetIconInfo
LoadAcceleratorsW
SetWindowLongPtrW
EnumChildWindows
MonitorFromRect
SetWindowPos
GetDC
InflateRect
DestroyWindow
GetFocus
GetMenu
GetWindowRect
MapVirtualKeyW
CallWindowProcW
AllowSetForegroundWindow
DefWindowProcW
IsIconic
SetForegroundWindow
SystemParametersInfoW
CreateDialogIndirectParamW
CheckMenuItem
TrackPopupMenuEx
SetClipboardData
ChangeWindowMessageFilterEx
TranslateMessage
TranslateAcceleratorW
DrawTextExW
MoveWindow
IsWindowEnabled
GetForegroundWindow
SendDlgItemMessageW
FrameRect
EmptyClipboard
DestroyAcceleratorTable
SetMenuItemInfoW
CloseClipboard
CreateIconIndirect
DestroyIcon
SendMessageW
KillTimer
SetCursor
LoadCursorW
DestroyMenu
RegisterHotKey
ClientToScreen
CreatePopupMenu
LoadMenuW
UnregisterHotKey
DialogBoxIndirectParamW
InvalidateRect
IsDialogMessageW
DispatchMessageW
OpenClipboard
GetActiveWindow
GetClassLongPtrW
ReleaseDC
gdi32
SetPixelV
GetDeviceCaps
GetTextExtentExPointW
ExtTextOutW
SetDCPenColor
RoundRect
CreateBitmap
Rectangle
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
DeleteDC
SetTextColor
CreateFontIndirectW
CreateSolidBrush
DeleteObject
SetBkColor
ExcludeClipRect
SetDCBrushColor
GetObjectW
CreateDIBSection
SetBkMode
SelectClipRgn
comdlg32
ChooseFontW
ChooseColorW
shell32
SHAppBarMessage
SHGetKnownFolderPath
Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemFree
oleaut32
SysFreeString
SysAllocString
ntdll
RtlFreeHeap
RtlMultiByteToUnicodeSize
RtlCreateHeap
RtlQueryPerformanceCounter
NtSetThreadExecutionState
NtCreateMutant
NtQueryInformationFile
RtlSetHeapInformation
RtlRaiseStatus
NtCreateKeyedEvent
NtQueryInformationThread
NtSetSystemInformation
LdrAccessResource
NtQueryValueKey
RtlExpandEnvironmentStrings_U
NtOpenFile
RtlEqualSid
RtlGetDaclSecurityDescriptor
NtMapViewOfSection
RtlInterlockedPopEntrySList
NtQueryDefaultLocale
NtWaitForSingleObject
NtSetValueKey
NtUnmapViewOfSection
NtQuerySecurityObject
NtQueryDirectoryFile
NtCreateFile
RtlOpenCurrentUser
RtlMultiByteToUnicodeN
RtlFindMessage
NtWaitForKeyedEvent
RtlGetVersion
RtlInitAnsiString
NtFlushBuffersFile
RtlRunOnceBeginInitialize
RtlInitUnicodeStringEx
NtDeviceIoControlFile
NtQueryAttributesFile
RtlUTF8ToUnicodeN
RtlLengthSid
NtDeleteValueKey
NtDelayExecution
RtlReAllocateHeap
LdrGetDllHandleEx
NtQueryInformationToken
NtReleaseKeyedEvent
LdrLoadDll
NtSetInformationThread
NtReadFile
LdrFindResource_U
NtSetInformationFile
LdrUnloadDll
NtCreateThreadEx
RtlFreeUnicodeString
RtlGetAce
RtlDosPathNameToNtPathName_U_WithStatus
RtlDowncaseUnicodeChar
RtlUpcaseUnicodeChar
RtlTimeToTimeFields
LdrGetProcedureAddressEx
NtOpenKeyEx
RtlRandomEx
NtReleaseMutant
NtWriteFile
NtQuerySystemInformation
NtCreateSection
RtlDosSearchPath_Ustr
RtlAllocateHeap
RtlInitializeSListHead
NtOpenProcessToken
RtlInterlockedPushEntrySList
NtAdjustPrivilegesToken
NtOpenMutant
NtResumeThread
NtSetInformationProcess
NtClose
RtlSetUnhandledExceptionFilter
NtTerminateThread
RtlRunOnceComplete
NtQueryInformationProcess
RtlExitUserProcess
RtlInitUnicodeString
comctl32
InitCommonControlsEx
ImageList_Draw
ImageList_GetIconSize
ord381
ord345
dwmapi
DwmSetWindowAttribute
dbghelp
MiniDumpWriteDump
shlwapi
PathUnquoteSpacesW
ord354
StrFormatByteSizeEx
StrTrimW
uxtheme
GetThemeFont
GetThemeBackgroundContentRect
DrawThemeEdge
BeginBufferedAnimation
BufferedPaintRenderAnimation
DrawThemeBackground
GetThemePartSize
CloseThemeData
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
GetThemeTransitionDuration
SetWindowTheme
EndBufferedAnimation
DrawThemeTextEx
OpenThemeData
winhttp
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCrackUrl
WinHttpConnect
WinHttpSetStatusCallback
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReadData
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryHeaders
Name
.text
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=33140,
count=9, id=259, version=34321,
count=16, id=260, version=34321,
count=40, id=261, version=34321,
count=144, id=261, version=33140,
count=14, id=260, version=33140,
count=2, id=262, version=33140,
count=39, id=257, version=33140,
count=483, id=1, productName=Unmarked objects,
count=3, id=264, version=34809,
count=1, id=255, version=34809,
count=1, id=258, version=34809,
Mem Reduct/memreduct.exe.sig
- SHA256 3152dde222deb493a3e56e41014f9ba7340393b0aa2a7f61615228a4c0af560e
- MD5 561870cd86db34a61af8c34b15fc7dc5
- SHA1 6e1d822f277bc8d590e132c42998934ecd7f2402
- SHA512 0046d53cb7a7d0e6a1287aed24771c3f046b38f93f0763a942ee177852106cabc9b5212fa04d18c69e8fc5b649eeb229be4c38f2b23949dd1c4bf733f4983776
- TLSH T16DF0759F370D38DA6155F09939B82021B8B92B81F0FC72AC9173FB812B2D10D591417F
- MD5 SHA1 SHA512 TLSH
Mem Reduct/memreduct.lng
- SHA256 bccfb40bcb6830ef3f87d61e7ec0ad010d0fda088cca77bbdd9a5353d473f72c
- MD5 38233b05c0f8b092b5bdf5587a20da0f
- SHA1 3ab4feab7d863d0dcf36fb0667c2f6308f72bb53
- SHA512 4b74fc97afc883fd7b76aa0034bca55e2174fccc012d084d04cd28a0947c8724aa29b1e272a763fb06b7cea020b64069a8f570621973aedb2c754a6231fbe5f0
- SSDEEP 3072:EZcxMPVKkJpguCszv6RrxOapQgfUMkAa1awUYAGhDZaK7XhS:eODfUMdwRP7XhS
- TLSH T17EB3A81B66F95027F2F79B00E9F501A71BA6BD52693C940C43CA170839F0E60A9677F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Mem Reduct/portable.dat
- SHA256 889b31c6a536fee7b302a65e6a816ec43341b2602e791b2c04fc74d499886e99
- MD5 15b9de0b65f03afe4235b261fe4e28dc
- SHA1 3101a088809003ccb03c908321a6586cc341f736
- SHA512 c3143f190058d81136b11cba9ce4eddc12cf8b21755c9091d80430f8afb30f84947767dc5330b9157832c1a603b66db3d6b46dfaa72e9d51a60863f52fd40bd6
- MD5 SHA1 SHA512