26c0decb0d570ef5ca7770b6474988d6c154b84b3d14a7ac8196ed49317003e0
- SHA256 26c0decb0d570ef5ca7770b6474988d6c154b84b3d14a7ac8196ed49317003e0
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cs2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
cs2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
猎鹰注入器.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
猎鹰注入器.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 26c0decb0d570ef5ca7770b6474988d6c154b84b3d14a7ac8196ed49317003e0
- Size 3.8MB
- Sample260804-l8v57axelf
- SHA256 26c0decb0d570ef5ca7770b6474988d6c154b84b3d14a7ac8196ed49317003e0
- MD5 8ce83d17798816fae5fd413a659820e9
- SHA1 67fdfbe56950932b8f8073bb4e859a9fcdca7d62
- SHA512 bc77028ea81fef0b1d4f41597cf838d4c83dd6be587a87ea43075dbdfc9411ed51962668cdce565e1f4c3577fa1c9659a289169c16f6038b9380e0a8a4b75450
- SSDEEP 98304:/BBDWxZL/hHFXORDvNzwB8V1KEF/wDi6dgiRW7famDt20:5BDMF1ORDvN0B8V1KEoBbRWLDtL
- TLSH T1FF0633ECEE47BA99D1057CCC269110D9A46BB3123BDE6E7372D31713EB6916AC32504C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/cs2.dll unpack001/猎鹰注入器.exe
File Explorer
-
26c0decb0d570ef5ca7770b6474988d6c154b84b3d14a7ac8196ed49317003e0.zip 3.8MB
-
cs2.dll.dll 3.6MB
-
教程.txt41B
-
猎鹰注入器.exe.exe 563KB
cs2.dll
- IMPHASH 0d44e334f2351c527f6f5f8bd968182c
- SHA256 774864455e8a84593c138a493bbab466101e542026da9470ad7b4b95525c0b72
- MD5 83c6d4c2550b38d7877262fd72e1010a
- SHA1 64bf55e04aeb51592bcd55a067eb114023ec9959
- SHA512 38910e3089a900d583d512b1cd7ad2addcefc95cdb36d84e1bfde6257b36735b90d61e2f9edf1335e1175fa9516d8ac1f51bf481699222eca8bc0abf9a2c3ea8
- SSDEEP 98304:lH5sLpr9Hl3mXNNFSVO11WiDTYHP+aBPEYFGd37R:lH5E7WXNNkVO11WiCP72Yc
- TLSH T1B60633EDB68E1ABDDD0954B8D98120AC7667F311CEA52E0F37AAC1265FD3D01876D203
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6530558
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AcquireSRWLockExclusive
shell32
SHGetFolderPathW
user32
CloseClipboard
advapi32
RegCloseKey
ole32
CoCreateInstance
api-ms-win-core-synch-l1-2-0
WaitOnAddress
d3d11
D3D11CreateDeviceAndSwapChain
Name
.text
Size
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
970KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_addr
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.he0
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.he1
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.he2
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
223B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
教程.txt
- SHA256 12a32779795ff59ba046080fedcfafc8f5b3744b258b720d0b3890bf1fc4dbdd
- MD5 5a44abbead2dcca1eeb6457f35f6a9b6
- SHA1 ea7d0c0e4094fba93054bf8939fbdb7f141ad7b4
- SHA512 0702e8b9c7170dacddf5f76ec36a11f1bc580ac1590799925efb9323dbf79680c7946d328ed906823ec2a1464abbe0a1208784b97ae6c5cd0520372ad3a38d73
- MD5 SHA1 SHA512
猎鹰注入器.exe
- SHA256 75fd31f135c48029e4fbd674cea69e17f19d89e2e520b8c3c48a4ebc1cd13338
- MD5 e1356c23d3472520afffea93e8076926
- SHA1 4380de5b540c6c338ced397988d2cf374279ae0f
- SHA512 163f5c2a384e70ac5aeb895744a8a36ef593d057bb1a78e237a7ab71c53b7c9a4d3e8f65b6eee271787eccae5f27bfdd1f0ef0d7f503d9225f5aa9f4499ff813
- SSDEEP 6144:DS2PS+OcvuOddc40bSkX+7PmIcz6tf0j2wpGb9u6MwL:DS2PS2Wz40ACIceNUgzMwL
- TLSH T1B6C491E06489C4F3E1A0A4FE46CA71E142DF0EFABA1057106869B5BBD5F7C12016BD7B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
806032
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
WOC0
Size
Virtual Size
588KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
WOC1
Size
196KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
366KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=175, id=261, version=33145,
count=17, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=89, id=261, version=35721,
count=15, id=257, version=33145,
count=203, id=1, productName=Unmarked objects,
count=1, id=265, version=36246,
count=1, id=255, version=36246,
count=1, id=151,
count=1, id=258, version=36246,