147c2eb9ea2df5f3d273473102d680756d968bee0fdde8168214f30b033a4b9d

Sharing

Copy URL Twitter E-mail

General

Target
147c2eb9ea2df5f3d273473102d680756d968bee0fdde8168214f30b033a4b9d
Size 1.6MB
Sample260804-lkk1bagh42
SHA256 147c2eb9ea2df5f3d273473102d680756d968bee0fdde8168214f30b033a4b9d
MD5 9dcf12810d9535d5afd9013cfb56a337
SHA1 1b0c47833b524cf9af85d3c9abb82045eb9c8833
SHA512 24b2b72f6b37206c52c8cc0666a56fa0bb05a5e9f41233eb2398ed2bd0ac71648cad326d74f3b8f560b58d5b8225d0d7cedfaefa21c75188bd65dcb3f87b3e6d
SSDEEP 12288:+mcTT/lMSULAX9rNjT1WmEz4Lr8ClWCk2iXh+KQSLcZnrAu2FXsDXN0w83g:+X9YLAX9rNTfLr1JkXQSe2FXmo
TLSH
T1E575B50AF7EA20D1F5BAD139AA97222AFC7174E14739A7D75144490E0F70FE4AD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
147c2eb9ea2df5f3d273473102d680756d968bee0fdde8168214f30b033a4b9d

File Explorer

147c2eb9ea2df5f3d273473102d680756d968bee0fdde8168214f30b033a4b9d

.dll 1.6MB

147c2eb9ea2df5f3d273473102d680756d968bee0fdde8168214f30b033a4b9d

IMPHASH 732829f8748f22c4542dba9e3f6e3d78
SHA256 147c2eb9ea2df5f3d273473102d680756d968bee0fdde8168214f30b033a4b9d
MD5 9dcf12810d9535d5afd9013cfb56a337
SHA1 1b0c47833b524cf9af85d3c9abb82045eb9c8833
SHA512 24b2b72f6b37206c52c8cc0666a56fa0bb05a5e9f41233eb2398ed2bd0ac71648cad326d74f3b8f560b58d5b8225d0d7cedfaefa21c75188bd65dcb3f87b3e6d
SSDEEP 12288:+mcTT/lMSULAX9rNjT1WmEz4Lr8ClWCk2iXh+KQSLcZnrAu2FXsDXN0w83g:+X9YLAX9rNTfLr1JkXQSe2FXmo
TLSH
T1E575B50AF7EA20D1F5BAD139AA97222AFC7174E14739A7D75144490E0F70FE4AD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557351

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\git\gitlab\tool\src\antihook\src\wdm\x64\Debug\AntiHook.pdb

kernel32

lstrlenW CreateFileW GetFileSizeEx DecodePointer CloseHandle RaiseException GetLastError SetLastError DeviceIoControl InitializeCriticalSectionEx CreateFileMappingW MapViewOfFile UnmapViewOfFile lstrlenA MultiByteToWideChar WideCharToMultiByte GetEnvironmentVariableW GetCurrentProcess OpenProcess GetModuleHandleW GetProcAddress LoadLibraryW CompareFileTime GetFileSize ReadFile lstrcpynA lstrcpyW SystemTimeToFileTime GetSystemDirectoryA LocalFree SetEndOfFile ReadConsoleW SetStdHandle GetStringTypeW GetModuleFileNameW SetEnvironmentVariableW GetLocalTime DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapQueryInformation HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW SetConsoleCtrlHandler GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers GetCurrentThread HeapValidate HeapSize VirtualProtect VirtualAlloc GetSystemInfo WriteConsoleW GetProcessHeap HeapFree HeapAlloc OutputDebugStringW OutputDebugStringA SetFilePointerEx CreateDirectoryW GetFileType GetStdHandle ExitProcess GetModuleHandleExW RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader FreeLibrary VirtualQuery InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess

user32

wsprintfA wsprintfW MessageBoxW UnregisterClassW

advapi32

RegGetValueA OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

ole32

CoInitializeEx CoInitializeSecurity CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket

oleaut32

VariantInit GetErrorInfo SysAllocString VariantChangeType SetErrorInfo CreateErrorInfo SysAllocStringLen VariantClear SysFreeString

shlwapi

PathFindFileNameW PathAppendW StrStrIA PathAppendA PathFileExistsW

dbghelp

ImageNtHeader UnDecorateSymbolNameW SymSetOptions SymGetOptions SymGetModuleInfo64 SymInitializeW SymLoadModuleEx SymRegisterCallback64 SymFromName SymEnumSymbols SymFromIndex SymGetTypeInfo SymGetTypeFromName SymCleanup

crypt32

CryptStringToBinaryW CryptStringToBinaryA CryptBinaryToStringA CryptBinaryToStringW

iphlpapi

GetAdaptersInfo

ws2_32

inet_ntoa inet_ntop freeaddrinfo gethostname getaddrinfo

libcurl

curl_easy_perform curl_easy_setopt curl_easy_init curl_easy_strerror curl_easy_cleanup curl_slist_free_all curl_slist_append curl_easy_reset

cjson

cJSON_PrintUnformatted cJSON_Delete cJSON_GetObjectItem cJSON_IsString cJSON_CreateObject cJSON_AddStringToObject cJSON_GetStringValue cJSON_free cJSON_Parse

Name

.textbss

Size

Virtual Size

537KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

418KB

Virtual Size

417KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

481B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

147c2eb9ea2df5f3d273473102d680756d968bee0fdde8168214f30b033a4b9d

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

dbghelp

crypt32

iphlpapi

ws2_32

libcurl

cjson

generic