pasters[.]club[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
pasters.club.exe
Size 1.7MB
Sample260804-p8d4fsxtfy
SHA256 0f976a71b1863f5ce5f26218bdb0e7f58e3b0fb41043ff54387d95290eb4d06f
MD5 fac641ecd0523047d0aad59a69de7100
SHA1 76f587fe17341147da0a90fb844f078003d5b8a7
SHA512 dac211a67157a63fc11618633d10af2f2f6d9c9d3a684f2f11e9bc9f77b31b0701d3a10074a757eb477b584ef4e60f5c0ae930fe5d7d5a8219ba52be50a2390b
SSDEEP 49152:g5cUAiE80VWYYz0bo18jRbLJvz6pnAyAi:2ksALJe
TLSH
T117858E46B3B400E8C1ABD138C656A61FEB71344903309BEB67E08A556F63BE15F7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pasters.club.exe

File Explorer

pasters.club.exe

.exe 1.7MB

pasters.club.exe

IMPHASH 54f993a97009d51e277e6f9291435e04
SHA256 0f976a71b1863f5ce5f26218bdb0e7f58e3b0fb41043ff54387d95290eb4d06f
MD5 fac641ecd0523047d0aad59a69de7100
SHA1 76f587fe17341147da0a90fb844f078003d5b8a7
SHA512 dac211a67157a63fc11618633d10af2f2f6d9c9d3a684f2f11e9bc9f77b31b0701d3a10074a757eb477b584ef4e60f5c0ae930fe5d7d5a8219ba52be50a2390b
SSDEEP 49152:g5cUAiE80VWYYz0bo18jRbLJvz6pnAyAi:2ksALJe
TLSH
T117858E46B3B400E8C1ABD138C656A61FEB71344903309BEB67E08A556F63BE15F7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1366640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpOpenRequest WinHttpOpen WinHttpSendRequest WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSetTimeouts

kernel32

VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock VirtualProtect WriteProcessMemory GetTickCount64 VirtualProtectEx GetTickCount VirtualQueryEx Process32First VirtualFree GetCurrentProcess GetStdHandle VirtualAlloc Module32Next Module32First GetCurrentThreadId CreateToolhelp32Snapshot Sleep GetCurrentThread Process32Next CloseHandle GetSystemInfo GetThreadContext GetCurrentProcessId VirtualQuery IsDebuggerPresent CheckRemoteDebuggerPresent SetThreadAffinityMask SetThreadPriority SwitchToThread ReadProcessMemory GetConsoleScreenBufferInfo SetConsoleTextAttribute GetProcessId DuplicateHandle QueryPerformanceFrequency GetLastError GetModuleHandleW AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree SleepConditionVariableSRW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA GetProcAddress LoadLibraryA MultiByteToWideChar GetModuleHandleA GetLocaleInfoA GetFileInformationByHandleEx InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable SetUnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead OpenProcess

user32

GetKeyboardLayout GetWindowThreadProcessId GetDesktopWindow ShowCursor IsWindow keybd_event MapVirtualKeyA FindWindowA PostQuitMessage PeekMessageA OpenClipboard CloseClipboard CreateWindowExW SendInput DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow EmptyClipboard GetClipboardData SetClipboardData GetKeyState LoadIconA GetMessageExtraInfo LoadCursorA TranslateMessage GetForegroundWindow SetCapture TrackMouseEvent SetCursor ClientToScreen SetWindowDisplayAffinity GetClientRect SetProcessDPIAware IsWindowUnicode SetWindowLongA GetAsyncKeyState ReleaseCapture SetCursorPos ReleaseDC GetCursorPos UpdateWindow GetMonitorInfoA GetCapture ScreenToClient MonitorFromWindow GetDC ShowWindow MoveWindow RegisterClassExW SetLayeredWindowAttributes GetSystemMetrics UnregisterClassW

gdi32

GetDeviceCaps CreateSolidBrush

advapi32

RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

d3dcompiler_43

D3DCompile

msvcp140

??Bios_base@std@@QEBA_NXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA _Xtime_get_ticks _Query_perf_frequency ?_Xbad_function_call@std@@YAXXZ _Query_perf_counter ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Throw_Cpp_error@std@@YAXH@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Mtx_lock _Thrd_id _Thrd_join _Mtx_unlock _Cnd_broadcast ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit _Cnd_wait ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

wininet

InternetCloseHandle InternetReadFile InternetOpenA InternetOpenUrlA

winmm

timeBeginPeriod timeGetTime

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __std_exception_destroy __std_exception_copy __std_terminate strstr _CxxThrowException __C_specific_handler _purecall __intrinsic_setjmp __current_exception_context __current_exception memchr memcmp memmove memcpy longjmp strrchr

api-ms-win-crt-heap-l1-1-0

free _set_new_mode realloc malloc _callnewh

api-ms-win-crt-math-l1-1-0

fmodf cos _dsign log logf acosf pow roundf powf sin cosf sinf asinf __setusermatherr sqrt sqrtf ldexp atan2f ceilf

api-ms-win-crt-string-l1-1-0

tolower strncpy_s strncpy strcmp strlen strncmp strcpy_s wcslen

api-ms-win-crt-stdio-l1-1-0

fflush fclose ftell __stdio_common_vsscanf _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos _set_fmode __acrt_iob_func fgetc __p__commode fputc __stdio_common_vsprintf_s fseek __stdio_common_vfprintf fwrite _wfopen __stdio_common_vsprintf fread

api-ms-win-crt-utility-l1-1-0

rand srand qsort

api-ms-win-crt-convert-l1-1-0

strtoll strtoull strtod atof strtol

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _errno _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv exit abort system

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 strftime

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-environment-l1-1-0

_dupenv_s