WinScreenFix.rar
- SHA256 5d92707c21976b9a0d7a637ca16985c537882d14c29010ed92ea5af704e1092f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WinScreenFix/WinScreenFix.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
WinScreenFix/WinScreenFix.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
General
- Target WinScreenFix.rar
- Size 335KB
- Sample260805-a6rt7sbb96
- SHA256 5d92707c21976b9a0d7a637ca16985c537882d14c29010ed92ea5af704e1092f
- MD5 64d8af88c4f5195d7b468f386cef8ccb
- SHA1 bd51185790b4aea61b63e3fadb3445b7c92f5f79
- SHA512 850b7f481ad87ac6d103b7e30479fd58c7e2db91a4fa603d272771f26635b9cde23987b3cf87df342d65470ed82f9943180cb047fb7e12c86d5e9f40f4102291
- SSDEEP 6144:zYmMW5A4UGMtq5LzAy3WuNNU91+9smLKSEfXxfUyOL1AtzO57ttN:aW5A4yoTm2U91+9sX9OgO57t3
- TLSH T128742382B615FAFC9F5615DCCB2887317C8F5EC6260395FD49AB0AD318205D903899EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/WinScreenFix/WinScreenFix.exe
File Explorer
-
WinScreenFix.rar.rar 335KB
-
WinScreenFix/READ ME.txt525B
-
WinScreenFix/WinScreenFix.exe.exe 1.2MB
WinScreenFix/READ ME.txt
- SHA256 4afe3bda51d84738ca416654fe24ed32bb8d6d8479dd0432a760e993c8bb0ebe
- MD5 df1b82972c19bbd59927f3097ef784b1
- SHA1 c721770f7765ede0bd0fb4f33d805c40f0fb6898
- SHA512 d31b97bebc3b23506f6bc3cd6f9dd6811d770a325fae81702bf53d70d81cfd4998345b12e6d83e78ee677e88c1476c3679c1128f8f9c1f2934a655193c6da3cf
- TLSH T1D3F0C9F6ABEB959682DCD2914815A944EBA9517E314E19043CAD010CA2A350D663F58C
- MD5 SHA1 SHA512 TLSH
WinScreenFix/WinScreenFix.exe
- IMPHASH 92d7fe5813f894c12e9078c33c7d02f3
- SHA256 a26cfa10face75f2def36c530204c7d95c492ff3c947c1413111828bb58d12f0
- MD5 1b3c196b3a42e6c4adb7ba2a78770333
- SHA1 aadaddb91db1af7c34a1d64d79ca6e8d5a634aca
- SHA512 84c0bc8c8d9dca0c32e927cd4781e960e4b7bcbf34c3687ace88d12d7fc8dfa37e3406b854afcdbc8169f8a51636fa5ed6707089df812953157acac6177a1fad
- SSDEEP 12288:id7RH6JDCY6G0SRbvLuDHFG/lAHORmVrbiGSjJ6DEbJVTnZ9gJt8uu:McJDCY6G3RDLicQ9aTnZ9gJt8uu
- TLSH T15C552A8266CB5CFADE922BB865DB133AA735FD60CF7A4B6B5604C1306C036D1AD1E740
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
crypt32
CryptStringToBinaryA
gdi32
BitBlt
CreateCompatibleDC
CreateDIBSection
CreateEllipticRgn
CreateFontA
CreateFontW
CreatePen
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
LineTo
MoveToEx
PolyBezier
Rectangle
SelectClipRgn
SelectObject
SetBkColor
SetBkMode
SetTextColor
StretchBlt
TextOutA
kernel32
AddAtomA
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateFileW
CreateMutexA
CreateSemaphoreA
CreateThread
CreateToolhelp32Snapshot
DeleteAtom
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FindAtomA
FormatMessageA
GetAtomNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetStartupInfoA
GetSystemTimeAsFileTime
GetTempPathA
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
__C_specific_handler
msimg32
AlphaBlend
GradientFill
msvcrt
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_close
_commode
_endthreadex
_errno
_fmode
_initterm
_memccpy
_onexit
_read
_setjmp
_strdup
_stricmp
_time64
_ultoa
_vscprintf
_vsnprintf
_write
abort
calloc
exit
fprintf
fputc
fputs
fputwc
free
fwprintf
fwrite
localeconv
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
printf
rand
realloc
signal
srand
strcmp
strerror
strlen
strncmp
vfprintf
wcslen
shlwapi
SHCreateMemStream
user32
BeginPaint
ChangeDisplaySettingsA
CreateWindowExA
DefWindowProcA
DestroyWindow
DrawTextW
EndPaint
EnumWindows
FillRect
FindWindowExW
FindWindowW
GetClientRect
GetCursorPos
GetDC
GetDesktopWindow
GetSystemMetrics
GetWindowLongW
GetWindowRect
InvalidateRect
MessageBoxA
PostQuitMessage
ReleaseDC
SendMessageW
SetCursor
SetCursorPos
SetWindowPos
ShowWindow
SystemParametersInfoA
UpdateLayeredWindow
winmm
waveOutClose
waveOutOpen
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite
Name
.text
Size
236KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
752B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
108KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/92
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ