1a7d375e01b4fbf4649bd2abd2f2d614aa8edce6b790efeb82261d0285189614

Sharing

Copy URL Twitter E-mail

General

Target
1a7d375e01b4fbf4649bd2abd2f2d614aa8edce6b790efeb82261d0285189614
Size 805KB
Sample260806-e7ecqax1e1
SHA256 1a7d375e01b4fbf4649bd2abd2f2d614aa8edce6b790efeb82261d0285189614
MD5 2c92d5abcb3be0147a27c06d21751878
SHA1 9bdd4ecf7853f14f71ac888b4caa83970d17797f
SHA512 04e997de518f530c547e612fcf2e108f7233c2c258f0e51a740663cf093a6a1153e27080b981fadbbc3ce7a66e1e4d128f45931f479f2e353ea4fb863ca42394
SSDEEP 12288:AYMFmIZk/mcgGP7mPWwRo+8Mn/6cM3LMG4Gi:UZkx9PCvRo+8MHKs
TLSH
T117052B56A6FD4194F5F7D7348AB64343EB72BC565B38D2CF4210A62D1E36AE08E34322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a7d375e01b4fbf4649bd2abd2f2d614aa8edce6b790efeb82261d0285189614

File Explorer

1a7d375e01b4fbf4649bd2abd2f2d614aa8edce6b790efeb82261d0285189614

.exe 805KB

1a7d375e01b4fbf4649bd2abd2f2d614aa8edce6b790efeb82261d0285189614

IMPHASH 2b3f46910142c2aeaf8bc92b07830ebb
SHA256 1a7d375e01b4fbf4649bd2abd2f2d614aa8edce6b790efeb82261d0285189614
MD5 2c92d5abcb3be0147a27c06d21751878
SHA1 9bdd4ecf7853f14f71ac888b4caa83970d17797f
SHA512 04e997de518f530c547e612fcf2e108f7233c2c258f0e51a740663cf093a6a1153e27080b981fadbbc3ce7a66e1e4d128f45931f479f2e353ea4fb863ca42394
SSDEEP 12288:AYMFmIZk/mcgGP7mPWwRo+8Mn/6cM3LMG4Gi:UZkx9PCvRo+8MHKs
TLSH
T117052B56A6FD4194F5F7D7348AB64343EB72BC565B38D2CF4210A62D1E36AE08E34322
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

330976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\MouriNaruto\NanaZip\Output\Binaries\Release\x64\NanaZip.Core.Windows.pdb

shlwapi

SHAutoComplete

kernel32

FormatMessageW LocalFree GlobalAlloc GlobalFree GetProcAddress GetModuleHandleW GetSystemDirectoryW GetVersion CreateDirectoryW HeapFree SetLastError CreateFileW CreateEventW CloseHandle HeapAlloc GetProcessHeap QueryPerformanceCounter MultiByteToWideChar WideCharToMultiByte GetCurrentThread GetCurrentThreadId MulDiv GetProcessId GetCurrentDirectoryW DeleteFileW RemoveDirectoryW SetFileAttributesW SetFileTime GetCurrentProcessId MoveFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetLogicalDriveStringsW FindFirstStreamW FindNextStreamW GetFileSize SetEndOfFile SetFilePointer GlobalMemoryStatusEx GetSystemInfo GetModuleHandleA GetProcessAffinityMask FileTimeToSystemTime InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateSemaphoreW ResumeThread VirtualAlloc VirtualFree GetSystemTimeAsFileTime IsProcessorFeaturePresent GetProcessMitigationPolicy SetProcessMitigationPolicy SetThreadInformation VirtualProtect VirtualAllocEx VirtualProtectEx SystemTimeToFileTime SystemTimeToTzSpecificLocalTimeEx TzSpecificLocalTimeToSystemTimeEx SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualQuery SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleFileNameW GlobalUnlock GlobalLock GetTickCount Sleep WaitForMultipleObjects LoadLibraryExW GetCurrentProcess SetPriorityClass DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CompareFileTime GetLastError GetFileInformationByHandle WriteFile GetStdHandle ReadFile ExitProcess GetCommandLineW GetStartupInfoW InitializeSListHead

user32

GetSysColorBrush FillRect FrameRect MapWindowPoints GetWindowLongW SetWindowLongW EnumChildWindows GetClassNameW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo GetDpiForWindow GetWindowModuleFileNameW GetMenuBarInfo AttachThreadInput SetWindowPos SetActiveWindow GetForegroundWindow SetForegroundWindow GetWindowThreadProcessId CharUpperW GetSysColor GetClientRect ReleaseDC GetWindowDC GetMenuItemInfoW GetMenu GetWindowTextLengthW GetWindowTextW LoadStringW MonitorFromWindow SetWindowLongPtrW GetWindowLongPtrW GetMonitorInfoA MapDialogRect SystemParametersInfoW DialogBoxParamW GetComboBoxInfo OpenClipboard CloseClipboard EmptyClipboard SetClipboardData SetTimer LoadIconW LoadCursorW SetCursor EnableWindow InvalidateRect GetDlgItem SetFocus MoveWindow SetDlgItemTextW ShowWindow KillTimer GetParent IsDlgButtonChecked CheckDlgButton DestroyIcon GetWindowRect ScreenToClient SetWindowTextW EndDialog SendMessageW GetFocus PostMessageW GetKeyState OffsetRect

gdi32

SetTextColor SetBkColor GetStockObject CreateSolidBrush

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHCreateItemFromParsingName SHGetFileInfoW SHGetPathFromIDListW SHGetIDListFromObject

ole32

CoInitialize CoUninitialize CoCreateInstance CoTaskMemFree OleInitialize

oleaut32

VariantClear SysAllocStringLen SysFreeString SysStringLen SysAllocString

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea DwmGetWindowAttribute

uxtheme

GetWindowTheme DrawThemeTextEx OpenThemeData CloseThemeData DrawThemeBackground ord47 DrawThemeText GetThemeColor SetWindowTheme

bcrypt

BCryptDuplicateHash BCryptDestroyHash BCryptCreateHash BCryptGetProperty BCryptOpenAlgorithmProvider BCryptFinishHash BCryptHashData

ucrtbase

__current_exception __current_exception_context memcmp isblank _beginthreadex wcsrchr wcslen wcscmp free malloc strncpy_s _stricmp _callnewh _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate _seh_filter_exe _set_app_type __setusermatherr _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _set_fmode _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode __C_specific_handler _purecall __std_exception_copy __std_exception_destroy __std_terminate __CxxFrameHandler4 memmove memset memcpy _CxxThrowException wcsstr _wcsicmp

comctl32

ord413 ord410 ord345

Name

.text

Size

337KB

Virtual Size

337KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

342KB

Virtual Size

341KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1a7d375e01b4fbf4649bd2abd2f2d614aa8edce6b790efeb82261d0285189614

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

dwmapi

uxtheme

bcrypt

ucrtbase

comctl32

generic