4618a7e89b361973eec2535a40b052cb3a80b97c94a7f94538bd329fcf8e3fec

Sharing

Copy URL Twitter E-mail

General

Target
4618a7e89b361973eec2535a40b052cb3a80b97c94a7f94538bd329fcf8e3fec
Size 2.3MB
Sample260807-lrd6casapf
SHA256 4618a7e89b361973eec2535a40b052cb3a80b97c94a7f94538bd329fcf8e3fec
MD5 82dd3fc1bde67c99c3f3b2f2513b3ea5
SHA1 d556cb0bfc49201c162b578ecd88392d17256553
SHA512 55c7a2f8186995da8ddfd9b39c72d1e09731e7cb72c42753908b9fe3a595ede16ec68ba25072b79f1b983be5c75d47d8ca4e970f29b3fd1919be731bdfe7247b
SSDEEP 49152:UXCfx2Rk7vvICut31DW0ZxiPcjP35L6jozub0ZVqOsfqU:OCfx2y7A1ZMbyqOT
TLSH
T105B57E1776AD01A8E077D17DC9574A07EAF278065331EBDF02E407AA1F23BE14A7A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4618a7e89b361973eec2535a40b052cb3a80b97c94a7f94538bd329fcf8e3fec

File Explorer

4618a7e89b361973eec2535a40b052cb3a80b97c94a7f94538bd329fcf8e3fec

.dll 2.3MB

4618a7e89b361973eec2535a40b052cb3a80b97c94a7f94538bd329fcf8e3fec

IMPHASH 60be0218da48bb13dfbf20d52b591c1b
SHA256 4618a7e89b361973eec2535a40b052cb3a80b97c94a7f94538bd329fcf8e3fec
MD5 82dd3fc1bde67c99c3f3b2f2513b3ea5
SHA1 d556cb0bfc49201c162b578ecd88392d17256553
SHA512 55c7a2f8186995da8ddfd9b39c72d1e09731e7cb72c42753908b9fe3a595ede16ec68ba25072b79f1b983be5c75d47d8ca4e970f29b3fd1919be731bdfe7247b
SSDEEP 49152:UXCfx2Rk7vvICut31DW0ZxiPcjP35L6jozub0ZVqOsfqU:OCfx2y7A1ZMbyqOT
TLSH
T105B57E1776AD01A8E077D17DC9574A07EAF278065331EBDF02E407AA1F23BE14A7A721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1213892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\jenkins\workspace\ThunderPC\ThudnerPC_2025_AP_CI_Channel\thunder_pc\cppsrc\other\symbols\x64\Release\InstallEntry.pdb

libcurl

curl_slist_append curl_easy_perform curl_easy_cleanup curl_global_cleanup curl_easy_setopt curl_easy_init curl_easy_getinfo curl_global_init

libcrypto-3-x64

RAND_bytes

wininet

InternetCrackUrlW InternetOpenA InternetOpenUrlA HttpSendRequestW HttpOpenRequestW InternetSetOptionW InternetReadFile InternetConnectW InternetCloseHandle InternetOpenW HttpQueryInfoW

ws2_32

WSACleanup gethostbyname gethostname WSAStartup

kernel32

SetEvent CreateEventW WaitForMultipleObjects GetModuleFileNameW GetModuleHandleW VerSetConditionMask GetEnvironmentVariableW CreateMutexW OpenMutexW OpenEventW Sleep TerminateProcess OpenProcess GetPrivateProfileStringW VerifyVersionInfoW GetTickCount GetExitCodeProcess ReadFile CreateThread GetModuleFileNameA GetCurrentProcessId GetCurrentThread GetStartupInfoW GetVersionExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetSystemDirectoryW GetCommandLineA CreateDirectoryA DeleteFileA FindFirstFileA FindNextFileA GetLocalTime SystemTimeToFileTime GetStdHandle FindFirstFileExW GetFullPathNameW GetTempPathA GetWindowsDirectoryA GetComputerNameA GetConsoleScreenBufferInfo SetConsoleTextAttribute OutputDebugStringA RtlCaptureStackBackTrace GetACP MulDiv GlobalUnlock GlobalLock lstrlenW FreeResource ExitProcess CreateDirectoryW GetFileType SetFileTime DuplicateHandle DosDateTimeToFileTime FormatMessageW InitializeCriticalSectionAndSpinCount GlobalAlloc lstrcpyW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetFileAttributesA lstrcatA GetPrivateProfileStringA WritePrivateProfileStringA CreateFileA GetVolumeInformationA DeviceIoControl SetPriorityClass GetVersionExA FileTimeToSystemTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW GetModuleHandleExW WaitForSingleObject SetFileAttributesW ExitThread FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedFlushSList RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ResetEvent GetStringTypeW GetLocaleInfoEx GetCPInfo CompareStringEx CreateSymbolicLinkW GetFileInformationByHandleEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetTickCount64 GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable InitOnceExecuteOnce FlsFree FlsSetValue FlsGetValue FlsAlloc SetFileInformationByHandle LCMapStringEx InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared TryEnterCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetNativeSystemInfo GetExitCodeThread SwitchToThread WaitForSingleObjectEx QueryPerformanceFrequency QueryPerformanceCounter FormatMessageA LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent InitializeCriticalSection CopyFileW MoveFileExW CloseHandle WriteFile FreeLibraryAndExitThread RemoveDirectoryW GetFileSize GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW LoadLibraryW LoadLibraryExW GetProcAddress GetCurrentThreadId SetLastError GetCurrentDirectoryW SetCurrentDirectoryW MultiByteToWideChar FindResourceW SizeofResource LockResource LoadResource FindResourceExW IsWow64Process CreateProcessW GetCurrentProcess WideCharToMultiByte SystemTimeToTzSpecificLocalTime LocalFree GetSystemTime LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree RtlUnwind HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer SetEndOfFile GetCommandLineW SetConsoleCtrlHandler SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetTimeZoneInformation FlushFileBuffers GetFileSizeEx GetFileAttributesExW CreatePipe IsValidCodePage GetOEMCP GetEnvironmentStringsW SetFilePointer FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW ResumeThread

user32

GetWindowTextW SetWindowTextW SystemParametersInfoW ClientToScreen GetCaretPos GetWindowTextLengthW IsWindowEnabled CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo SetForegroundWindow GetKeyboardLayout GetKeyNameTextW ScreenToClient GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW PostMessageW UnregisterClassW MapVirtualKeyExW ShowCaret HideCaret TrackPopupMenu AppendMenuW EnableMenuItem DestroyMenu CreatePopupMenu SetRect CreateWindowExW IsWindow DestroyWindow SetTimer KillTimer GetWindowLongPtrW SetWindowLongPtrW LoadCursorW wsprintfW PostThreadMessageW SetWindowPos IsWindowVisible IsIconic BringWindowToTop GetActiveWindow SetWindowRgn GetWindowRect MessageBoxW GetWindowLongW SetWindowLongW GetDesktopWindow GetParent FindWindowW GetWindowThreadProcessId GetMessageW TranslateMessage DispatchMessageW EndDialog SendMessageW PeekMessageW SetCursor InflateRect UnionRect OffsetRect CharNextW GetDC ReleaseDC MonitorFromPoint MonitorFromWindow IsZoomed SetFocus GetFocus GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect GetCursorPos CreateCaret MapWindowPoints GetCaretBlinkTime FillRect DrawTextW CharPrevW LoadIconW LoadStringW GetWindowRgn MoveWindow UpdateLayeredWindow GetMonitorInfoW AdjustWindowRectEx GetPropW SetPropW GetMenu GetSystemMetrics EnableWindow ShowWindow RegisterClassW PostQuitMessage LoadImageW GetWindow PtInRect IsRectEmpty IntersectRect GetSysColor SetCaretPos

gdi32

CreateSolidBrush CreateRectRgnIndirect CreatePenIndirect CombineRgn CreateDIBSection PtInRegion CreateRectRgn SetWindowOrgEx GetObjectW GetTextMetricsW PlayEnhMetaFile GetCharABCWidthsW CloseEnhMetaFile SelectObject SaveDC RestoreDC GetStockObject DeleteDC CreatePen CreateFontIndirectW CreateDIBitmap CreateCompatibleDC CreateCompatibleBitmap BitBlt GetDeviceCaps DeleteObject CreateRoundRectRgn GetClipBox GetTextExtentPoint32W LineTo RoundRect SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetTextColor GetObjectA MoveToEx TextOutW GdiFlush EnumFontFamiliesExW GetBitmapBits SetBitmapBits SetStretchBltMode CreateEnhMetaFileW GetEnhMetaFileHeader

shell32

SHGetSpecialFolderPathA Shell_NotifyIconW DragQueryFileW SHGetFolderPathA SHGetFolderPathW SHCreateDirectoryExW ShellExecuteW CommandLineToArgvW ShellExecuteExW SHBrowseForFolderW SHGetSpecialFolderPathW SHGetPathFromIDListW

ole32

CoCreateInstance OleLockRunning CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal ReleaseStgMedium DoDragDrop RegisterDragDrop CoTaskMemFree OleDuplicateData

oleaut32

VariantInit VariantClear SysFreeString VariantChangeType GetErrorInfo SysAllocString SetErrorInfo CreateErrorInfo

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW TraceEvent RegisterTraceGuidsW UnregisterTraceGuids GetTraceLoggerHandle GetTraceEnableLevel ConvertStringSidToSidW LookupPrivilegeValueW SetTokenInformation GetLengthSid DuplicateTokenEx AdjustTokenPrivileges OpenThreadToken OpenProcessToken CreateProcessAsUserW RegOpenKeyW

shlwapi

SHSetValueW PathAppendW PathCombineA SHGetValueW PathMatchSpecA SHDeleteValueW SHDeleteKeyW PathCombineW PathIsRootW PathIsDirectoryW StrCmpIW PathRemoveFileSpecW PathFindFileNameW PathFileExistsW StrCmpW

comctl32

InitCommonControlsEx _TrackMouseEvent ord17

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

gdiplus

GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawImageRectRect GdipFillRectangleI GdipDrawRectangleI GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipSetImageAttributesWrapMode GdipSetImageAttributesColorKeys GdipSetStringFormatTrimming GdipDisposeImageAttributes GdipCreateImageAttributes GdipGetImageHeight GdipDeleteStringFormat GdipDisposeImage GdipCloneImage GdipLoadImageFromFileICM GdipLoadImageFromFile GdipSetPenMode GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipGetImageWidth GdipSetStringFormatLineAlign GdipGetPropertyItem GdipDrawImageRectI GdipSetImageAttributesColorMatrix

userenv

UnloadUserProfile

iphlpapi

GetAdaptersInfo

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

526KB

Virtual Size

526KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4618a7e89b361973eec2535a40b052cb3a80b97c94a7f94538bd329fcf8e3fec

libcurl

libcrypto-3-x64

wininet

ws2_32

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

shlwapi

comctl32

imm32

gdiplus

userenv

iphlpapi

generic