00219d140ebcc793e28c1d4894730a278bbd471f107f0ef4c2bd4deb0e42a2e7

Sharing

Copy URL Twitter E-mail

General

Target
00219d140ebcc793e28c1d4894730a278bbd471f107f0ef4c2bd4deb0e42a2e7
Size 4.6MB
Sample260807-ze9clstblh
SHA256 00219d140ebcc793e28c1d4894730a278bbd471f107f0ef4c2bd4deb0e42a2e7
MD5 9e796d5bed3ce0bd3c1286946f4e946f
SHA1 337e4d0c0d5d761b2bdb3c3e3098e8b71a084b3d
SHA512 bf08eb33b4c5e4c33cb02270d9dccc6a7abf1684865f1f4ccbc14fd9668401280bc044ec511d9733def20f54c70807d37f914bb77708242bc8031bab4f58fc91
SSDEEP 98304:FxmHKTyGKC2l8vApaCfL2XYHUBnscYfcpu/UV1dWeUOdWLgAsu4Pwd:FxmHKTyGKx2vALfLIYHUicscYH
TLSH
T1ED26BF12BD40C071DAC2027291BDBBBA9ABC9634073A74C793D819796E30DD27B3675B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00219d140ebcc793e28c1d4894730a278bbd471f107f0ef4c2bd4deb0e42a2e7

File Explorer

00219d140ebcc793e28c1d4894730a278bbd471f107f0ef4c2bd4deb0e42a2e7

.exe 4.6MB

00219d140ebcc793e28c1d4894730a278bbd471f107f0ef4c2bd4deb0e42a2e7

IMPHASH 8f7ecc7681006f3a852aef932e0d5a13
SHA256 00219d140ebcc793e28c1d4894730a278bbd471f107f0ef4c2bd4deb0e42a2e7
MD5 9e796d5bed3ce0bd3c1286946f4e946f
SHA1 337e4d0c0d5d761b2bdb3c3e3098e8b71a084b3d
SHA512 bf08eb33b4c5e4c33cb02270d9dccc6a7abf1684865f1f4ccbc14fd9668401280bc044ec511d9733def20f54c70807d37f914bb77708242bc8031bab4f58fc91
SSDEEP 98304:FxmHKTyGKC2l8vApaCfL2XYHUBnscYfcpu/UV1dWeUOdWLgAsu4Pwd:FxmHKTyGKx2vALfLIYHUicscYH
TLSH
T1ED26BF12BD40C071DAC2027291BDBBBA9ABC9634073A74C793D819796E30DD27B3675B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3158443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\AngelLove\Code\al1\sources\branches\Global\0.0.0.0_V1\midage\exe\Release\midage.pdb

webview2loader

CreateCoreWebView2EnvironmentWithOptions

ws2_32

gethostname WSAStartup WSACleanup closesocket connect ioctlsocket htons inet_addr recv inet_ntop freeaddrinfo getaddrinfo send setsockopt shutdown socket gethostbyname WSAGetLastError WSAAsyncSelect WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAWaitForMultipleEvents

steam_api

SteamAPI_UnregisterCallback SteamAPI_RegisterCallback SteamInternal_FindOrCreateUserInterface SteamAPI_GetHSteamUser SteamAPI_RunCallbacks SteamInternal_SteamAPI_Init SteamAPI_Shutdown SteamInternal_ContextInit

kernel32

GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetProcAddress LoadLibraryA FreeLibrary CreateToolhelp32Snapshot Module32First Module32Next FindClose FindFirstFileA FindNextFileA CreateDirectoryA DeleteFileA SetFileAttributesA GetVolumeInformationA SetEvent OpenEventA GlobalMemoryStatusEx GetSystemInfo MapViewOfFile CreateFileMappingA GetFileSize ReadFile SetFilePointer WriteFile MoveFileA MoveFileExA RemoveDirectoryA GetSystemDirectoryA GetWindowsDirectoryA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection CreateThread TerminateThread SetEndOfFile GetSystemTime FileTimeToDosDateTime SystemTimeToFileTime IsValidCodePage AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree GetFullPathNameW GetDiskFreeSpaceW LockFile GetFullPathNameA UnlockFileEx GetTempPathW CreateMutexW CreateFileW UnmapViewOfFile HeapValidate HeapSize FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile WaitForSingleObjectEx DeleteFileW HeapReAlloc LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GetProcessHeap GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW FlushFileBuffers WriteConsoleW GetConsoleMode WaitForSingleObject GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW CreateFileA CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc CreateMutexA GetStdHandle GetModuleFileNameW FreeLibraryAndExitThread ResumeThread GetModuleHandleExW ExitProcess GetCommandLineW GetCommandLineA LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwind RaiseException VirtualFree VirtualAlloc ExitThread GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetVersionExA InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent CloseHandle WideCharToMultiByte MultiByteToWideChar GetModuleHandleA GetFileAttributesW GetTimeZoneInformation FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileTime IsBadReadPtr SetUnhandledExceptionFilter QueryPerformanceFrequency QueryPerformanceCounter GetTickCount GetFileAttributesA GetCurrentDirectoryA SetCurrentDirectoryA ReleaseMutex OutputDebugStringA DeleteCriticalSection InitializeCriticalSectionEx GetLastError DecodePointer GetFileSizeEx GetTempPathA SetFilePointerEx ReadConsoleW SetStdHandle SetConsoleCtrlHandler FindFirstFileExW FindNextFileW GetACP GetOEMCP GetEnvironmentStringsW TerminateProcess UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo CompareStringEx GetStringTypeW LCMapStringEx WritePrivateProfileStringA LCMapStringW GetLocaleInfoEx EncodePointer FreeEnvironmentStringsW SetEnvironmentVariableW CreateSymbolicLinkW GetFileInformationByHandleEx GetModuleHandleW CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetTickCount64 GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce SetFileInformationByHandle GetPrivateProfileIntA GetLocalTime GetCurrentThread Sleep GetConsoleOutputCP

user32

GetMonitorInfoA MonitorFromWindow EnumDisplaySettingsA ChangeDisplaySettingsA ClientToScreen AdjustWindowRectEx GetMenu SetClipboardData GetClipboardData EmptyClipboard TranslateMessage DispatchMessageA PeekMessageA GetKeyboardLayoutList GetMessageA RegisterDeviceNotificationA UnregisterDeviceNotification UnregisterClassA ShowCursor MessageBoxA GetDC GetWindowTextA SetWindowTextA SetForegroundWindow RegisterClassA PostQuitMessage PostMessageA ActivateKeyboardLayout GetKeyboardLayout OpenClipboard WaitMessage SetActiveWindow ReleaseDC SystemParametersInfoA SetRect FillRect wsprintfA EnumDisplayDevicesA CreateWindowExA RegisterClassExA GetParent ScreenToClient InvalidateRect EndPaint BeginPaint GetDlgItem SendMessageA DrawEdge SetProcessDPIAware LoadIconA GetDesktopWindow GetForegroundWindow LoadCursorA SetWindowLongA GetWindowLongA GetCursorPos SetCursor SetCursorPos GetWindowRect GetClientRect TrackMouseEvent UpdateWindow GetSystemMetrics EnableWindow ReleaseCapture SetCapture SetFocus SetWindowPos ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW DefWindowProcW DefWindowProcA CloseClipboard

gdi32

GetTextFaceA SetBrushOrgEx TextOutA GetObjectA CreateDIBSection GetTextMetricsA SetStretchBltMode StretchBlt SetBkColor RemoveFontResourceExA AddFontResourceExA GetTextExtentPoint32A GetDeviceCaps GetBitmapBits CreateFontIndirectA SetDIBits SelectObject DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt GetStockObject SetTextColor

comdlg32

GetOpenFileNameA

advapi32

GetUserNameA RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA

shell32

SHFileOperationW ShellExecuteExA ShellExecuteA SHGetFolderPathW

ole32

CoSetProxyBlanket CoUninitialize CoCreateInstance CoInitialize CoTaskMemFree

iphlpapi

GetAdaptersAddresses

d2d1

ord1

dwrite

DWriteCreateFactory

vcomp140

omp_set_num_threads _vcomp_for_static_end _vcomp_for_static_simple_init _vcomp_fork

dsound

ord11

dinput8

DirectInput8Create

imm32

ImmGetCompositionStringW ImmGetContext ImmIsIME ImmReleaseContext

oleaut32

SysFreeString SysAllocString

generic

count=2, id=257, version=35207,

count=59, id=259, version=33145,

count=205, id=261, version=33145,

count=1, id=253, version=35207,

count=33, id=259, version=35207,

count=20, id=260, version=35207,

count=93, id=261, version=35207,

count=38, id=260, version=33145,

count=1, id=262, version=33145,

count=2, id=257, version=34444,

count=4, id=265, version=35228,

count=4, id=261, version=35225,

count=5, id=261, version=35223,

count=2, id=260, version=35217,

count=120, id=260, version=34808,

count=9, id=261, version=34808,

count=1, id=260, version=35228,

count=3, id=5, version=8447,

count=13, id=261, version=35222,

count=4, id=261, version=35227,

count=7, id=260, version=35227,

count=2, id=28, version=8830,

count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=4, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=26, id=257, version=33145,

count=3, productName=Unmarked objects (old),

count=363, id=1, productName=Unmarked objects,

count=159, id=261, version=35228,

count=1, id=255, version=35228,

count=1, id=151,

count=1, id=258, version=35228,