Release.rar
- SHA256 8f57de4b1a86a5a8b1fca189d3a7e21c3655af3e5d897cdc1af3bbd1a986a51a
Static task
static1
1 signatures
General
- Target Release.rar
- Size 987KB
- Sample260808-c3rq5sydlf
- SHA256 8f57de4b1a86a5a8b1fca189d3a7e21c3655af3e5d897cdc1af3bbd1a986a51a
- MD5 942153eb01c044257504dbb7343650a4
- SHA1 807c9ed244dacaa9b8f60fb290c7c12176ec889d
- SHA512 88fabf902d5292810b545c9d9b6e2169164f97b39deec4adbd308e97d2e66cf6b2b3b94ef012f2480fa4c7a96cf48ba3eee05251e9be099f4e70ece801bfaf2a
- SSDEEP 24576:65zOPNu2e80l5lmv0OZjtWTRrV4lff8OgPs8XMOy1E9Btmr:6Nr5lmv0JRrV4lfUfVMIBtmr
- TLSH T10D2533B785034C7882E11993D738EA05AE2130A5BDCB850EB7E15B97B50217E29BCC7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/emulator.exe
File Explorer
-
Release.rar.rar 987KB
-
Release/emulator.exe.exe 369KB
-
Release/emulator.log13KB
-
Release/emulator.pdb4.2MB
-
Release/output.txt92KB
-
Release/server.pfx85B
Release/emulator.exe
- IMPHASH 1de2d53eab5039717c8046dad37cca0c
- SHA256 1ba720712beb127607dec5669d4299c64945a0e4ac4b32e90b25c3b40ff6f682
- MD5 d16671896180075e838a58c8eecc8c8b
- SHA1 243bfb829dfdddaa66b7a768ad6a491536f4d3d8
- SHA512 82f4d171f2a3c5b7ea2a54ab46815753cf1cff7c09788e3e05e93e28fd47ac3983153a93c06b154d4bae272906319e51041dbfecaa1b745c70eba265ceda41e1
- SSDEEP 6144:d5o9svvMh3ubfgNADDZ7nE+th+augoA2m/Uf+F9+IJGRGUiwccU18NtqIMWjrlDH:ceHMVi7Saum/h7JSGU9ccUWqHWjxDbr3
- TLSH T1DC846B2EDB0509B0D166D178CE535803FB727C8D4371EEEB1BE49EA21F165D4AA3EA10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
256836
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\kazim\Desktop\vanguard emulator\x64\Release\emulator.pdb
kernel32
CreateFileA
Process32FirstW
CloseHandle
FillConsoleOutputAttribute
Beep
CreateFileMappingA
LocalFree
GetConsoleWindow
GetSystemTime
SetConsoleCursorPosition
SetConsoleTitleW
ConnectNamedPipe
FlushFileBuffers
GetExitCodeProcess
GetModuleFileNameA
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
Process32NextW
GetLastError
GetTickCount64
Sleep
CreateToolhelp32Snapshot
CreateFileW
CreateMutexA
FindClose
CreateNamedPipeW
GetModuleFileNameW
QueryPerformanceCounter
GetModuleHandleW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FillConsoleOutputCharacterA
SetConsoleCtrlHandler
FindFirstFileW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
TerminateProcess
DeviceIoControl
OutputDebugStringA
WriteFile
GetStdHandle
FindNextFileW
ReadFile
user32
SetWindowPos
GetWindowRect
GetAsyncKeyState
advapi32
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
shell32
ShellExecuteA
bcrypt
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptDestroyHash
BCryptGenRandom
BCryptImportKeyPair
BCryptGenerateKeyPair
BCryptDecrypt
BCryptFinalizeKeyPair
BCryptGetProperty
BCryptDestroyKey
BCryptEncrypt
BCryptOpenAlgorithmProvider
BCryptExportKey
BCryptHashData
BCryptSetProperty
BCryptCreateHash
BCryptGenerateSymmetricKey
crypt32
CryptStringToBinaryA
PFXImportCertStore
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptBinaryToStringA
PFXExportCertStore
CertCloseStore
CertStrToNameA
CryptImportPublicKeyInfoEx2
CertFindCertificateInStore
CertOpenStore
CryptDecodeObjectEx
msvcp140
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Strxfrm
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?id@?$collate@D@std@@2V0locale@2@A
_Mtx_lock
_Strcoll
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
_Mtx_unlock
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
winhttp
WinHttpQueryDataAvailable
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpReadData
WinHttpQueryHeaders
WinHttpOpen
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpConnect
ws2_32
htons
setsockopt
htonl
recv
connect
socket
accept
send
WSAStartup
inet_pton
listen
closesocket
bind
WSAGetLastError
secur32
AcquireCredentialsHandleW
DeleteSecurityContext
AcceptSecurityContext
EncryptMessage
QueryContextAttributesW
FreeCredentialsHandle
DecryptMessage
InitializeSecurityContextW
FreeContextBuffer
vcruntime140_1
__CxxFrameHandler4
vcruntime140
wcsrchr
strchr
__std_terminate
__std_exception_copy
memcmp
__current_exception
__C_specific_handler
_CxxThrowException
__current_exception_context
memmove
memcpy
memset
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
fflush
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
fclose
_set_fmode
setvbuf
fgetpos
__stdio_common_vsprintf
fwrite
fgetc
__stdio_common_vswprintf_s
__p__commode
__stdio_common_vsprintf_s
fputc
api-ms-win-crt-heap-l1-1-0
_callnewh
realloc
free
malloc
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
terminate
system
_beginthreadex
_register_thread_local_exe_atexit_callback
_errno
_c_exit
__p___argv
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_onexit_table
_set_app_type
_invoke_watson
_configure_narrow_argv
_initialize_narrow_environment
_cexit
_register_onexit_function
_crt_atexit
_seh_filter_exe
api-ms-win-crt-string-l1-1-0
_wcsicmp
tolower
strcpy_s
wcscat_s
wcscpy_s
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
270KB
Virtual Size
269KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=31, id=261, version=35207,
count=6, id=257, version=35207,
count=19, id=257, version=33145,
count=324, id=1, productName=Unmarked objects,
count=1, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
Release/emulator.log
- SHA256 8a67fb436b850008d7c6a468731d9ce34287d793e9627822265ac7f5fd53ae54
- MD5 fd5bbf26cd5e61795417bb18bd726463
- SHA1 3fa0fd555af266c2b4022f9a1fc3f9dfaacfd036
- SHA512 dd3f3ac6cdf80ff57f29a4f63d5eae0dfaa54cf0099ca1642f5d728d8a4ddf560d1c5a1046b86fdc38d7b43958159232990e9a08db8dc756603584aed29c6b96
- SSDEEP 192:vd1N2DGz3K8oVmwuBtXRLb4W9CVvIvMv+nmr6yWW1EWGKasNQ7m3g:vdCDG+CdQgrV
- TLSH T12952E18410B3BAE6D2E0B0FC922567E8756FD6266EC5DDCF363D1008865FD08E2B65A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/emulator.pdb
- SHA256 e2cc50dacb12e39a6523f0baace2b3711a562700f5b624b4ea45e78fc2652cad
- MD5 83653cb79349084daa05e63afd81493a
- SHA1 2cedf427a35b16ee1e58b2540e663384494fd2d3
- SHA512 bd46e8dc1eeb0ef1461c51262e33472e8e58e66cd1dc8f1285264ae101c9eae17f44b5ae199b9ebce0fb87a2d3c91cb6b71535a6044a52ffcebb84f631847138
- SSDEEP 98304:HfwomQBeMIN+r7mQhjqjVTwTpIlgOQhGP1MZZg9ayYlv+aD+:wMZ
- TLSH T198160952A6558E23C86F1736D09F131C23649A06EFFF6BCBA80EA3154DD6329CE6F540
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/output.txt
- SHA256 464c76596c3610f8de1a83644641ed952c6323b1187e525b983bad2db65566d2
- MD5 127e04ebb25d8d4cdbb5068263a98c23
- SHA1 e34100afe09e69c84d0d8ff2bb691bf75bbd9c38
- SHA512 a3c4a1bfc33003682772626ec2bd7706768eff46acc11f0e469a4932cb1f26e3ab03e0a2fbc81593608f0505e53894b38311c2c3ee3a6701ef55959e642df590
- SSDEEP 1536:xo+HVbgacjaccqTzNifku3C5uwBpdCl8sl8lfzQdix8KAAe19MXZ+ETynDLxueCm:xo+HVbgacjaX+zNifkMC9BpdClXl8lfK
- TLSH T1769371B04BBCE5BAE7084453FF17DE683F29AA07E11F2E26151837402A6E75F2915B03
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/server.pfx
- SHA256 ebb2e38da29ed42f4e269ff4d4c4d46e675949f3d8fef334427be4253a2ab105
- MD5 acb5874db74b59c825247c08cc6e116a
- SHA1 9bf205a01a8e167988f2f71ef40a1d71aaa00167
- SHA512 a875354763b0861c25b84edab8f1a64c8557b692f61e6d86791c571e00b16cc9c97bb18eba2bdf165326ea389f18d416183ccdbd99872e555f382796e6c2a8d7
- TLSH T115A01210423B21A541684ED520E44224028957800C10D5A2F8708588C8D020D2348A85
- MD5 SHA1 SHA512 TLSH