0066ae0e9b55b9d6a3c5bfd85cded7a4cd16181e1afc5b7b5efe0b340a073dac

Sharing

Copy URL Twitter E-mail

General

Target
0066ae0e9b55b9d6a3c5bfd85cded7a4cd16181e1afc5b7b5efe0b340a073dac
Size 292KB
Sample260809-s86p9abb74
SHA256 0066ae0e9b55b9d6a3c5bfd85cded7a4cd16181e1afc5b7b5efe0b340a073dac
MD5 b979f74b3c94221b040639626f78ea29
SHA1 66e69fda382e6d653806cbbda6d6c9ad2b18826a
SHA512 e1ede01ffbcd96cb6ad4a86f9e5c440f3a1a9e2225186b9c7eff2ee450a9be33ef40a8abe1111264e2c4264b94fa3b17825711601c453110361818dbae4ef419
SSDEEP 3072:jWllcg0uYsaz6DzIOumxsO7EJ92LE/lZxbEEodiuE7TpchPP14RfpsTd95jvvTtR:jWllXxvIDesvJ9U014/kOhn5x5
TLSH
T16B547C16B6A410BDE167C67CC9538945EBF2BC4307A1EADB07904EAA3F237D05A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0066ae0e9b55b9d6a3c5bfd85cded7a4cd16181e1afc5b7b5efe0b340a073dac

File Explorer

0066ae0e9b55b9d6a3c5bfd85cded7a4cd16181e1afc5b7b5efe0b340a073dac

.dll 292KB

0066ae0e9b55b9d6a3c5bfd85cded7a4cd16181e1afc5b7b5efe0b340a073dac

IMPHASH f5f0e5cc66dec9c3420847794b490d00
SHA256 0066ae0e9b55b9d6a3c5bfd85cded7a4cd16181e1afc5b7b5efe0b340a073dac
MD5 b979f74b3c94221b040639626f78ea29
SHA1 66e69fda382e6d653806cbbda6d6c9ad2b18826a
SHA512 e1ede01ffbcd96cb6ad4a86f9e5c440f3a1a9e2225186b9c7eff2ee450a9be33ef40a8abe1111264e2c4264b94fa3b17825711601c453110361818dbae4ef419
SSDEEP 3072:jWllcg0uYsaz6DzIOumxsO7EJ92LE/lZxbEEodiuE7TpchPP14RfpsTd95jvvTtR:jWllXxvIDesvJ9U014/kOhn5x5
TLSH
T16B547C16B6A410BDE167C67CC9538945EBF2BC4307A1EADB07904EAA3F237D05A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65172

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\Killer Project Ever\onvue fixlife\onvue\x64\Release\AffinityKillerDLL.pdb

kernel32

FreeLibraryAndExitThread GetCurrentThreadId GetModuleHandleA Sleep DisableThreadLibraryCalls CloseHandle CreateThread GetProcAddress GetModuleHandleW IsDebuggerPresent WriteConsoleW CreateFileW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect HeapFree GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers HeapAlloc GetFileType GetStdHandle SetFilePointerEx WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LocalFree MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo GetLastError ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetFileSizeEx RtlUnwind

wininet

InternetOpenA InternetConnectA HttpOpenRequestA InternetSetOptionA InternetReadFile InternetCloseHandle HttpSendRequestA

bcrypt

BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptOpenAlgorithmProvider

ole32

CoCreateInstance CoInitializeSecurity CoInitializeEx CoSetProxyBlanket CoUninitialize

oleaut32

VariantClear SysAllocString SysFreeString

user32

UnhookWindowsHookEx EnumWindows DefWindowProcA CreateWindowExA GetWindowDisplayAffinity GetWindowLongPtrA SetWindowLongPtrA RegisterClassA MessageBoxA SetWindowDisplayAffinity SetWindowsHookExA ShowWindow CallNextHookEx DestroyWindow LoadCursorA

ws2_32

WSAStartup

Name

.text

Size

190KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0066ae0e9b55b9d6a3c5bfd85cded7a4cd16181e1afc5b7b5efe0b340a073dac

kernel32

wininet

bcrypt

ole32

oleaut32

user32

ws2_32

generic