be16677f5c4150457f6521075cd8b568cb3662642e9508bfd20efe6c1438908f

Sharing

Copy URL Twitter E-mail

General

Target
be16677f5c4150457f6521075cd8b568cb3662642e9508bfd20efe6c1438908f
Size 1.1MB
Sample260812-tgan6sbl21
SHA256 be16677f5c4150457f6521075cd8b568cb3662642e9508bfd20efe6c1438908f
MD5 1b55a533f4a365d84513f8ea48b562b5
SHA1 3acbc33f1a7e9dcee72ac7823a416233c67cbbcb
SHA512 87b94b97f421241c5af37971d06558e6d467103cbfb426065f99607390d57520cceb830361eb1beedd8952bd03f92df9e6864ee70d3767fdad8315a99aefd0dc
SSDEEP 24576:XwrD4I9VBhafxnshRC/XyW8FR+Mp5AepTsrgNOaQVD+jzF1TKmx2DxY:Xw34shW/MPHpwrMp1TKW2D
TLSH
T1EF458C70FA56C0B2D69110B094BEEBBF583D6F594B3184C7D3CC3DA8A9705C1277A68A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be16677f5c4150457f6521075cd8b568cb3662642e9508bfd20efe6c1438908f

File Explorer

be16677f5c4150457f6521075cd8b568cb3662642e9508bfd20efe6c1438908f

.exe 1.1MB

be16677f5c4150457f6521075cd8b568cb3662642e9508bfd20efe6c1438908f

IMPHASH e2a524cb066dc040ef0ec12cb07317bc
SHA256 be16677f5c4150457f6521075cd8b568cb3662642e9508bfd20efe6c1438908f
MD5 1b55a533f4a365d84513f8ea48b562b5
SHA1 3acbc33f1a7e9dcee72ac7823a416233c67cbbcb
SHA512 87b94b97f421241c5af37971d06558e6d467103cbfb426065f99607390d57520cceb830361eb1beedd8952bd03f92df9e6864ee70d3767fdad8315a99aefd0dc
SSDEEP 24576:XwrD4I9VBhafxnshRC/XyW8FR+Mp5AepTsrgNOaQVD+jzF1TKmx2DxY:Xw34shW/MPHpwrMp1TKW2D
TLSH
T1EF458C70FA56C0B2D69110B094BEEBBF583D6F594B3184C7D3CC3DA8A9705C1277A68A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

868245

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Source\Desktop\WrathOfEternal\WrathOfEternal\SourceCodeVS2019\_bin\AllRelease\ClientUpdate.pdb

winmm

timeGetTime

d3d9

Direct3DCreate9

kernel32

GetModuleHandleW InitializeCriticalSection MulDiv LoadLibraryW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount GetCommandLineW GetExitCodeProcess MoveFileW DeleteFileW Sleep SetFileAttributesW WaitForSingleObject GetTempPathW CreateDirectoryW ReadFile GetCurrentDirectoryW lstrcatW MultiByteToWideChar lstrcpyW WideCharToMultiByte DeleteCriticalSection GetFileSize CloseHandle GetDiskFreeSpaceExW GetLastError CreateFileW InitializeCriticalSectionEx SetFilePointer GetModuleFileNameW WriteFile lstrlenW InitializeSListHead GetFileSizeEx CreateFileA FormatMessageA SetLastError WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle WaitForSingleObjectEx MoveFileExA QueryPerformanceCounter VerifyVersionInfoA LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary GetSystemDirectoryA QueryPerformanceFrequency VerSetConditionMask SleepEx LeaveCriticalSection EnterCriticalSection GetEnvironmentVariableA SetEvent FileTimeToDosDateTime ResetEvent CreateEventW GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount GetLocalTime FileTimeToLocalFileTime UnmapViewOfFile SystemTimeToFileTime LocalFileTimeToFileTime lstrcmpW OutputDebugStringW CreateMutexW

user32

SetScrollPos SetScrollRange EnableScrollBar MoveWindow GetScrollRange IntersectRect FillRect GetIconInfo DestroyIcon CharNextW DrawTextW DrawIconEx ShowScrollBar SetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW RedrawWindow InflateRect GetScrollPos OffsetRect AdjustWindowRectEx CallWindowProcW GetMenu SetWindowPos RegisterClassExW ShowWindow IsWindow SetPropW SetWindowLongW PostQuitMessage SystemParametersInfoW GetClassInfoExW LoadImageW EnableWindow GetWindowLongW GetMessageW DefWindowProcW GetKeyState GetWindow GetWindowRect GetFocus DestroyWindow GetScrollInfo GetPropW SetWindowRgn CreateWindowExW ScreenToClient SendMessageW GetSystemMetrics DispatchMessageW SetTimer MapWindowPoints IsRectEmpty SetFocus GetUpdateRect TranslateMessage LoadCursorW SetCapture SetCursor GetClientRect GetDlgItem KillTimer GetParent RegisterWindowMessageW PtInRect ReleaseCapture InvalidateRect GetCursorPos BeginPaint EndPaint GetDesktopWindow GetDC ReleaseDC PostMessageW EnumWindows GetWindowTextW MessageBoxW MessageBoxA wsprintfW InvalidateRgn SetRect

gdi32

TextOutW CreateRectRgnIndirect GetClipBox GdiFlush StretchBlt CreateDIBSection CreateBitmap SetBitmapBits CombineRgn GetRegionData CreateRectRgn ExtCreateRegion GetBitmapBits CreateFontIndirectW CreateSolidBrush DeleteObject RestoreDC SetBkColor GetObjectW CreatePen SetTextColor DeleteDC GetTextMetricsW GetStockObject SetWindowOrgEx CreateCompatibleDC SelectObject SaveDC CreateCompatibleBitmap BitBlt ExtTextOutW RoundRect ExtSelectClipRgn SetStretchBltMode MoveToEx SelectClipRgn Rectangle LineTo SetBkMode GetDeviceCaps GetTextExtentPoint32W

shell32

ShellExecuteW ShellExecuteExW SHGetFolderPathW

ole32

CoUninitialize CoCreateInstance CLSIDFromProgID CLSIDFromString OleLockRunning CoInitialize

oleaut32

VariantInit SysAllocString VariantClear SysFreeString

msvcp140

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

shlwapi

PathFileExistsW

comctl32

ImageList_LoadImageW _TrackMouseEvent ImageList_GetIcon ord17

vcruntime140

_except_handler4_common _CxxThrowException __current_exception_context __current_exception longjmp wcschr __std_terminate memchr strstr memmove strrchr strchr memset _setjmp3 wcsstr _purecall __std_exception_copy __std_exception_destroy __CxxFrameHandler3 __CxxLongjmpUnwind memcpy

api-ms-win-crt-stdio-l1-1-0

__p__commode _lseeki64 _read _write _close _open __stdio_common_vsprintf _set_fmode ftell fopen fclose fseek fwrite fread __stdio_common_vfprintf fgets _wfopen_s fflush __stdio_common_vsscanf fputc __stdio_common_vswprintf feof _wfopen fputs __acrt_iob_func _putws

api-ms-win-crt-heap-l1-1-0

free calloc _set_new_mode malloc realloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_errno _wsystem _invalid_parameter_noinfo_noreturn _beginthreadex exit abort terminate _getpid __sys_nerr _controlfp_s _configure_narrow_argv _register_thread_local_exe_atexit_callback _c_exit _initialize_narrow_environment _exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function strerror _endthreadex _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

wcsncpy tolower iswalnum strpbrk wcstok isspace isdigit _wcsicmp _stricmp _strdup isprint isalpha strncpy _wcslwr isxdigit isalnum iscntrl ispunct islower iswalpha iswdigit iswcntrl iswspace iswxdigit strncmp strcspn strspn _strlwr isupper toupper

api-ms-win-crt-utility-l1-1-0

qsort rand srand

api-ms-win-crt-convert-l1-1-0

strtod wcstoul wcstod strtoul atoi strtoll _wtoi wcstol strtol _wtol

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 _gmtime64 clock

api-ms-win-crt-filesystem-l1-1-0

_access _unlink _fstat64 _wrename _wremove _stat64

api-ms-win-crt-environment-l1-1-0

getenv _wgetenv

api-ms-win-crt-math-l1-1-0

_libm_sse2_atan_precise _libm_sse2_exp_precise _libm_sse2_asin_precise _libm_sse2_log10_precise _libm_sse2_log_precise floor _libm_sse2_acos_precise _CIfmod _libm_sse2_pow_precise _libm_sse2_sin_precise _libm_sse2_sqrt_precise _libm_sse2_tan_precise _CIatan2 __setusermatherr ceil _libm_sse2_cos_precise

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ws2_32

WSACleanup WSAStartup accept htonl WSAIoctl ioctlsocket WSASetLastError __WSAFDIsSet socket setsockopt select freeaddrinfo getpeername ntohs htons getsockopt getsockname ntohl connect bind WSAGetLastError getaddrinfo gethostname send sendto recv closesocket listen recvfrom

normaliz

IdnToAscii

wldap32

ord45 ord41 ord60 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord211 ord46 ord217 ord143 ord50

crypt32

CertEnumCertificatesInStore CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CryptDecodeObjectEx CertGetCertificateChain CertFreeCertificateChain CertOpenStore CertCloseStore CertAddCertificateContextToStore PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFreeCertificateChainEngine CertFindCertificateInStore CertFindExtension

advapi32

CryptEncrypt CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA CryptImportKey

Sharing

General

Malware Config

Signatures

File Explorer

be16677f5c4150457f6521075cd8b568cb3662642e9508bfd20efe6c1438908f

winmm

d3d9

kernel32

user32

gdi32

shell32

ole32

oleaut32

msvcp140

shlwapi

comctl32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

ws2_32

normaliz

wldap32

crypt32

advapi32

generic