good.zip
- SHA256 22fcc301b171dc96100d8f88c60cd2e53c821092fef5523dd38fa7d3971167a8
Static task
static1
1 signatures
General
- Target good.zip
- Size 457KB
- Sample260813-jev7zshe38
- SHA256 22fcc301b171dc96100d8f88c60cd2e53c821092fef5523dd38fa7d3971167a8
- MD5 bd466ac83c3c29bf97aa26ec8087d1f9
- SHA1 227dd4d7ada0e25bba216573edb21946435b6b45
- SHA512 518a75eaf9ab5a7dcba599db686c9a8e0b745c3836f1c886285789a59c91e5a38205b00903b6d1eb32da5f8e90836dfbfd661393dee4cebcaff24cec88213ddd
- SSDEEP 6144:ijxikspT2f6Y3N03ZXEsuCmcW3KaYbtH3Bdq0CWACXpdUbdTM8X7dmGxak5wjozt:WPepDXmxKaU/sWybFNr5akBd+6
- TLSH T14FA4230FDA6B9EA3F6CF30DA56252CEA803CD7D85A016413F20698DFE662356451F722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/blue.dll unpack001/output_patched.exe
File Explorer
-
good.zip.zip 457KB
-
blue.dll.dll 92KB
-
dbdata.token13KB
-
output_patched.exe.exe 1.2MB
blue.dll
- IMPHASH 7a1d6ec690a385d8e46f180582f98428
- SHA256 653a0b6084d7689c71e53142db882f396228812cacfda510e04a41244d37b817
- MD5 571707bc45b64ead2cbfc8fcd0a372f3
- SHA1 6987a1d1d8f516ff9853f4e2a904d473df5c2b0a
- SHA512 0c0d57cd0fa10ea2c6a81219c7d8e1d1d4d384b54454a4277c651b610501eafc50a9e97659ba86152dd0652fcea854abd634c3b461e5cdce02499eb5a4dc4053
- SSDEEP 1536:G75SD2n5/Ar1IUhgTgIJP5L5Z0fZAQ+394tb87HQD3EYQH:A5SD2n5/AjhqrJP5L5KpWwk
- TLSH T1EA9329F5BBD19D8AEA56637863C6C561373CFEE082624B0B063815342F07ED07DE9686
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4754
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AllocConsole
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
api-ms-win-crt-convert-l1-1-0
mbrtowc
wcrtomb
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
strerror
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
fputc
freopen_s
fwrite
api-ms-win-crt-string-l1-1-0
memset
strlen
strncmp
wcslen
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_tzset
_Z12InstallHooksv
_Z12IsTokenReadyv
_Z12PrngStepHookj
_Z13PatchFunctionyPvPS_
_Z14InjectSnapshotv
_Z16HwidDispatchHookc
_Z18CreateDebugConsolev
_Z22ScanTokenForHwidValuesv
_Z6printfPKcz
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
325B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
116B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/14
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
512B
Virtual Size
175B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/80
Size
512B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/91
Size
512B
Virtual Size
378B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
dbdata.token
- SHA256 41f182fb27166e9ac1bd60a089fa960b54f8b70dc59b00eda5ea42014f538821
- MD5 27b50e01175c5308d1359b05ae246055
- SHA1 2376f86dc9f42e5ad481ec03c03c458d09490160
- SHA512 cfe4fef861dbc7bd4af98e29f8614f097d5ee81aa453919a63bdb33fd801547323a429d3d906274e6bc215e07b5f2cb9dbb8f641d6566ea2a7ce370fcf91d1b7
- SSDEEP 384:zf0lOaTp0MoFJz2B6QoWiumHeeL1kITmkAYGSSQ:ehoX3QT2e61kyHEQ
- TLSH T19A527CCCD2AA48D18D456FC5A87662CB4F25177B4DE8054720B8BB281E734EE8079EED
- MD5 SHA1 SHA512 SSDEEP TLSH
output_patched.exe
- IMPHASH 3d1f154825c3db974c7377f41bdba303
- SHA256 026e701fd8f9388984bb26d0174cfa6a2cb041ffc2172b23ee21b9e1ba35b001
- MD5 d74493540ad31d84051de4c84dfdb064
- SHA1 e1e8f0b9cb2af4e60ccfe35bc9c8f4bf28530fa0
- SHA512 7ca227bea3a3c81cb43ba0f7a73f5e42609b86bc79f93d5d2261132912fc52b592c266ad03cbf363fa2aa7b0303ab311527a8c6a1b1193acfaab045f2532f26d
- SSDEEP 24576:3U3qT42th4FgBOKHqSv5qmKDqSha4mnYIVgVA6LO0vOO4GgnsJu:3U3qT42v4FgBOKHqGqkSha4MrVgFLO04
- TLSH T146453AA5BF22C354D8422C7814384B09DB387F8EC22DD657D7AA3542371DB9EB1AE385
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1327104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
bcrypt
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDestroyHash
BCryptDestroyKey
BCryptFinishHash
BCryptGetProperty
BCryptHashData
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptVerifySignature
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
DeleteDC
DeleteObject
GetStockObject
SelectObject
SetBkMode
kernel32
CloseHandle
CreateFileA
ExitProcess
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStdHandle
GetTickCount
ReadFile
VirtualAlloc
WriteFile
LoadLibraryA
user32
AdjustWindowRect
BeginPaint
CreateWindowExA
DefWindowProcA
DestroyWindow
DispatchMessageA
DrawTextA
EndPaint
FillRect
FrameRect
GetClientRect
GetMessageA
InvalidateRect
IsDialogMessageA
KillTimer
LoadCursorA
LoadIconA
MessageBoxA
PostQuitMessage
RegisterClassA
SendMessageA
SetTimer
ShowWindow
TranslateMessage
UpdateWindow
arm_game_timer
cell_blocked
change_direction
compute_window_size
current_timer_ms
draw_board
draw_cell
draw_center_box
draw_scene_to_dc
eat_bonus
ensure_backbuffer
fill_rect_color
finish_game
generate_obstacles
handle_key
init_game_memory
mainCRTStartup
main_window_proc
make_score_text
maybe_spawn_bonus
paint_double_buffered
place_apple
point_hits_obstacle
point_hits_snake
release_backbuffer
run_game_application
snake_eat_apple
start_new_game
stop_game_timer
u32_to_dec
update_game_step
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.blue
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE