e6b5588f5750a7f21e20a394b253a495d6b95f95af0f9becc7f56f876e748778

General

Target
e6b5588f5750a7f21e20a394b253a495d6b95f95af0f9becc7f56f876e748778
Size 306KB
Sample260814-kys3eazamd
SHA256 e6b5588f5750a7f21e20a394b253a495d6b95f95af0f9becc7f56f876e748778
MD5 25f5ca2b3f123075e3f948a96bdac627
SHA1 034a9388d84523f0a6433d18f12114abb1db1755
SHA512 f79f297bb29b30568c95c59b8a6bd1b1254ae9db6f53248c75008e601c44a92488426ff7dac3ffc76e761284c6dff37d5430f0e60f701836098c0460f3062571
SSDEEP 6144:Oo6UAKLRGV24/tjEjZFrBhYK5EH70eO8dJ2n+F:tVLRGlEjhhYK5ygezdJ/
TLSH
T103646C2AF79514BAD167C13CCD834506E7B278864771DBEF13A04A962E23BE09B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e6b5588f5750a7f21e20a394b253a495d6b95f95af0f9becc7f56f876e748778

File Explorer

e6b5588f5750a7f21e20a394b253a495d6b95f95af0f9becc7f56f876e748778

.dll 306KB

e6b5588f5750a7f21e20a394b253a495d6b95f95af0f9becc7f56f876e748778

IMPHASH 489022ca9b4287562483f77b12e7fbca
SHA256 e6b5588f5750a7f21e20a394b253a495d6b95f95af0f9becc7f56f876e748778
MD5 25f5ca2b3f123075e3f948a96bdac627
SHA1 034a9388d84523f0a6433d18f12114abb1db1755
SHA512 f79f297bb29b30568c95c59b8a6bd1b1254ae9db6f53248c75008e601c44a92488426ff7dac3ffc76e761284c6dff37d5430f0e60f701836098c0460f3062571
SSDEEP 6144:Oo6UAKLRGV24/tjEjZFrBhYK5EH70eO8dJ2n+F:tVLRGlEjhhYK5ygezdJ/
TLSH
T103646C2AF79514BAD167C13CCD834506E7B278864771DBEF13A04A962E23BE09B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

99840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\William\Desktop\GrimDawnCombatAnalyzer\x64\Release\GdHook.pdb

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

kernel32

WriteConsoleW ReadConsoleW GetModuleFileNameA GetCurrentProcess GetCurrentThreadId GetModuleHandleA Sleep CreateFileA DisableThreadLibraryCalls LoadLibraryA QueryPerformanceFrequency CloseHandle CreateThread AddVectoredExceptionHandler GetProcAddress GetCurrentProcessId QueryPerformanceCounter GetTickCount VirtualQuery GetModuleHandleExA CreateNamedPipeA WriteFile DisconnectNamedPipe GetLastError ConnectNamedPipe RtlCaptureStackBackTrace GetTickCount64 GetModuleHandleW VirtualFree VirtualAlloc GetSystemInfo HeapCreate VirtualProtect HeapFree Thread32Next Thread32First SuspendThread ResumeThread CreateToolhelp32Snapshot HeapReAlloc HeapAlloc GetThreadContext FlushInstructionCache SetThreadContext OpenThread ReadFile WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetStringTypeW SetStdHandle CreateFileW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize SetEndOfFile

Name

.text

Size

203KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e6b5588f5750a7f21e20a394b253a495d6b95f95af0f9becc7f56f876e748778

version

kernel32

generic