krxslaxyv2.1.zip
- SHA256 246047892d71613bb081237673af6beb9b5a96b1ce5f3bb13598bf4daf3bf4b5
Static task
static1
2 signatures
General
- Target krxslaxyv2.1.zip
- Size 296KB
- Sample260816-a2en3swgpg
- SHA256 246047892d71613bb081237673af6beb9b5a96b1ce5f3bb13598bf4daf3bf4b5
- MD5 391cc0a15a997c52579f346c008f8110
- SHA1 4c881aa84aef3e1478413e27429fbbf65f78571e
- SHA512 bb63f4ce7af52b4fe75e567bdd97c3eca48636bd26fd14043655af948aa26fcc24333bf470ece9c32222d59cc6be6cbf1dc08340db014d020968809b3389e6f7
- SSDEEP 6144:gMSsLNvVTWVUgn1yfy4X0yQs1VyaOT7fcjRNjs1GszQL6H2IvcSPgFw:gMfhvngni5X0ts1ROT7kjrEGs92G+Fw
- TLSH T15B54234B99DC7E3700039C783B51E9ED98A15D0FA54CAB37871B82ED18878F923C97A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/injector.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/krxslaxyv2.1.dll
File Explorer
-
krxslaxyv2.1.zip.zip 296KB
-
injector.exe.exe 38KB
-
krxslaxyv2.1.dll.dll 632KB
injector.exe
- IMPHASH 09be90fa926051f0bd6d784f970dd879
- SHA256 d0601d51e37db6250cf847d6ba6e2ae461fe459eb9ddc153b47e1a791870017a
- MD5 ea69607c35c50f6d34336cb2a0a56632
- SHA1 736c9270d9ebf17c549736814023a9396bfdd7d0
- SHA512 4b34195602a4d60553471a852237f17636e9562662ad21ef7ecbcb8fae28a5fb8b7b4943b03b47f1714b9a6f7d7742d42085831c512d02400880d6de942d7aa5
- SSDEEP 768:ZjveBpGFg9iruEQZlztCAjozVynXV8VXhyNy7Y43B:BvMGFsirLQZ3RX3Na1
- TLSH T18303391B6B5640E8E0E2D2B9DAA71B49D7B27C050762A7CF5351812E0F772C0787FE42
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
20576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\ENES\Downloads\hahaha\output\hookloader.pdb
dbghelp
ImageDirectoryEntryToData
kernel32
SetConsoleTextAttribute
SetConsoleScreenBufferSize
GetStdHandle
SetConsoleMode
SetConsoleWindowInfo
GetConsoleScreenBufferInfoEx
GetModuleHandleA
GetConsoleMode
SetConsoleScreenBufferInfoEx
LoadLibraryA
GetProcAddress
SetConsoleCP
FreeLibrary
GetConsoleWindow
SetConsoleOutputCP
SetConsoleTitleW
LoadLibraryExW
GetFileAttributesExW
FindFirstFileW
GetFileInformationByHandleEx
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleHandleW
InitializeSListHead
IsDebuggerPresent
GetLastError
CloseHandle
AreFileApisANSI
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateFileW
FindClose
user32
GetWindowThreadProcessId
FindWindowW
GetWindowLongPtrW
SendMessageW
ShowScrollBar
SetWindowPos
SetWindowLongPtrW
msvcp140
?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
memcpy
memset
__current_exception_context
__current_exception
_CxxThrowException
memmove
__std_terminate
__std_exception_copy
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
free
malloc
api-ms-win-crt-runtime-l1-1-0
system
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
_seh_filter_exe
_set_app_type
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
__p___argc
_invoke_watson
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35207,
count=10, id=260, version=35207,
count=27, id=261, version=35207,
count=6, id=257, version=35207,
count=7, id=257, version=33145,
count=163, id=1, productName=Unmarked objects,
count=1, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
krxslaxyv2.1.dll
- IMPHASH 1f25bd2a14a4aa661738ea15dc5c2446
- SHA256 67a2c59ec5b931cf5853c7ce26a7dc1abf26ca52314c716b6707e31a3053224a
- MD5 16458cee007877cdc348cc8a9c65ca3d
- SHA1 95938c8aabee354e21179dd0979401dc431026bb
- SHA512 df751d6a0fbcc1a55bfddedb8d007632c3bf723c704a6609dcd4297277b6943a1e9d57ba86114a46405ce4327e6e6d24185b7705e862050f70586331f7a24dc3
- SSDEEP 6144:YLcEppMH/deMVTdnnFjpsNXIUFSQz7Qb58//AK6nnqznrRpW+pzTInlM2BB3BZck:Y7e1JwrSyBQuTpzT/2BnF
- TLSH T1DDD45B45A3F820ECF1B796729A725512E7B2BC950A70F2AF03E0499D5F37790963B312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
68:a1:59:c5:dc:ee:85:54:7e:30:b9:87:8d:40:0f:f2:b6:25:26:65:e6:43:98:30:b1:f2:73:8e:31:c1:b2:a3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN
Chains
Aug 14, 2026
CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN
Subject
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Serial Number
47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN
Serial Number
36:ea:f6:1d:c3:95:f6:30:41:f4:24:7d:ae:76:ab:7e
Issuer
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 9, 2016 - Aug 12, 2018
Minor OS version
0
Major OS version
6
Entry point
259828
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\SLAXY\Downloads\.dvn guncel (2)\dvn guncel\dvn\project\x64\Release\JJGBFRV368BY238RB8R3HFSNS.pdb
kernel32
FindNextFileW
Sleep
VirtualAlloc
VirtualProtect
VirtualQuery
GetModuleHandleA
GetProcAddress
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocalTime
GetTickCount
FindFirstFileW
WideCharToMultiByte
SetEndOfFile
WriteConsoleW
HeapSize
CreateFileW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetTickCount64
FindClose
GetACP
IsValidCodePage
CloseHandle
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
MultiByteToWideChar
GetStringTypeW
WakeAllConditionVariable
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
FindFirstFileExW
RtlUnwind
user32
ScreenToClient
GetCursorPos
GetSystemMetrics
MapVirtualKeyW
GetKeyNameTextA
GetKeyboardState
GetAsyncKeyState
GetActiveWindow
CallNextHookEx
ToUnicode
advapi32
GetUserNameW
shell32
SHGetFolderPathA
MertdOirf__
Name
.text
Size
434KB
Virtual Size
434KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
164KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
441KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=176, id=261, version=33145,
count=28, id=260, version=33145,
count=21, id=259, version=33145,
count=10, id=259, version=35207,
count=14, id=260, version=35207,
count=83, id=261, version=35207,
count=9, id=257, version=33145,
count=154, id=1, productName=Unmarked objects,
count=4, id=261, version=35228,
count=1, id=259, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,