8e0f5947d45fec2d99493fcb16f0278a0fec9904fe52ba041baa06ca18419ab1

Sharing

Copy URL Twitter E-mail

General

Target
8e0f5947d45fec2d99493fcb16f0278a0fec9904fe52ba041baa06ca18419ab1
Size 9.1MB
Sample260817-p3z4qs1amd
SHA256 8e0f5947d45fec2d99493fcb16f0278a0fec9904fe52ba041baa06ca18419ab1
MD5 b22133b4b23c8c4ca0ff426ba23ec396
SHA1 5ac0a650f92fcb5ddc6a7e39f962e27f99f90a68
SHA512 617c26c9d9a40ac50400156a080186a264ecddb9fa4b085f5082832c201250f51abc3303e1ffb89b701be13e4dd4b6653229e0691410d5277cbb8f0e3cc97b5e
SSDEEP 98304:RHXzWoDvgh5HULSJ4ZhqvNRWVeB1uBX0aiT6g83j/i:koDgX2SJ5UQBi0p6Lz/i
TLSH
T1F6A68D1BA7449269D06FC17CC3964B16E972B4950F32A2CF0604576D2E7BBF82F3A394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e0f5947d45fec2d99493fcb16f0278a0fec9904fe52ba041baa06ca18419ab1

File Explorer

8e0f5947d45fec2d99493fcb16f0278a0fec9904fe52ba041baa06ca18419ab1

.dll 9.1MB

8e0f5947d45fec2d99493fcb16f0278a0fec9904fe52ba041baa06ca18419ab1

IMPHASH cbc6bc047ba13f0dcf552af347843aa5
SHA256 8e0f5947d45fec2d99493fcb16f0278a0fec9904fe52ba041baa06ca18419ab1
MD5 b22133b4b23c8c4ca0ff426ba23ec396
SHA1 5ac0a650f92fcb5ddc6a7e39f962e27f99f90a68
SHA512 617c26c9d9a40ac50400156a080186a264ecddb9fa4b085f5082832c201250f51abc3303e1ffb89b701be13e4dd4b6653229e0691410d5277cbb8f0e3cc97b5e
SSDEEP 98304:RHXzWoDvgh5HULSJ4ZhqvNRWVeB1uBX0aiT6g83j/i:koDgX2SJ5UQBi0p6Lz/i
TLSH
T1F6A68D1BA7449269D06FC17CC3964B16E972B4950F32A2CF0604576D2E7BBF82F3A394
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2703552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\velocity-fixed\velocity-fixed-main\cs2\velocity-cs2\..\bin\velocity-cs2-dev.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AreFileApisANSI CloseHandle CompareStringEx CompareStringW CopyFile2 CreateDirectoryExW CreateDirectoryW CreateFile2 CreateFileA CreateFileMappingA CreateFileW CreateHardLinkW CreateProcessW CreateSymbolicLinkW CreateThread DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl DisableThreadLibraryCalls EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformationEx GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetThreadId GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExA GlobalAlloc GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveVectoredExceptionHandler ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SuspendThread SwitchToThread TerminateProcess TryAcquireSRWLockExclusive TryAcquireSRWLockShared UnhandledExceptionFilter UnmapViewOfFile VirtualProtect WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

shell32

SHGetFolderPathW

user32

CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow EmptyClipboard GetAsyncKeyState GetClipboardData GetCursorPos GetKeyState GetSystemMetrics GetWindowLongPtrW LoadCursorW MapVirtualKeyW OpenClipboard RegisterClassExA SetClipboardData SetCursor SetCursorPos UnregisterClassA

advapi32

GetUserNameA RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

ole32

CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal PropVariantClear

api-ms-win-core-synch-l1-2-0

WaitOnAddress

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueW

d3d11

D3D11CreateDeviceAndSwapChain

Name

.text

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.0MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

372KB

Virtual Size

372KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_addr

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

Name

memcmp_

Size

512B

Virtual Size

88B

Characteristics

Name

memcpy_

Size

512B

Virtual Size

332B

Characteristics

Name

memset_

Size

512B

Virtual Size

120B

Characteristics

Name

.rsrc

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8e0f5947d45fec2d99493fcb16f0278a0fec9904fe52ba041baa06ca18419ab1

kernel32

shell32

user32

advapi32

ole32

api-ms-win-core-synch-l1-2-0

version

d3d11

generic