good patcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
good patcher.exe
Size 16KB
Sample260818-2lcckatvdx
SHA256 e5c7733345bf5ddf159950d2d6ffc8cd3c10b3e1ac27c3a36ed49fd5df2f3bc2
MD5 30338ed9eda799d6ec0f63747bd4fa19
SHA1 55f8cb3600f7940cf6414fe5934691d09ccdffae
SHA512 53370369b292f5d602bb57f7a703df7de15f017fb6329de5d1d34b2009533017b5e7389d0f3cc86358065cbd901cd7dfc4350219a26ba407e5bc23398db84885
SSDEEP 384:W6NB5b6DQYNSaEIf82NhSmMhTBNsUBE3u8:WsW1NSPMdJMhTBuU63u
TLSH
T10C724A5BB7660AD9D175C238C5B79A36E1B778250733939F07C1C42A0FBA3907D26E41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
good patcher.exe

File Explorer

good patcher.exe

.exe 16KB

good patcher.exe

IMPHASH 0fbf72dfc5ae6aa54971d17be9d8888d
SHA256 e5c7733345bf5ddf159950d2d6ffc8cd3c10b3e1ac27c3a36ed49fd5df2f3bc2
MD5 30338ed9eda799d6ec0f63747bd4fa19
SHA1 55f8cb3600f7940cf6414fe5934691d09ccdffae
SHA512 53370369b292f5d602bb57f7a703df7de15f017fb6329de5d1d34b2009533017b5e7389d0f3cc86358065cbd901cd7dfc4350219a26ba407e5bc23398db84885
SSDEEP 384:W6NB5b6DQYNSaEIf82NhSmMhTBNsUBE3u8:WsW1NSPMdJMhTBuU63u
TLSH
T10C724A5BB7660AD9D175C238C5B79A36E1B778250733939F07C1C42A0FBA3907D26E41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

7104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\logxn\Downloads\new\patcher\x64\Release\patcher.pdb

kernel32

WriteProcessMemory OpenProcess CreateToolhelp32Snapshot GetLastError Process32Next K32GetModuleBaseNameA VirtualProtectEx K32EnumProcessModules RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlCaptureContext

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __C_specific_handler __std_terminate __current_exception_context memcpy memset

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _register_onexit_function _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc system _exit exit _initterm_e _initterm _initialize_narrow_environment _configure_narrow_argv _cexit _set_app_type _seh_filter_exe _get_initial_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-string-l1-1-0

strcmp