f091f4bb34bab3bde9bf18b9ea63e8d3d5d7bec4ef5bc69eabc127b200d68337

General

Target
f091f4bb34bab3bde9bf18b9ea63e8d3d5d7bec4ef5bc69eabc127b200d68337
Size 175KB
Sample260820-sa685azarg
SHA256 f091f4bb34bab3bde9bf18b9ea63e8d3d5d7bec4ef5bc69eabc127b200d68337
MD5 b144f97610b009d5ff583a4c3c8a4c56
SHA1 c2ffade298a364ebaa7742bbacebd6df93902fe3
SHA512 b8c0e4f6cab08c601fb648cea4fdc1bde5cbc3da7d9394ae2f7e228fd0907d5ab36ac7d19bcae668d71365844b1e7118a42f99fae2771f749c6155d7e848b075
SSDEEP 3072:P/RxCuo2dlPuh9+hg3dqoATWbElUUUXoY4631Kz18XTDC:Bxfo2dlPuh9+hW9ohkEqXT
TLSH
T1B4046B1A73A500BAE973413988535A05F372B8510771DABF07A4437ADF2F7E06A3BB64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f091f4bb34bab3bde9bf18b9ea63e8d3d5d7bec4ef5bc69eabc127b200d68337

File Explorer

f091f4bb34bab3bde9bf18b9ea63e8d3d5d7bec4ef5bc69eabc127b200d68337

.dll 175KB

f091f4bb34bab3bde9bf18b9ea63e8d3d5d7bec4ef5bc69eabc127b200d68337

IMPHASH 9e110a845c9472720a33e68679c18e31
SHA256 f091f4bb34bab3bde9bf18b9ea63e8d3d5d7bec4ef5bc69eabc127b200d68337
MD5 b144f97610b009d5ff583a4c3c8a4c56
SHA1 c2ffade298a364ebaa7742bbacebd6df93902fe3
SHA512 b8c0e4f6cab08c601fb648cea4fdc1bde5cbc3da7d9394ae2f7e228fd0907d5ab36ac7d19bcae668d71365844b1e7118a42f99fae2771f749c6155d7e848b075
SSDEEP 3072:P/RxCuo2dlPuh9+hg3dqoATWbElUUUXoY4631Kz18XTDC:Bxfo2dlPuh9+hW9ohkEqXT
TLSH
T1B4046B1A73A500BAE973413988535A05F372B8510771DABF07A4437ADF2F7E06A3BB64
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16500

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Code\5.3.7\klzcode\bin\client\app\游戏活动\plugins\MONNZM.pdb

kernel32

GetModuleFileNameW GetModuleHandleW GetProcAddress CloseHandle GetCurrentProcess TerminateProcess WaitForSingleObject DeleteCriticalSection FreeLibrary GetLastError MultiByteToWideChar WideCharToMultiByte InitializeCriticalSectionEx OpenFileMappingW MapViewOfFile ReleaseSemaphore CreateSemaphoreW TerminateThread CreateThread WriteConsoleW HeapSize EnterCriticalSection LeaveCriticalSection InitializeCriticalSection EncodePointer DecodePointer GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW HeapFree HeapAlloc LCMapStringW GetStdHandle GetFileType WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle CreateFileW FlushFileBuffers

Name

.text

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f091f4bb34bab3bde9bf18b9ea63e8d3d5d7bec4ef5bc69eabc127b200d68337

kernel32

generic