788f2a270b99069f964cd0891d975992035b1abff5699c4a1aa01f176cbe8e97

Sharing

Copy URL Twitter E-mail

General

Target
788f2a270b99069f964cd0891d975992035b1abff5699c4a1aa01f176cbe8e97
Size 1000KB
Sample260820-zpcrdsysfw
SHA256 788f2a270b99069f964cd0891d975992035b1abff5699c4a1aa01f176cbe8e97
MD5 7b51e5714d22b698831c4a05b0556af6
SHA1 ffd270f482da2a8787bfa61e1d2a3b1bcc9c5289
SHA512 a92632462a32348bc944babf4dd1b95f8eba15683ce2793272f35071cdc552b8f96a834c46daac4b32fc9785e5a080f42dc13ca106ba814c03bac8796afecf34
SSDEEP 24576:4RYeIQMnjacHOXtm6Pwv/5vsTGQIwISFuI/bb:4RYDjVHYElBvsTjuIDb
TLSH
T182259E1A62DC0178E077D1B9CA6B4503FBB1B84A13719ADF03E0965A1F37BE14A7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
788f2a270b99069f964cd0891d975992035b1abff5699c4a1aa01f176cbe8e97

File Explorer

788f2a270b99069f964cd0891d975992035b1abff5699c4a1aa01f176cbe8e97

.dll 1000KB

788f2a270b99069f964cd0891d975992035b1abff5699c4a1aa01f176cbe8e97

IMPHASH 7c7e2d3c606d581f9c898d197d297990
SHA256 788f2a270b99069f964cd0891d975992035b1abff5699c4a1aa01f176cbe8e97
MD5 7b51e5714d22b698831c4a05b0556af6
SHA1 ffd270f482da2a8787bfa61e1d2a3b1bcc9c5289
SHA512 a92632462a32348bc944babf4dd1b95f8eba15683ce2793272f35071cdc552b8f96a834c46daac4b32fc9785e5a080f42dc13ca106ba814c03bac8796afecf34
SSDEEP 24576:4RYeIQMnjacHOXtm6Pwv/5vsTGQIwISFuI/bb:4RYDjVHYElBvsTjuIDb
TLSH
T182259E1A62DC0178E077D1B9CA6B4503FBB1B84A13719ADF03E0965A1F37BE14A7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

542640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CodeBench\workplace\gamingmodules\bin\x86\Release\plugins\SEColorManagerPlugin\SEColorManagerPlugin64.pdb

monitorcontrol

MonCtrl_GetMonitorCount MonCtrl_UnInit MonCtrl_GetMonitorModelName MonCtrl_Init MonCtrl_GetMonitorColorGamutCount MonCtrl_GetMonitorColorGamut MonCtrl_GetMultiMonitorColorSyncStatus MonCtrl_SetMonitorColorGamut MonCtrl_GetMonitorColorGamutByIndex

powrprof

PowerRegisterSuspendResumeNotification PowerUnregisterSuspendResumeNotification

kernel32

FindClose SetFileAttributesW GetFileSize GetModuleHandleW VirtualQuery GlobalFree SetLastError GetLocalTime LocalFree WaitForMultipleObjects CreateEventW SetEvent ResetEvent GetSystemPowerStatus CreateProcessW GetExitCodeProcess GetModuleFileNameW FindResourceW LoadResource FindResourceExW CloseHandle DeleteFileW LockResource SetDllDirectoryW MultiByteToWideChar ReleaseMutex GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW SetFilePointer GetPrivateProfileIntW WriteFile GetStdHandle SetConsoleTextAttribute GetFileSizeEx SizeofResource FindNextFileW FindFirstFileW ReadFile GetSystemFirmwareTable LoadLibraryExW QueryFullProcessImageNameW FreeLibrary GetProcAddress GetCurrentProcess GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx HeapFree WideCharToMultiByte Sleep CopyFileW SleepConditionVariableSRW GetTickCount64 WaitForSingleObjectEx GetExitCodeThread GetStringTypeW SetFilePointerEx RtlUnwind WriteConsoleW SetEndOfFile SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation ReadConsoleW FlushFileBuffers GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType ExitProcess FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList RtlUnwindEx InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoEx GetCPInfo LCMapStringEx CompareStringEx EncodePointer GetSystemTimeAsFileTime QueryPerformanceFrequency WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns CreateDirectoryW GetFullPathNameW K32GetModuleFileNameExW GetStartupInfoW TerminateProcess GetCurrentProcessId UnmapViewOfFile SystemTimeToFileTime SetFileTime LocalFileTimeToFileTime GetCurrentDirectoryW IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter IsProcessorFeaturePresent

user32

DisplayConfigGetDeviceInfo EnumDisplayDevicesW QueryDisplayConfig wsprintfW DisplayConfigSetDeviceInfo TranslateMessage RegisterClassW DispatchMessageW RegisterDeviceNotificationW CreateWindowExW DefWindowProcW GetMessageW SetDisplayConfig GetDisplayConfigBufferSizes

advapi32

RegNotifyChangeKeyValue RegOpenKeyExA RegEnumKeyExA RegEnumKeyW RegQueryInfoKeyW RegFlushKey RegCreateKeyExW RegSetValueExW QueryServiceStatus CloseServiceHandle OpenSCManagerW ControlService StartServiceW OpenServiceW RegCloseKey AllocateAndInitializeSid FreeSid CheckTokenMembership InitializeSecurityDescriptor RegOpenKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegEnumKeyExW LookupAccountSidW

shell32

SHGetSpecialFolderPathW ord165 SHCreateDirectoryExW

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoUninitialize CoInitialize CoSetProxyBlanket

oleaut32

VariantInit SysAllocString VariantClear SysFreeString

shlwapi

SHGetValueW PathIsDirectoryW SHSetValueA PathFileExistsW SHGetValueA SHDeleteValueA PathFindFileNameW

mscms

InstallColorProfileW WcsSetUsePerUserProfiles WcsSetDefaultColorProfile ord233 ord234

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQuerySessionInformationW

winhttp

WinHttpSetTimeouts WinHttpSendRequest WinHttpReadData WinHttpWriteData WinHttpQueryOption WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryHeaders WinHttpGetProxyForUrl WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable

netapi32

NetApiBufferFree NetLocalGroupGetMembers

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlPcToFileHeader

crypt32

CertNameToStrA CertNameToStrW

Name

.text

Size

740KB

Virtual Size

740KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

788f2a270b99069f964cd0891d975992035b1abff5699c4a1aa01f176cbe8e97

monitorcontrol

powrprof

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

mscms

wtsapi32

winhttp

netapi32

ntdll

crypt32

generic