offset_finder2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
offset_finder2.exe
Size 20KB
Sample260822-alyf9adh46
SHA256 e4964b87228012be8f316118b58eedfe27b622a82bc9552a9603fbd924636ae7
MD5 d87eae244b3197c676d75ceb6c7a39c3
SHA1 aa7819d6036691ee0474c1c59fd149bc189640e3
SHA512 0f7a470c95499bc4ec2fd9c84e907513a01734a6d2fa6ada6895f5b0dabe78a37979e6394e9cb0be1595e130ee3f332ea19f262a9aafa726e2a424c64211457a
SSDEEP 384:1PIzu1XdGiLquV+TJfZaKoowhHSIh5Uqi3k3L93:9B1NJpo1fZwow1OH3kZ
TLSH
T172921955AB0B08E8D11AA37C8BF20526D2B278252B33D7CF1357968A1F663D17D3BD42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
offset_finder2.exe

File Explorer

offset_finder2.exe

.exe 20KB

offset_finder2.exe

IMPHASH 5eaa33206d2015585508a633fad7fcaa
SHA256 e4964b87228012be8f316118b58eedfe27b622a82bc9552a9603fbd924636ae7
MD5 d87eae244b3197c676d75ceb6c7a39c3
SHA1 aa7819d6036691ee0474c1c59fd149bc189640e3
SHA512 0f7a470c95499bc4ec2fd9c84e907513a01734a6d2fa6ada6895f5b0dabe78a37979e6394e9cb0be1595e130ee3f332ea19f262a9aafa726e2a424c64211457a
SSDEEP 384:1PIzu1XdGiLquV+TJfZaKoowhHSIh5Uqi3k3L93:9B1NJpo1fZwow1OH3kZ
TLSH
T172921955AB0B08E8D11AA37C8BF20526D2B278252B33D7CF1357968A1F663D17D3BD42
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle OpenProcess VirtualQueryEx GetModuleHandleA GetProcAddress K32EnumProcessModules CreateToolhelp32Snapshot Process32FirstW Process32NextW AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW ReleaseSRWLockExclusive

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?setf@ios_base@std@@QEAAHHH@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

vcruntime140

memcpy __C_specific_handler __current_exception _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate memset __current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strcmp _wcsicmp strlen

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit __p___argv __p___argc _initialize_onexit_table _register_onexit_function _crt_atexit terminate _exit _seh_filter_exe _register_thread_local_exe_atexit_callback _set_app_type exit _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free