Windows_activation_[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Windows_activation_.exe
Size 2.0MB
Sample260823-zsys2azgnc
SHA256 15c8aee0beddebe3eae3d666de68737fa9aa5b211540cbaa83ff03f0011f5224
MD5 b4a32a8cb456c434429658fb4d440a71
SHA1 9634db91736a90b52f391ed958e30c39207ac58e
SHA512 f0908ba0d49680ddb333ee8589ea16d236ab2a2114d6d99b7edbdb920e8d3740bedc6d556f4cefdfda46d3377a1813f9b87f4fa42af9064a90d001e15ec7ce44
SSDEEP 12288:mu/va+3zyqxan5rDyUq8Gvu5LVtlhLNzDhTLaniXh3kYBIeKuowv6Y8o:Dva+an5rDyUq8GveLLTLNzpa0k01ao
TLSH
T1CAA55006E7B610CDECB6DD3994522229B8713E95473897FFD245BA0A0B31BE4A93D703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows_activation_.exe

File Explorer

Windows_activation_.exe

.exe 2.0MB

Windows_activation_.exe

IMPHASH 67bbe39654f7dd7ba84832d114fcddbc
SHA256 15c8aee0beddebe3eae3d666de68737fa9aa5b211540cbaa83ff03f0011f5224
MD5 b4a32a8cb456c434429658fb4d440a71
SHA1 9634db91736a90b52f391ed958e30c39207ac58e
SHA512 f0908ba0d49680ddb333ee8589ea16d236ab2a2114d6d99b7edbdb920e8d3740bedc6d556f4cefdfda46d3377a1813f9b87f4fa42af9064a90d001e15ec7ce44
SSDEEP 12288:mu/va+3zyqxan5rDyUq8Gvu5LVtlhLNzDhTLaniXh3kYBIeKuowv6Y8o:Dva+an5rDyUq8GveLLTLNzpa0k01ao
TLSH
T1CAA55006E7B610CDECB6DD3994522229B8713E95473897FFD245BA0A0B31BE4A93D703
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

726929

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\NickTsl\source\repos\winact\x64\Debug\winact.pdb

kernel32

FormatMessageA EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LocalFree EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException QueryPerformanceCounter GetCurrentProcessId InitializeSListHead GetStartupInfoW GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW HeapSize HeapValidate GetSystemInfo GetModuleHandleExW GetStdHandle WriteFile ExitProcess GetCommandLineA GetCommandLineW GetCurrentThread CloseHandle WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW HeapReAlloc HeapQueryInformation GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW DeleteFileW GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW SetEndOfFile RtlUnwind

Name

.textbss

Size

Virtual Size

691KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

338KB

Virtual Size

338KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

329B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

437B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

163KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Windows_activation_.exe

kernel32

generic