bebb42fbdfed2b70bc93a4640943d0d82d1c4ca100e8efb8bcf08db90751703a

Sharing

Copy URL Twitter E-mail

General

Target
bebb42fbdfed2b70bc93a4640943d0d82d1c4ca100e8efb8bcf08db90751703a
Size 330KB
Sample260831-slps8avble
SHA256 bebb42fbdfed2b70bc93a4640943d0d82d1c4ca100e8efb8bcf08db90751703a
MD5 f55e4129d24a86cc37c5a5b4baf3f40f
SHA1 7ac72fa8260e9fe1df5df3ca15d997660e50b2e6
SHA512 45f16e2b02e5b1e7afc7c45bf1825df1fbb5f2ffec78585501f9c78099c53b10e267dccc60be98012ed5b9171963c48698505f6284b275aac43ea0a57a458d43
SSDEEP 6144:BWUZsTOAO6xcop0M0Y2E++3e94mZ6kdBT:qSBYn2E++39I6k3
TLSH
T1C2745B15E6D510F9E2B7D278CE634506EA727C520B31A7DF239086972F23AD48E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bebb42fbdfed2b70bc93a4640943d0d82d1c4ca100e8efb8bcf08db90751703a

File Explorer

bebb42fbdfed2b70bc93a4640943d0d82d1c4ca100e8efb8bcf08db90751703a

.exe 330KB

bebb42fbdfed2b70bc93a4640943d0d82d1c4ca100e8efb8bcf08db90751703a

IMPHASH 8dd8b300faf2ee3a9c48ae8ce8a026b9
SHA256 bebb42fbdfed2b70bc93a4640943d0d82d1c4ca100e8efb8bcf08db90751703a
MD5 f55e4129d24a86cc37c5a5b4baf3f40f
SHA1 7ac72fa8260e9fe1df5df3ca15d997660e50b2e6
SHA512 45f16e2b02e5b1e7afc7c45bf1825df1fbb5f2ffec78585501f9c78099c53b10e267dccc60be98012ed5b9171963c48698505f6284b275aac43ea0a57a458d43
SSDEEP 6144:BWUZsTOAO6xcop0M0Y2E++3e94mZ6kdBT:qSBYn2E++39I6k3
TLSH
T1C2745B15E6D510F9E2B7D278CE634506EA727C520B31A7DF239086972F23AD48E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

87328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\MaaAssistantArknights\MaaAssistantArknights\build\bin\RelWithDebInfo\MAA.Updater.pdb

kernel32

RemoveDirectoryW WriteFile CloseHandle GetLastError ReleaseMutex WaitForSingleObject CreateMutexW Sleep TerminateProcess CreateProcessW OpenProcess GetLocalTime GetTickCount GetModuleHandleW CopyFileW MoveFileExW ReplaceFileW MultiByteToWideChar WideCharToMultiByte GetConsoleMode WriteConsoleW HeapSize ReadFile SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW HeapReAlloc GetOEMCP GetACP IsValidCodePage SetFilePointerEx GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetFullPathNameW GetFileSizeEx GetUserDefaultLCID IsValidLocale GetFileAttributesW FindNextFileW GetLocaleInfoW LCMapStringW FindFirstFileW FindClose DeleteFileW CreateFileW CreateDirectoryW ReadConsoleW GetStdHandle GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW GetProcAddress GetModuleFileNameW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW RtlUnwind

user32

TranslateMessage LoadCursorW FillRect MessageBoxW GetClientRect SetWindowTextW RedrawWindow SetForegroundWindow UpdateWindow GetSystemMetrics ShowWindow DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW SendMessageW PeekMessageW DispatchMessageW

comctl32

InitCommonControlsEx

shell32

SHFileOperationW

advapi32

RegGetValueW

dwmapi

DwmSetWindowAttribute

gdi32

CreateSolidBrush SetBkColor SetBkMode DeleteObject GetStockObject SetTextColor

Name

.text

Size

212KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bebb42fbdfed2b70bc93a4640943d0d82d1c4ca100e8efb8bcf08db90751703a

kernel32

user32

comctl32

shell32

advapi32

dwmapi

gdi32

generic