1328441af8f4a551bc2a117281319c9c914b5b610b53f5286874c4c6582e7caa

General

Target
1328441af8f4a551bc2a117281319c9c914b5b610b53f5286874c4c6582e7caa
Size 146KB
Sample260916-ynswjss1bs
SHA256 1328441af8f4a551bc2a117281319c9c914b5b610b53f5286874c4c6582e7caa
MD5 d04b3a7739a2fd18893eba5dd2f67730
SHA1 aebdcdcc9b3e117434277686921b5c7ef0183233
SHA512 5056b21eaf9d44db76b92002027c3dd4074de48dd4f686bb28573855a04216894976307eea7a534dc6e892490116b3d074c1918eeb1b4a27b2d5d3b35eb0c6fb
SSDEEP 3072:VI4qUEqcMygcP7a4+Ev9NpYGeW+5j3//2U3foqbNTsvkepw5xyvTZzMx8mQXS:VI4qUqMZN4+ipN+x3nlPocTkpwkQCXXS
TLSH
T1EEE37D027580C472E97E1639C0B6C6718B3FBD218BE4CDCB67985A7D5F601C19E3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1328441af8f4a551bc2a117281319c9c914b5b610b53f5286874c4c6582e7caa

File Explorer

1328441af8f4a551bc2a117281319c9c914b5b610b53f5286874c4c6582e7caa

.dll 146KB

1328441af8f4a551bc2a117281319c9c914b5b610b53f5286874c4c6582e7caa

IMPHASH 49b49f0954650ba9a8d14c8cd649ad27
SHA256 1328441af8f4a551bc2a117281319c9c914b5b610b53f5286874c4c6582e7caa
MD5 d04b3a7739a2fd18893eba5dd2f67730
SHA1 aebdcdcc9b3e117434277686921b5c7ef0183233
SHA512 5056b21eaf9d44db76b92002027c3dd4074de48dd4f686bb28573855a04216894976307eea7a534dc6e892490116b3d074c1918eeb1b4a27b2d5d3b35eb0c6fb
SSDEEP 3072:VI4qUEqcMygcP7a4+Ev9NpYGeW+5j3//2U3foqbNTsvkepw5xyvTZzMx8mQXS:VI4qUqMZN4+ipN+x3nlPocTkpwkQCXXS
TLSH
T1EEE37D027580C472E97E1639C0B6C6718B3FBD218BE4CDCB67985A7D5F601C19E3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

30319

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Q:\VPNGame_source\vpngame020522_secserv\node_modules\ffi\build\Release\ffi_bindings.pdb

kernel32

GetCurrentThreadId SetLastError SetErrorMode GetModuleHandleA MultiByteToWideChar GetLastError LoadLibraryW GetErrorMode GetProcAddress FreeLibrary VirtualProtect VirtualFree VirtualAlloc Sleep GetSystemInfo VirtualQuery UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RaiseException InterlockedFlushSList EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RtlUnwind GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile OutputDebugStringW HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap FlushFileBuffers GetConsoleCP GetConsoleMode GetFileSizeEx SetFilePointerEx GetStringTypeW SetStdHandle HeapSize HeapReAlloc CloseHandle CreateFileW DecodePointer LoadLibraryExA

Sharing

General

Malware Config

Signatures

File Explorer

1328441af8f4a551bc2a117281319c9c914b5b610b53f5286874c4c6582e7caa

kernel32

generic