Memesense CS2.rar
- SHA256 92ee8fd7c74e4aeba198e0b796d3bc637bb7519cdf3f8847203cbb39b60699c0
Password
123
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Memesense CS2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Memesense CS2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Memesense CS2.rar
- Size 91KB
- Sample260918-endbbaab53
- SHA256 92ee8fd7c74e4aeba198e0b796d3bc637bb7519cdf3f8847203cbb39b60699c0
- MD5 4e21ea2f8f18add52436abcde5c477b2
- SHA1 a81421d79326240ceb8e3ecec799bf98ca6f324f
- SHA512 ccdf22d85bbd5160d74dec58ad1119e17e003c75e0bf17e3bfa7fac09981d5ff335966ae75bf86d696ce3598dcd6b14f601460fe680cbf7dbb232130bb76096e
- SSDEEP 1536:uF66mTKg3ZTp0Q6s8LG5v5uLPyEprD0gFUwQ3Kzsmgivt3K/qSgOoC76y+B:us6m1Tp0KvuLPyEhogFM2sCvt3QqOOyQ
- TLSH T18E9302C9600BD1A924C1F7F86824116F4344C3A5AEB47E96803943C836C5C67CEDBFBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Memesense CS2.exe
File Explorer
-
Memesense CS2.rar.rar 91KB
-
Memesense CS2.exe.exe 125KB
Memesense CS2.exe
- IMPHASH 838ebf00106c790e199157fb51d61b1e
- SHA256 2b296bf4753f82ce8d311cc1de3c2e1adda32b309a060eddb7ae110d434c2ab9
- MD5 d668066ee28bb15e4d1cb50eefa0185c
- SHA1 b7498b5a5b235ee1eafc5973225616b89fb94739
- SHA512 ad5260ec49bf53c06c2718fb66e0f5deb600b9e490c18d1dd4c4ab92f2a9ba434e9aa41c5ec72fae9de2b981d209ecf4f2e7a35a6780a971322bc58f01c69496
- SSDEEP 3072:P1dVLvrc+VoekegD3wrLRlW3etAYJC0MJ:P1dVDrc+VoekeQgr1lW3esDJ
- TLSH T1D0C3AF34DA1AB06FD35E9874DA031D06CE62BCCA46A0BBCB57914CD20EE5F60DB2D781
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
6
Entry point
31700
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
WSAStartup
crypt32
CryptStringToBinaryA
kernel32
WriteProcessMemory
WriteFile
CreateMutexA
SuspendThread
ResumeThread
GetModuleHandleA
Sleep
GetLastError
OpenMutexA
InitializeSListHead
LoadLibraryA
CloseHandle
VirtualProtectEx
GetProcAddress
VirtualAllocEx
ReadProcessMemory
CreateProcessW
FreeLibrary
FlushInstructionCache
CreateRemoteThread
GetCurrentProcess
CreateFileA
ReleaseSRWLockExclusive
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
AcquireSRWLockExclusive
TerminateProcess
msvcp140
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?_Xout_of_range@std@@YAXPEBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
wininet
InternetReadFile
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception_context
__current_exception
memset
memcpy
memcmp
__std_exception_copy
__std_exception_destroy
memmove
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
_callnewh
free
_set_new_mode
malloc
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-runtime-l1-1-0
_exit
exit
_register_thread_local_exe_atexit_callback
_initterm
_cexit
_register_onexit_function
_initterm_e
terminate
_get_narrow_winmain_command_line
_c_exit
_initialize_onexit_table
_set_app_type
_initialize_narrow_environment
_invoke_watson
_configure_narrow_argv
_seh_filter_exe
_crt_atexit
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=30, id=261, version=35207,
count=6, id=257, version=35207,
count=153, id=1, productName=Unmarked objects,
count=13, id=257, version=33145,
count=1, id=265, version=35223,
count=1, id=255, version=35223,
count=1, id=258, version=35223,