TopazPatcher[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
TopazPatcher.zip
Size 73KB
Sample260922-vxp98sbd27
SHA256 d507dcae35e9cd1fcc83f09e81d52590ccd5780608edaca673bc6aca9b9c9ddf
MD5 826f58ac60538426ec3ce98cb43e35ba
SHA1 e5d8e86f1ba4a899f34a6d284fab53feee8b2db6
SHA512 6f2844f0a52248c0787e5b122dde96b0be265559f98f00a9f6c519f468cd6a1200101c0f9d512c15fdfb34092c34a7367f77d0df0373d07b1c95946b6b021d6e
SSDEEP 1536:eFuUxTC9vLQRC/oGNOykMUX5712P9c6t2Zz6YZSEswYClsu9t:eYmYQMDgXr2zcuY0EswYgz9t
TLSH
T15D73124A46F169A1D57CEA448FAB4349D3C02675CFC4C498A2D9C73C9E029BF4A3B07E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/TopazPatcher.exe

File Explorer

TopazPatcher.zip

.zip 73KB
TopazPatcher.exe

.exe 179KB

TopazPatcher.zip

SHA256 d507dcae35e9cd1fcc83f09e81d52590ccd5780608edaca673bc6aca9b9c9ddf
MD5 826f58ac60538426ec3ce98cb43e35ba
SHA1 e5d8e86f1ba4a899f34a6d284fab53feee8b2db6
SHA512 6f2844f0a52248c0787e5b122dde96b0be265559f98f00a9f6c519f468cd6a1200101c0f9d512c15fdfb34092c34a7367f77d0df0373d07b1c95946b6b021d6e
SSDEEP 1536:eFuUxTC9vLQRC/oGNOykMUX5712P9c6t2Zz6YZSEswYClsu9t:eYmYQMDgXr2zcuY0EswYgz9t
TLSH
T15D73124A46F169A1D57CEA448FAB4349D3C02675CFC4C498A2D9C73C9E029BF4A3B07E
MD5 SHA1 SHA512 SSDEEP TLSH

TopazPatcher.exe

IMPHASH 53e4e12437621212a425d294842d0a96
SHA256 98c075eb97775146391294d2937cf9abaf9ae0f527e2e4cdbe876f94a114b8a4
MD5 1e6cb4bef6bbb9259344bfb78b75afe9
SHA1 e16ad0affec34eeb7a7a142d7a05be694702810a
SHA512 4287fc8866aba062c491ad1c879b8e59e8bce8b7e3773bf69f9c6981908fb1b3c14f1b679bd7250b73ab27ef90f617bd02f4f8550def910cdbd5acf82919983b
SSDEEP 3072:+lDJk88wN1QI7sxrYL1peQ3lOY9SkHNwmlgzaAT5Qgr6ozTnEb6ozi:yAIwxrI14Q3kYBlrvcfkW
TLSH
T1CC043C13A6A811BEE1B3D678C9924901FB72786A4B71A7CF23504E7A1F777D09E35302
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

shell32

ShellExecuteW

advapi32

RegCloseKey ReportEventW RegisterEventSourceW RegOpenKeyExW RegGetValueW DeregisterEventSource

kernel32

TlsFree CreateActCtxW ActivateActCtx GetLastError FindResourceW GetWindowsDirectoryW GetProcAddress GetModuleHandleW FreeLibrary LoadLibraryExW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetStdHandle GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW FindClose GetFileAttributesW MultiByteToWideChar GetConsoleMode GetFileAttributesExW LoadLibraryA WriteConsoleW DeleteCriticalSection WideCharToMultiByte IsWow64Process OutputDebugStringW GetCurrentProcessId TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _exit exit _initterm_e _errno _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort _invoke_watson

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc malloc _callnewh free

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf __p__commode fputwc __acrt_iob_func __stdio_common_vswprintf _set_fmode _wfsopen fflush setvbuf __stdio_common_vsnwprintf_s

api-ms-win-crt-locale-l1-1-0

_create_locale ___mb_cur_max_func ___lc_codepage_func ___lc_locale_name_func __pctype_func _configthreadlocale setlocale _lock_locales _free_locale _unlock_locales

api-ms-win-crt-string-l1-1-0

strlen strcmp wcsncmp toupper strcpy_s _wcsdup wcsnlen

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-math-l1-1-0

__setusermatherr