ppSR_REL_4.6.5X.zip
- SHA256 bcd4a729f3e259b1ef80363b64d667ed17739b14e6e2b82972c118ae634aa306
Password
discord.gg/ppSR
Static task
static1
1 signatures
General
- Target ppSR_REL_4.6.5X.zip
- Size 13.8MB
- Sample260930-ag6xtswwbs
- SHA256 bcd4a729f3e259b1ef80363b64d667ed17739b14e6e2b82972c118ae634aa306
- MD5 39a62459c5bc144dffe894b6eb8134f5
- SHA1 fcc717d7cd1dc07154dea101399c2056d582c772
- SHA512 b9e3b3cd6d35df6de5a2ed4c5f79952d287b419013a37ac33a9085ca083ea385acac43ef93230d41cee88c8544473cd2ccd367bb81b6d7df0e57566f9a1d8188
- SSDEEP 393216:933R0aTVcBXG36R3UCXedvH5Ma11lUNuQ0RKbzAnmjs:93mkcxy6R3UnP5Ma11lUNuUvkmjs
- TLSH T1DEE633513B380928E20319B5AE8DE0A33CB76BF9115C9DCB66B9D8C1F51DA1E97C46CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ppSR_REL_4.6.5X/ppsr.exe
File Explorer
-
ppSR_REL_4.6.5X.zip.zip 13.8MB
-
ppSR_REL_4.6.5X/misc/freesr-data.json293KB
-
ppSR_REL_4.6.5X/misc/hotfix.json1KB
-
ppSR_REL_4.6.5X/misc/persistent.json1KB
-
ppSR_REL_4.6.5X/misc/resources/AvatarConfig.json258KB
-
ppSR_REL_4.6.5X/misc/resources/AvatarConfigLD.json10KB
-
ppSR_REL_4.6.5X/misc/resources/AvatarSkin.json11KB
-
ppSR_REL_4.6.5X/ppsr.exe.exe 13.8MB
ppSR_REL_4.6.5X/misc/freesr-data.json
- SHA256 748353b7d933efc5125c57d1e6b2c12c71cef26b363287f9fbea1064a99fa1ca
- MD5 8d30cb141247cb812159e4b43ba32867
- SHA1 b6b2f37066d2161f3fb01c20c63d6389eeb2c2be
- SHA512 5aa91227745b29cedd05dec69625fe15b416a348c196c5b918cbc944bc7ed0d36865c51569be9f589045c62ff30307668a1cb1f92f772a054cad16f36bb6310c
- SSDEEP 384:O/qdTNzwLk3UaJ2m441Oq/X8/E39nZbhpf+jkhnxk0gV5nUQvvSFMWM/+QAUJ6Eo:OCJNzwCvl3fjnbfzqvVxeYExeCZ
- TLSH T1215490A3DA4F38DB69C458B85B3DBBFA88CE573BC870A3F6F0605106610E4690175B67
- MD5 SHA1 SHA512 SSDEEP TLSH
ppSR_REL_4.6.5X/misc/hotfix.json
- SHA256 293a1b293a86b827756533eeee7dd5593b451cd5f51a9eebce88d709be0f57e9
- MD5 9fd059e702b91e4795da858fefe1e996
- SHA1 7e0aff1d3c16dfaa0178520220e28899da597bce
- SHA512 dbd777f750c51d90288cccf36ee080ef66ddc9e28ea318eb7c59ac28accc1b4163ef71145959396a312d1307c37d4dc9b1fc9b84387984ff52bc1953ec5e8d3e
- TLSH T1B62136E7A38564230D9236E825705788E613338B96A5CE87B63FFC880F905DB3155E6A
- MD5 SHA1 SHA512 TLSH
ppSR_REL_4.6.5X/misc/persistent.json
- SHA256 a6ff8fcb1ece315eb023f4b2f770f88774f199586a651953306c8ef11a582281
- MD5 65f8bdfb0a328c3b67a8eedc30af54a8
- SHA1 00ac0bfdf879b78fa26f00a74b7b8ed8cd3e472d
- SHA512 3c70f31cf8ead946541f058270b243ac65c0f0d10dd6836e21779a8f1decd6122593caa7846b73408e744d4800d55e039f600fff4dd6ba693be672888f078ef7
- TLSH T1BA21003ACA586CAA247CD2F8B6B00B07E000279786940C9F3E7C484C4FB6F1323C5A0B
- MD5 SHA1 SHA512 TLSH
ppSR_REL_4.6.5X/misc/resources/AvatarConfig.json
- SHA256 f818dd6aacbe786bd90858c3ae9aecfba0651773c86bc568373029c14dad3055
- MD5 93be8206836d3722f734f782129ccb86
- SHA1 870dd04f575ed4f8e9fd779eff7c199215682c4a
- SHA512 011ad11149e5c118dd42e243084e0692003551750a179b80f016801543d1610cf10a02818bfc795b850553dbeadf6ea275b6d269282a156ce705ab5b53d67412
- SSDEEP 1536:nAAfHeibBQc9jp9A4FR29I63/GUxZIGd7rAltlwpfvPq0tlSCV7wpT+eo9x2Muvl:4iets+xeB
- TLSH T192447921D9B90D1B98099157E029E307869813E3CFB53C11FAAC981D9FACD1F327E799
- MD5 SHA1 SHA512 SSDEEP TLSH
ppSR_REL_4.6.5X/misc/resources/AvatarConfigLD.json
- SHA256 8ed93dd855bd605c242486f7de8b573e564150a3822f37a03bd4f9ba26549621
- MD5 6a1cdb7b90f33429962c2cea0895d277
- SHA1 505745ef42313a56d79462cc4f38d4e0ac02a55f
- SHA512 44941ecafc05bcc13e6824bb4af916572111907f0ea12e47a33f07d88b68bb6694cc9957689771f3aaac1a2fd328d2e5ba77a0c5c5a90046d510080c805ae61a
- SSDEEP 192:DytSqSyh69uganjYFyw6OSXd2rd8jYFyd9OSXd2rd8jYFyqfOSXd2rd8jYFyq:w7Syh6sA9SXd244SXd2jGSXd2t
- TLSH T1FB22BC12D5680D57A8099283F02AE30A4A9813F3CE763C10B76CDC9D9F6CD9F71BE659
- MD5 SHA1 SHA512 SSDEEP TLSH
ppSR_REL_4.6.5X/misc/resources/AvatarSkin.json
- SHA256 b34e5fe482141a31670ea0957631ec29a8a14cb318dc4f677e808ee610e1c452
- MD5 d76d403f8b46cf6a63f9bbcccd54ea8f
- SHA1 1262a5db1fb275c1c574e67384cb3bbef52e6c79
- SHA512 31c21501456a1cd142b52fa33f24b1239bd695d6df312a3d0875f7171c4e404bdec70b067d0faeeede04f0fd3a56e4385054d645db368e0f53b6642bacaa1e44
- SSDEEP 192:YKHM8PBGtiqBTXWI4K2y2H1TvSeeqFhN3+Z0fbuegtdF+mm+uthhMdfDrNjoyth6:TdPBB8iI4a+IeeQOyfbuLDm+r9VjoEw
- TLSH T180322A109DA50D5BA8044287E165F70A5A8907E3CB753C52FBAC9C2E9F7CA2F302F54E
- MD5 SHA1 SHA512 SSDEEP TLSH
ppSR_REL_4.6.5X/ppsr.exe
- IMPHASH 9ba3383e1b2f3edc98f51f2eca370de3
- SHA256 e7e3560e2abe9b47ecc69fc33741f7a28281ef46ab63b9187f51de42b9656c9b
- MD5 0bfa0e10c7adab34b815edbaae262c1c
- SHA1 7e0242fa4d0ee0bdfe73b566a60d5235d1aedb4d
- SHA512 5ce3e934b723bc8af6c7bc6c39e477414d7c3bb9238db43c270793450d7299f441188c744d139f2ac2c2df761e7fe6a6a487a36f29aa2d51c994f1bb33acaf75
- SSDEEP 393216:rrWJ8q8GzUmJvNRxA1CthnxeHnQ01IrXtIfGY4d5lINF:PwzUmfjthwHQcytIP4d5C
- TLSH T1D0E63318EE3522FECD0749BDB56C0DD2F24EBB350665B15F46A2F9092242AED18BC3D4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
discord.gg/ppSR
Minor OS version
0
Major OS version
6
Entry point
53148
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shell32
SHFileOperationW
SHGetFolderPathW
CommandLineToArgvW
kernel32
GetModuleHandleW
IsDebuggerPresent
CreateDirectoryW
SetConsoleCtrlHandler
AddDllDirectory
GetCommandLineW
GetFullPathNameW
GetStdHandle
WriteFile
GetShortPathNameW
TerminateProcess
GetModuleFileNameW
SetEnvironmentVariableW
K32GetModuleFileNameExW
GetEnvironmentVariableW
GetTempPathW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetModuleHandleA
OpenProcess
Sleep
GetLastError
GetCurrentThreadId
CloseHandle
GetProcAddress
GetCurrentProcessId
CreateProcessW
GetSystemTimeAsFileTime
FormatMessageA
QueryPerformanceCounter
SetDllDirectoryW
LoadLibraryExW
GetExitCodeProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
InitializeSListHead
vcruntime140
wcschr
__C_specific_handler
__current_exception
__current_exception_context
memset
memcpy
memmove
api-ms-win-crt-runtime-l1-1-0
terminate
abort
_seh_filter_exe
_set_app_type
__p___wargv
_errno
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
_exit
exit
__p___argc
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_wide_argv
_crt_atexit
_initialize_onexit_table
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
api-ms-win-crt-convert-l1-1-0
mbstowcs
wcstoul
api-ms-win-crt-stdio-l1-1-0
puts
__stdio_common_vsprintf
__stdio_common_vfprintf
_set_fmode
__acrt_iob_func
__p__commode
__stdio_common_vswprintf
api-ms-win-crt-string-l1-1-0
_wcsdup
iswctype
wcsncmp
_wcsicmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13.6MB
Virtual Size
13.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=2, id=253, version=35207,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=19, id=261, version=35207,
count=5, id=257, version=33145,
count=112, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=1, id=264, version=35228,
count=1, id=258, version=35228,