52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9

General

Target
52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9
Size 1.7MB
Sample260930-hl48sshc87
SHA256 52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9
MD5 77f06261d2ad5b4e726445eba2b4a6c8
SHA1 e3fc6ac83a1906e27a1cc17414259c526cc72af8
SHA512 f7d833e1c1c7ecc3abf4406912fafbae86014bbf11f962e26eacd65201ce28c41988f316d1edfb38f501dac9d6800af4e951ce9b0ebe816036a7ee195c974891
SSDEEP 49152:RZivu9n2mf5SfJ4klKXn/h0PWj37y63bTgv/S2:WvYf5SfJ4kmrj37n3YS2
TLSH
T1D285F0203F829836C2B309B90B9DF271075E6D5C0A61865357F4FEABFFEC1626D20656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9

File Explorer

52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9

.exe 1.7MB

52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9

IMPHASH 0053c01cdd0614a49d754b0f32e8777f
SHA256 52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9
MD5 77f06261d2ad5b4e726445eba2b4a6c8
SHA1 e3fc6ac83a1906e27a1cc17414259c526cc72af8
SHA512 f7d833e1c1c7ecc3abf4406912fafbae86014bbf11f962e26eacd65201ce28c41988f316d1edfb38f501dac9d6800af4e951ce9b0ebe816036a7ee195c974891
SSDEEP 49152:RZivu9n2mf5SfJ4klKXn/h0PWj37y63bTgv/S2:WvYf5SfJ4kmrj37n3YS2
TLSH
T1D285F0203F829836C2B309B90B9DF271075E6D5C0A61865357F4FEABFFEC1626D20656
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

81517

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\dailybuild_fix\wegame_client\build\bin\Release\client_launcher.pdb

kernel32

Sleep CloseHandle OpenEventA GetModuleFileNameW CreateProcessW GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW OutputDebugStringA MultiByteToWideChar WideCharToMultiByte WaitForSingleObject RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection WriteConsoleW FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP SetStdHandle TerminateProcess DecodePointer OpenProcess EnterCriticalSection LeaveCriticalSection GetCPInfo EncodePointer SetLastError SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW IsDebuggerPresent OutputDebugStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind FreeLibrary LoadLibraryExW GetFileAttributesExW ExitProcess GetModuleHandleExW GetModuleFileNameA GetStdHandle WriteFile GetCommandLineA GetACP HeapAlloc HeapFree HeapReAlloc GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapSize FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap CreateFileW

user32

SendMessageA FindWindowA

shell32

ShellExecuteExW

advapi32

RegOpenKeyExW RegQueryValueExW

Sharing

General

Malware Config

Signatures

File Explorer

52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9

kernel32

user32

shell32

advapi32

generic