f51155b371bb766247c755c4d283356c23d9bbb944dfb220830cd9f31e9d577c

Sharing

Copy URL Twitter E-mail

General

Target
f51155b371bb766247c755c4d283356c23d9bbb944dfb220830cd9f31e9d577c
Size 1.1MB
Sample260930-t24gzsys5k
SHA256 f51155b371bb766247c755c4d283356c23d9bbb944dfb220830cd9f31e9d577c
MD5 7676a87af30f7d293885dfbbf2184754
SHA1 f8b4f949f403848173f7b0829aca63e7a88a4800
SHA512 0f8aa38f77f23208ba1ea3e33ff55db56141db55ea78e8e6cec32bda3e9bc991f42d604a1791a1c500749032b6168887a62b050dd47d2394567874b0fdacf68e
SSDEEP 12288:RBtIlGpziZMklVuOyiifuuHj4Aa2U84WPu9LXr49JDCTxFMV7VuDW2kz9j/y1:RUgCwOQ4WPu9LXr4LIFaR
TLSH
T13D351901EBA08018FDF715FA9AFF7078993DB9E1572890C751C42AED9A25AE07C31B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f51155b371bb766247c755c4d283356c23d9bbb944dfb220830cd9f31e9d577c

File Explorer

f51155b371bb766247c755c4d283356c23d9bbb944dfb220830cd9f31e9d577c

.exe 1.1MB

f51155b371bb766247c755c4d283356c23d9bbb944dfb220830cd9f31e9d577c

IMPHASH 0e06550a3cc3557b731ece8b9cf9bdc6
SHA256 f51155b371bb766247c755c4d283356c23d9bbb944dfb220830cd9f31e9d577c
MD5 7676a87af30f7d293885dfbbf2184754
SHA1 f8b4f949f403848173f7b0829aca63e7a88a4800
SHA512 0f8aa38f77f23208ba1ea3e33ff55db56141db55ea78e8e6cec32bda3e9bc991f42d604a1791a1c500749032b6168887a62b050dd47d2394567874b0fdacf68e
SSDEEP 12288:RBtIlGpziZMklVuOyiifuuHj4Aa2U84WPu9LXr49JDCTxFMV7VuDW2kz9j/y1:RUgCwOQ4WPu9LXr4LIFaR
TLSH
T13D351901EBA08018FDF715FA9AFF7078993DB9E1572890C751C42AED9A25AE07C31B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4421

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

T:\01. AI Projects\JX1-VS2022\SwordOnline\Sources\Sword3PaySys\S3AccServer\Debug\Sword3PaySys.pdb

ws2_32

htonl htons closesocket bind socket WSAStartup WSACleanup inet_addr inet_ntoa

kernel32

GetLocaleInfoW DecodePointer SetEndOfFile CreateFileW FlushFileBuffers HeapQueryInformation CloseHandle SetEvent ResetEvent ReleaseMutex WaitForSingleObject CreateMutexA CreateEventA TerminateThread GetModuleFileNameA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetStdHandle CreateDirectoryA FreeLibrary GetProcAddress LoadLibraryA GetConsoleMode SetConsoleMode SetConsoleCtrlHandler IsValidLocale SetConsoleTextAttribute SetConsoleWindowInfo LocalFree GetLastError LocalAlloc FormatMessageA MultiByteToWideChar Sleep GetTickCount LCMapStringW HeapSize HeapReAlloc GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW CompareStringW GetTimeFormatW GetDateFormatW FindClose GetUserDefaultLCID EnumSystemLocalesW GetCurrentThreadId SetConsoleScreenBufferSize UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetFileSizeEx GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW HeapAlloc HeapFree GetProcessHeap VirtualQuery InitializeCriticalSectionEx RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ReadFile CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetFileType WriteConsoleW WriteFile ExitProcess GetCommandLineA GetCommandLineW HeapValidate GetSystemInfo GetCurrentThread ReadConsoleW SetFilePointerEx GetConsoleOutputCP OutputDebugStringW

user32

GetMessageA TranslateMessage DispatchMessageA MessageBoxA

ole32

OleRun CoInitialize CLSIDFromProgID CoUninitialize CoInitializeEx CoCreateInstance CLSIDFromString

oleaut32

VariantInit VariantClear SysFreeString GetErrorInfo SysAllocString VariantChangeType SetErrorInfo CreateErrorInfo

engine

?KGLogUnInit@@YAHPAX@Z ?KGLogInit@@YAHABU_KGLOG_PARAM@@PAX@Z ?KGLogPrintf@@YAHW4KGLOG_PRIORITY@@QBDZZ

Name

.text

Size

856KB

Virtual Size

855KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

192KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f51155b371bb766247c755c4d283356c23d9bbb944dfb220830cd9f31e9d577c

ws2_32

kernel32

user32

ole32

oleaut32

engine

generic