038401f7850583e67a3ce12172283c9b2c5a97715bc6bf00c4da5e2cfdd39be8

Sharing

Copy URL Twitter E-mail

General

Target
038401f7850583e67a3ce12172283c9b2c5a97715bc6bf00c4da5e2cfdd39be8
Size 209KB
Sample261001-kceynaef54
SHA256 038401f7850583e67a3ce12172283c9b2c5a97715bc6bf00c4da5e2cfdd39be8
MD5 d05cef37a22555634615ea065d0e24b9
SHA1 c6deef308dfd43ab1155086ae5a96da580f9ab8d
SHA512 3131653d4ff3f7545858bc4d281d09d2e71f971a365c33216246cedb51913dadbc2f42ceb543fb95c0dad200539b18692aa4adfc64cdebda6b296148ed821b12
SSDEEP 3072:huLRjq9z6kHXfPv1ada03WPlbe7UegTN331KvEjLmPb2J:huVOHXf1adhAg3hMLub2J
TLSH
T16C249D15B7A514FAE9678534C9420901EA727C460BA0EADF13904BF69F337E09F3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
038401f7850583e67a3ce12172283c9b2c5a97715bc6bf00c4da5e2cfdd39be8

File Explorer

038401f7850583e67a3ce12172283c9b2c5a97715bc6bf00c4da5e2cfdd39be8

.exe 209KB

038401f7850583e67a3ce12172283c9b2c5a97715bc6bf00c4da5e2cfdd39be8

IMPHASH 9200fcdad6c0c3f166a2a61129bb7e3b
SHA256 038401f7850583e67a3ce12172283c9b2c5a97715bc6bf00c4da5e2cfdd39be8
MD5 d05cef37a22555634615ea065d0e24b9
SHA1 c6deef308dfd43ab1155086ae5a96da580f9ab8d
SHA512 3131653d4ff3f7545858bc4d281d09d2e71f971a365c33216246cedb51913dadbc2f42ceb543fb95c0dad200539b18692aa4adfc64cdebda6b296148ed821b12
SSDEEP 3072:huLRjq9z6kHXfPv1ada03WPlbe7UegTN331KvEjLmPb2J:huVOHXf1adhAg3hMLub2J
TLSH
T16C249D15B7A514FAE9678534C9420901EA727C460BA0EADF13904BF69F337E09F3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\hp\.zcode\workspace\default\hvnc-lab\server\hvnc_server.pdb

ws2_32

htons recv connect InetPtonW socket send WSAStartup listen closesocket bind accept WSACleanup WSAGetLastError

gdi32

SelectObject CreateDIBSection CreateCompatibleDC CreateFontW DeleteDC DeleteObject CreateSolidBrush BitBlt

user32

GetGUIThreadInfo ReleaseDC OpenDesktopW SetProcessDPIAware PostQuitMessage PrintWindow LoadCursorW EnumDesktopWindows TranslateMessage CreateDesktopW MapWindowPoints DispatchMessageW CloseDesktop IsWindow ShowWindow GetWindowThreadProcessId GetMessageW DefWindowProcW RealChildWindowFromPoint PostMessageW GetWindowRect GetDC IsWindowVisible FillRect CreateWindowExW SendMessageW GetSystemMetrics RegisterClassExW SetThreadDesktop

gdiplus

GdipCloneImage GdipGetImageEncodersSize GdipFree GdiplusStartup GdiplusShutdown GdipGetImageEncoders GdipSaveImageToStream GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage

ole32

CreateStreamOnHGlobal GetHGlobalFromStream

shell32

ShellExecuteW

kernel32

GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetStringTypeW HeapSize HeapReAlloc CreateFileW WriteConsoleW SetEnvironmentVariableW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteFile GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue GetModuleFileNameW MultiByteToWideChar GetPrivateProfileStringW Sleep GetTickCount64 GetLastError GlobalSize CloseHandle GlobalLock CreateProcessW GetModuleHandleW GlobalUnlock TlsGetValue ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter WakeAllConditionVariable InitializeCriticalSectionEx GetSystemTimeAsFileTime GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc

Name

.text

Size

127KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

038401f7850583e67a3ce12172283c9b2c5a97715bc6bf00c4da5e2cfdd39be8

ws2_32

gdi32

user32

gdiplus

ole32

shell32

kernel32

generic