2f42ac6fc885e2007df7c85a4f78d273843cd97667843ba348b81ac12d49158f

General

Target
2f42ac6fc885e2007df7c85a4f78d273843cd97667843ba348b81ac12d49158f
Size 206KB
Sample261001-rxexqavyd1
SHA256 2f42ac6fc885e2007df7c85a4f78d273843cd97667843ba348b81ac12d49158f
MD5 fbc48fb518e37cee9a1633df153c292d
SHA1 de99565adf843b952a555aba9e6c00346a003e35
SHA512 1ecdce48e6c4d350dd6a59f85c3307e37c6d54d8a45de6aed28e1f04829ea2842e7b1d6d7df4a1a634cb26d0abc258543a3c584875508f54f8e3e5e86578dd35
SSDEEP 6144:ePIzHdRS85w7xRf4XPnFqrp/BriTs3Odfl:WI28S9Rfe/UKTsQl
TLSH
T1B6241202A1ACB018ED355CBAA2AE0FBFBB133F935D99143538C899C3C937D446758AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/激活工具/激活工具.exe

File Explorer

2f42ac6fc885e2007df7c85a4f78d273843cd97667843ba348b81ac12d49158f

.zip 206KB
激活工具/激活工具.exe

.exe 2.3MB
激活工具/激活工具.exe.config

.xml 627B
激活工具/激活说明.txt

431B

2f42ac6fc885e2007df7c85a4f78d273843cd97667843ba348b81ac12d49158f

SHA256 2f42ac6fc885e2007df7c85a4f78d273843cd97667843ba348b81ac12d49158f
MD5 fbc48fb518e37cee9a1633df153c292d
SHA1 de99565adf843b952a555aba9e6c00346a003e35
SHA512 1ecdce48e6c4d350dd6a59f85c3307e37c6d54d8a45de6aed28e1f04829ea2842e7b1d6d7df4a1a634cb26d0abc258543a3c584875508f54f8e3e5e86578dd35
SSDEEP 6144:ePIzHdRS85w7xRf4XPnFqrp/BriTs3Odfl:WI28S9Rfe/UKTsQl
TLSH
T1B6241202A1ACB018ED355CBAA2AE0FBFBB133F935D99143538C899C3C937D446758AD5
MD5 SHA1 SHA512 SSDEEP TLSH

激活工具/激活工具.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4943842ae491c0c507879e6675d1ff79a2de3b8cb6e22ed894e0321af5b3c676
MD5 ae05dce43a9b24efc90444bb255d37c4
SHA1 fbcb62f8117fe1d27bd9f3b1d2f9e78cfea21171
SHA512 9f0d4027ffb37d3f0f53e17c246b400b605b72fa32ed2e0e13fce609f9978a694972e3b3fb53830b78960811a4a46d9edf5cdd3608094a9afd65f8c06befce2a
SSDEEP 6144:HKM5zppCrqi0nnnnkST6TpCrqi0nnnnkST6j1HRdiPbSdH85Mnnnnn2BLqA2Vieo:HhzBY1+GnE3hpI
TLSH
T119B57B93D8BD3A32E12E3671F92F4425B5711D6EC6C199887D4E70A40F38209799FBCA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2443074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\DevelopDir\gitDotNet\oldversion_jihuo\ZTRH-KMS\obj\Debug\ZTRH-KMS.pdb

2f42ac6fc885e2007df7c85a4f78d273843cd97667843ba348b81ac12d49158f

激活工具/激活工具.exe

mscoree

dotnet

激活工具/激活工具.exe.config

激活工具/激活说明.txt

Sharing

General

Malware Config

Signatures

File Explorer

2f42ac6fc885e2007df7c85a4f78d273843cd97667843ba348b81ac12d49158f

激活工具/激活工具.exe

mscoree

dotnet

激活工具/激活工具.exe.config

激活工具/激活说明.txt