skipframesv2.rar
- SHA256 90134ba0f4e8b0bcc3a7a145dacefc605bf2b13e67cd47e5cc6f89dedaec4592
Static task
static1
1 signatures
General
- Target skipframesv2.rar
- Size 146KB
- Sample261001-tmp12s1tcy
- SHA256 90134ba0f4e8b0bcc3a7a145dacefc605bf2b13e67cd47e5cc6f89dedaec4592
- MD5 98ef36a0d6301e200006265443fccde5
- SHA1 ffb6f12e1d19c0627d015252d2581d3b15e18971
- SHA512 58a7c9589bfe2e9a122fbcbc273a778c4a43627c5d9a2192203ec5a503bcddf0c0aa1351b9dd4d483e4e7a4cb15bcaa45dd556bb4094e1e6a434f80e765ca6ae
- SSDEEP 3072:V8v2dE8oiUi/+3BcJG9PhFq5G/ri1xqG1irbgpMP+zfTHn:KPVO4SqPhFAoqxqE6gyP+zfT
- TLSH T15AE3122D2B623B833A930C7DCD92E5C786A6391E209134EE8BE7C6C1A45DFA55101F99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/skipframesv2/sfv2-multi.exe unpack001/skipframesv2/sfv2.asi
File Explorer
-
skipframesv2.rar.rar 146KB
-
skipframesv2/how to use.txt1KB
-
skipframesv2/inject.jpeg20KB
-
skipframesv2/sfv2-multi.exe.exe 141KB
-
skipframesv2/sfv2.asi.dll 123KB
skipframesv2/how to use.txt
- SHA256 70f752eb7a19eb4922dc3afa51eff5773488f3436519a48a983d6df84f35dcdd
- MD5 252b00deb1ddab27f238ef7ef1970bf5
- SHA1 fc54f9a22f5fd2c36bee211ca30cd3f1440d9fdb
- SHA512 92b36cb69fcb894ab962ed4bba90d10d53cce15b641beb8de70d67641d872b66bd79b6400bb76abfd2709090f322a3aafd5893ee83b955d0c32dca8fa421b751
- TLSH T14221F33F7C8D62BBA0B29020634ED6E6FB9CC1A9D462C791693AD45C3537E5AC50F4C8
- MD5 SHA1 SHA512 TLSH
skipframesv2/inject.jpeg
- SHA256 a9b4c6434d8e0a5b80eff8a1b7066e2933db50294402877ec4cf410cc1eb8693
- MD5 c25f0b37f09adc31c286d20c34f32733
- SHA1 25f6dc3e77d3bf8d6404fedf6cdd8933a724f974
- SHA512 b044bf4734157df37582f5b2bacaa0ef605add2c2803bed6d0c09487a296f1b2f002aa202a00ff07b70f929c817d5c23aadcc7e191e0374bb1e7684ead7c2567
- SSDEEP 384:DJkTDIjpXuFu3aUB/mxswyU741UipLn3Jmoz1PzOrXwcZba6yGl:Fkoh3asQ+CQL5mc1zOrAQlyo
- TLSH T18D92AF51EF84CDBBD946A6F1D346673F1E8D412AEEA0783C02CC15D6B681F241B7681C
- MD5 SHA1 SHA512 SSDEEP TLSH
skipframesv2/sfv2-multi.exe
- IMPHASH b3fcbba7e1b52a5590cd4223f48f9dbf
- SHA256 727d5befd188ccb2db25e3dac5f6d666468e71e946443f9417b581696a3cb6f8
- MD5 5b982ce137f2339e5e8c224383c1a571
- SHA1 1af0921c69cc0d372eddff09a273bae18d69096b
- SHA512 edf0d3597f8545049a0a9bc75c24858ab9587d7a34151c1ebacd9100912522a10b21d8c616ae85c01098d6f6c09d780c765b83d74957e005dad437b389f2a067
- SSDEEP 3072:Mfau4Tlhp7e8o/9jb1pfQBF8TVCG5hHj1b3LjxAGAIgIOLr7Q:N97e8qb/fQzIVR5FjZXxhELr8
- TLSH T190E37C01B5D084B2D5AE19391430DBB69B3FB930DF605EDBA7840A7A1F702C1DE39D6A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
11602
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\HujuJ\Downloads\skipframes\injectors\injector - sfv2\Release\DLL byte injector.pdb
kernel32
WriteProcessMemory
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
LoadLibraryA
Process32FirstW
CloseHandle
LoadLibraryW
GetProcAddress
VirtualAllocEx
CreateRemoteThread
VirtualFreeEx
lstrcmpW
WideCharToMultiByte
SetConsoleTextAttribute
GetStdHandle
SetConsoleTitleA
SetConsoleMode
GetModuleHandleA
GetCommandLineA
GetConsoleMode
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
Sleep
msvcp140
?_Xlength_error@std@@YAXPBD@Z
_Query_perf_counter
_Query_perf_frequency
vcruntime140
memcpy
__current_exception
__std_exception_destroy
__CxxFrameHandler3
_CxxThrowException
__current_exception_context
memset
__std_exception_copy
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_register_onexit_function
exit
terminate
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_controlfp_s
_cexit
__p___argv
__p___argc
_invalid_parameter_noinfo_noreturn
_exit
_initterm_e
_initterm
_initialize_narrow_environment
_configure_narrow_argv
_c_exit
_set_app_type
_seh_filter_exe
_get_initial_narrow_environment
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
__p__commode
_set_fmode
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
127KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=34321,
count=4, id=259, version=34321,
count=12, id=260, version=34321,
count=25, id=261, version=34321,
count=3, id=257, version=30795,
count=92, id=1, productName=Unmarked objects,
count=5, id=264, version=34436,
count=1, id=255, version=34436,
count=1, id=258, version=34436,
skipframesv2/sfv2.asi
- IMPHASH 574b396aca635ab763589889f0241729
- SHA256 f3cae4ba69f3d74987a55b8aac3fcae1fc0450265beb895fa2db5dc60a955734
- MD5 4283db49340ab77a3397290c8cece26e
- SHA1 31f2c393c41308fd8eefa95ab04ce3ddd1e8845b
- SHA512 257b0f2d4fed142f071e3870c2e450d09893b6606aa5353dfab0b93b9a5558bc2e3b7b6b5fe00c6ec8d799eeefc6acfcffdd67d47429ed0174d504ad3df692d2
- SSDEEP 3072:m73mZG9drp3ImddKFCA91LUoNP8VB88wtIYo9x:kmg3IuQFH9FU9gqx
- TLSH T1BFC37D01B59080B2D5AE19391830DB769B3FB930CF606EDB6744167A5F742C1CE39EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
16868
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualProtect
GetModuleHandleA
IsBadReadPtr
Sleep
GetModuleFileNameA
SetPriorityClass
GetCurrentProcess
SetThreadPriority
DisableThreadLibraryCalls
GetCurrentThread
CloseHandle
CreateThread
GetProcAddress
FreeLibrary
WriteConsoleW
CreateFileW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
VirtualQuery
user32
GetAsyncKeyState
Name
.text
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=139, id=261, version=30795,
count=20, id=260, version=30795,
count=1, id=253, version=34321,
count=22, id=259, version=34321,
count=18, id=260, version=34321,
count=36, id=261, version=34321,
count=5, id=257, version=30795,
count=97, id=1, productName=Unmarked objects,
count=9, id=265, version=34436,
count=1, id=258, version=34436,