42b0a09b541f7bc3767c5aee0f233a05c5fc7e638dcc1e43f2c9b62a0ae229d0

Sharing

Copy URL Twitter E-mail

General

Target
42b0a09b541f7bc3767c5aee0f233a05c5fc7e638dcc1e43f2c9b62a0ae229d0
Size 93KB
Sample261014-lrerwafe42
SHA256 42b0a09b541f7bc3767c5aee0f233a05c5fc7e638dcc1e43f2c9b62a0ae229d0
MD5 dbc7c9a0fff26ae1d9b8c5f21937badd
SHA1 e6c0b5d5d52244e7f67b1105db38174054ce9f3e
SHA512 09275e766a0f0d9c7fd15fd0ebdbad8cef48abe9edc8d9d9bf6f89e0251ef58bbc677f524969c5f8711e5a208c4f6727eea51b070f412ee7419daba4ac4c5ea1
SSDEEP 1536:qrteS8vSQWPevO2lNYHS2O25ul3z0aoeITejNiY:qTaK2HYy2bYlRlMAA
TLSH
T16193E81BB69801BCF0A6D2BECAD1DD91E776700E0B616BCF079185728FA26D49D39603
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42b0a09b541f7bc3767c5aee0f233a05c5fc7e638dcc1e43f2c9b62a0ae229d0

File Explorer

42b0a09b541f7bc3767c5aee0f233a05c5fc7e638dcc1e43f2c9b62a0ae229d0

.exe 93KB

42b0a09b541f7bc3767c5aee0f233a05c5fc7e638dcc1e43f2c9b62a0ae229d0

IMPHASH 323a87d8de416c335cdb81970e8f095a
SHA256 42b0a09b541f7bc3767c5aee0f233a05c5fc7e638dcc1e43f2c9b62a0ae229d0
MD5 dbc7c9a0fff26ae1d9b8c5f21937badd
SHA1 e6c0b5d5d52244e7f67b1105db38174054ce9f3e
SHA512 09275e766a0f0d9c7fd15fd0ebdbad8cef48abe9edc8d9d9bf6f89e0251ef58bbc677f524969c5f8711e5a208c4f6727eea51b070f412ee7419daba4ac4c5ea1
SSDEEP 1536:qrteS8vSQWPevO2lNYHS2O25ul3z0aoeITejNiY:qTaK2HYy2bYlRlMAA
TLSH
T16193E81BB69801BCF0A6D2BECAD1DD91E776700E0B616BCF079185728FA26D49D39603
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Q_\LongYinLiZhiZhuan\tools\Il2CppLab\bin\x64\Release_package\LabLauncher.pdb

comctl32

InitCommonControlsEx

comdlg32

GetOpenFileNameW

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

kernel32

GetCurrentProcess GetModuleFileNameW WaitForSingleObject K32EnumProcessModulesEx GetExitCodeThread GetPrivateProfileStringW Sleep GetLastError K32GetModuleBaseNameW CloseHandle CreateThread GetProcAddress VirtualAllocEx CreateProcessW GetModuleHandleW CreateRemoteThread WritePrivateProfileStringW GetTickCount GetExitCodeProcess CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW AreFileApisANSI WriteProcessMemory VirtualFreeEx GetFileInformationByHandleEx WideCharToMultiByte LocalFree FormatMessageA GetLocaleInfoEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime

user32

DispatchMessageW LoadIconW TranslateMessage LoadCursorW GetDlgItem PostQuitMessage UpdateWindow EnableWindow GetWindowTextW MoveWindow ShowWindow GetWindowTextLengthW GetMessageW DefWindowProcW MessageBoxW CreateWindowExW SendMessageW SetWindowTextW RegisterClassExW

gdi32

CreateFontW

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler memmove _CxxThrowException __current_exception __current_exception_context memset

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vswprintf_s __p__commode

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _c_exit _cexit _invoke_watson _initialize_onexit_table exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _register_onexit_function _set_app_type _seh_filter_exe _crt_atexit abort _exit

api-ms-win-crt-string-l1-1-0

_wcsnicmp _wcsicmp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sharing

General

Malware Config

Signatures

File Explorer

42b0a09b541f7bc3767c5aee0f233a05c5fc7e638dcc1e43f2c9b62a0ae229d0

comctl32

comdlg32

advapi32

kernel32

user32

gdi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic