17102026_1802_14102026_ការប្រៀបធៀបប្រាក់បៀវត្សរ៍៖ មជ្ឈមណ្ឌលបោកប្រាស់ផ្សេងៗ.exe.zip
- SHA256 1f04b5af587fe66262c303cc2ff79986a657e1b1e3446b51127de0bb814bcda7
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ការប្រៀបធៀបប្រាក់បៀវត្សរ៍៖ មជ្ឈមណ្.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
300 seconds
Behavioral task
behavioral2
Sample
ការប្រៀបធៀបប្រាក់បៀវត្សរ៍៖ មជ្ឈមណ្.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
300 seconds
General
- Target 17102026_1802_14102026_ការប្រៀបធៀបប្រាក់បៀវត្សរ៍៖ មជ្ឈមណ្ឌលបោកប្រាស់ផ្សេងៗ.exe.zip
- Size 816KB
- Sample261017-wmf49axvbx
- SHA256 1f04b5af587fe66262c303cc2ff79986a657e1b1e3446b51127de0bb814bcda7
- MD5 bf95539003870b840e4463f169871eb3
- SHA1 f4cb6bc655a584bc2fb996a1c62282b50bb0f634
- SHA512 b7e60f7a877579430d25cd65e920e14a494dbd78f29b25859abb91f19602cc7087b1adf8a56652ab35c099d935a80150b287ad580a1a1a314a7b93077cc70685
- SSDEEP 12288:ua68fAb1ruKTyxOOZAWYO9CdHLhJndNL+APdUF0+Y9fT7jYUblZNTMl/ReUxL6sM:uaZfq5XTy/AWNAHLVNLDdUuJPbpnx
- TLSH T13005339B24F8166A88C55FF383C6FA7D6DD1024202DEFD1F04BB795A6A71C26D0E1683
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ការប្រៀបធៀបប្រាក់បៀវត្សរ៍៖ មជ្ឈមណ្ឌលបោកប្រាស់ផ្សេងៗ.exe
File Explorer
-
17102026_1802_14102026_ការប្រៀបធៀបប្រាក់បៀវត្សរ៍៖ មជ្ឈមណ្ឌលបោកប្រាស់ផ្សេងៗ.exe.zip.zip 816KB
-
ការប្រៀបធៀបប្រាក់បៀវត្សរ៍៖ មជ្ឈមណ្ឌលបោកប្រាស់ផ្សេងៗ.exe.exe 2.1MB
ការប្រៀបធៀបប្រាក់បៀវត្សរ៍៖ មជ្ឈមណ្ឌលបោកប្រាស់ផ្សេងៗ.exe
- IMPHASH 5af7e3b0e349e03abf417b0fad1212f7
- SHA256 537230534fae312b4d1247ed4987990bb2cae9c71affb9bf041ce43cb7066554
- MD5 d0a915ae51cc846d30f5b67721668130
- SHA1 b336c53fa7742a351ef9e23e891a4c9d29b97ac0
- SHA512 808655c0e31390da8fd323c1d7e9e9063ddec4c2f0cd49d59c7c75ad2b6924a725e0f523ba9b545345dc3e02cd953f44725d678a95166661b01ed295f4e6f477
- SSDEEP 24576:QCvnXZkdlwP4aHHjnNIkG889X4asVrvcEvsjpSVaEmbSQgJekS:QCvpkdlPIHjc9X4asVrvj0jApmLc
- TLSH T123A55C03B16580DEE06AD9F9874A8131E5F07C9907B5A2CF1280BB561FB7BE41B3E764
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
2
Major OS version
5
Entry point
1164736
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\data\agent-x\workspace\crashpad_win\wxcrashpad\src\out\release\crashpad_handler.exe.pdb
kernel32
AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
AssignProcessToJobObject
CloseHandle
CompareStringW
ConnectNamedPipe
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateNamedPipeW
CreateProcessW
CreateSemaphoreW
CreateThread
DecodePointer
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DisconnectNamedPipe
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FindResourceExW
FindResourceW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessId
GetProcessTimes
GetProductInfo
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDefaultLCID
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadId
GetThreadLocale
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
HeapAlloc
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitOnceExecuteOnce
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSListHead
IsDBCSLeadByte
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32GetModuleFileNameExW
K32GetProcessMemoryInfo
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalFree
LockFileEx
LockResource
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenProcess
OpenThread
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReadProcessMemory
RegisterWaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryW
RemoveVectoredExceptionHandler
ReplaceFileW
ResetEvent
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetHandleInformation
SetLastError
SetNamedPipeHandleState
SetProcessShutdownParameters
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepConditionVariableSRW
SleepEx
SuspendThread
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransactNamedPipe
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnlockFileEx
UnmapViewOfFile
UnregisterWaitEx
UpdateProcThreadAttribute
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
Wow64GetThreadContext
WriteConsoleW
WriteFile
WriteProcessMemory
lstrcpyW
lstrlenA
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
GetHandleVerifier
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
199KB
Virtual Size
199KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
59KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
172B
Characteristics
Name
.tls
Size
512B
Virtual Size
297B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
CPADinfo
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
463KB
Virtual Size
462KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ