osu-collect-windows-x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
osu-collect-windows-x64.exe
Size 15.6MB
Sample261024-ncqxpseg96
SHA256 1939963fa517b62480b617a29c50e6e9c518504165455e112c5321a0cb32c8e5
MD5 a95b8e2999c1a3b17bf7ef08a78bf095
SHA1 ca21cebb18375b1e5e6aa4ece562a6e20b1dc3e6
SHA512 95c77752b698905b1b41270ea21ab9d74bc0c6a75d30f05d3e4122137f447cb2d553ba83547358cf7abfc1d7f4d9f855eedf76caa822e4a139c070909c4f9435
SSDEEP 98304:WDsQnRBIz0rWA2P0qoGiVJMnXOufOAYeDTnnhRFCbky5fzbikFJeKiOqUJCAvNRS:hP+cXOufOAYeDTnnMzrrqUJtvXX0w8z
TLSH
T197F62906AB6B94E8C4BAC47483465637BD6130DB0735BAEB45C4572A3F66BF0AB3D304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
osu-collect-windows-x64.exe

File Explorer

osu-collect-windows-x64.exe

.exe 15.6MB

osu-collect-windows-x64.exe

IMPHASH f2b3e8093f1ba05c324e098dfa3504ec
SHA256 1939963fa517b62480b617a29c50e6e9c518504165455e112c5321a0cb32c8e5
MD5 a95b8e2999c1a3b17bf7ef08a78bf095
SHA1 ca21cebb18375b1e5e6aa4ece562a6e20b1dc3e6
SHA512 95c77752b698905b1b41270ea21ab9d74bc0c6a75d30f05d3e4122137f447cb2d553ba83547358cf7abfc1d7f4d9f855eedf76caa822e4a139c070909c4f9435
SSDEEP 98304:WDsQnRBIz0rWA2P0qoGiVJMnXOufOAYeDTnnhRFCbky5fzbikFJeKiOqUJCAvNRS:hP+cXOufOAYeDTnnMzrrqUJtvXX0w8z
TLSH
T197F62906AB6B94E8C4BAC47483465637BD6130DB0735BAEB45C4572A3F66BF0AB3D304
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12126704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

osu_collect.pdb

kernel32

VirtualProtect UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA CreateIoCompletionPort PostQueuedCompletionStatus FreeLibraryAndExitThread GetModuleHandleExW InterlockedPushEntrySList GetQueuedCompletionStatusEx RtlUnwindEx SetFileCompletionNotificationModes DecodePointer ReadFile GetOverlappedResult WriteFile EncodePointer InitializeCriticalSectionEx RaiseException CancelIoEx ReadConsoleInputW FindClose FlushFileBuffers GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateThread UnlockFile WaitForSingleObject GetNumberOfConsoleInputEvents GetExitCodeProcess LoadLibraryExW OutputDebugStringW GetTimeZoneInformation SwitchToThread CloseHandle RtlPcToFileHeader CreateConsoleScreenBuffer LockFileEx GetDiskFreeSpaceW GetVolumePathNameW lstrlenW CompareStringOrdinal ReadFileEx SleepEx WriteFileEx SetLastError GetFullPathNameW WaitForMultipleObjects SetHandleInformation CreateEventW SetFileInformationByHandle SetEnvironmentVariableW SetUnhandledExceptionFilter GetSystemTimeAsFileTime SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx CreateProcessW GetCurrentProcess DuplicateHandle CreateDirectoryW SetThreadStackGuarantee GetCurrentThread RemoveDirectoryW MoveFileExW FindFirstFileExW CreateHardLinkW ExitProcess WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW CreateSymbolicLinkW DeleteFileW ReadConsoleW MultiByteToWideChar WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetFileAttributesW InitializeSListHead SetEndOfFile GetOEMCP GetTempPathW GetACP CancelIo FindNextFileW SetFilePointerEx IsValidCodePage SetStdHandle CreateMutexW GetFileSizeEx GetTempFileNameW UnlockFileEx CreateFile2 SetConsoleActiveScreenBuffer FillConsoleOutputAttribute FillConsoleOutputCharacterA SetConsoleCursorInfo SetConsoleTextAttribute SetEvent ResetEvent GetConsoleScreenBufferInfo SystemTimeToFileTime SetConsoleCursorPosition GetLastError SetConsoleMode LCMapStringEx InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue EnumSystemLocalesW Sleep CreateFileW GetConsoleMode GetUserDefaultLCID IsValidLocale GetStdHandle GetLocaleInfoW GetModuleHandleA GetProcAddress HeapSize GetCurrentThreadId GetProcessHeap HeapFree HeapReAlloc LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetSystemInfo GetSystemTimePreciseAsFileTime QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW AddVectoredExceptionHandler GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW LoadLibraryA HeapAlloc GetModuleFileNameW GetModuleHandleW FormatMessageW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind LoadLibraryExA CreateFileMappingW MapViewOfFile FlushViewOfFile UnmapViewOfFile CreateFileMappingFromApp MapViewOfFileFromApp GetNativeSystemInfo FormatMessageA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetSystemTime LoadLibraryW TerminateProcess WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW LocalFree GetLocaleInfoEx GetExitCodeThread WakeConditionVariable FindFirstFileW GetDiskFreeSpaceExW GetFileAttributesExW AreFileApisANSI CopyFile2 InitOnceBeginInitialize InitOnceComplete GetStringTypeW GetCPInfo FlsAlloc FlsGetValue FlsSetValue FlsFree GetFileType IsProcessorFeaturePresent ExitThread FreeLibrary RtlUnwind

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptFinishHash BCryptGenerateSymmetricKey BCryptSetProperty BCryptOpenAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptHashData BCryptEncrypt BCryptGenRandom

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

send WSASend getaddrinfo connect WSACleanup getsockname getpeername shutdown WSAGetLastError getsockopt recv WSAStartup closesocket setsockopt bind ioctlsocket WSASocketW freeaddrinfo WSAIoctl

ntdll

NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtReadFile NtWriteFile NtOpenFile NtCreateNamedPipeFile

crypt32

CertSetCertificateContextProperty CertOpenStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateChain CertFreeCertificateContext CertFreeCertificateChainEngine CertCloseStore CertCreateCertificateChainEngine CertAddEncodedCertificateToStore

oleaut32

SysFreeString SysStringLen

advapi32

SystemFunction036

user32

ToUnicodeEx GetWindowThreadProcessId GetForegroundWindow GetKeyboardLayout

Name

.text

Size

12.1MB

Virtual Size

12.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

101KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

534KB

Virtual Size

533KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

osu-collect-windows-x64.exe

kernel32

shell32

combase

bcrypt

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

crypt32

oleaut32

advapi32

user32

generic