efc026b0f7b33cd7318590794518008d51c46bfaa4d764d195f3bddfcdd6e6c1

Sharing

Copy URL Twitter E-mail

General

Target
efc026b0f7b33cd7318590794518008d51c46bfaa4d764d195f3bddfcdd6e6c1
Size 736KB
Sample261027-ar54aaat7n
SHA256 efc026b0f7b33cd7318590794518008d51c46bfaa4d764d195f3bddfcdd6e6c1
MD5 41ebfee344de713047d94d45f429d542
SHA1 864f3795b0701b5fcc79ddc267c9cecc08d8d2bb
SHA512 d59df3e48e3569d863de9aabf9c7e4977952eb629031a788b73c5ba44c4b781100cf48ffa6d8ae02c559f0958797ab3cc467891c5234eb0c7bd0dd743c4c2dd2
SSDEEP 6144:2/wqSFBa56a0o3yANOP6Keck6+I4lOkxhv+2+z4eJCpzpMi5wn2PqAC4CqTNjrOy:2/cu0Wy+cwpl/hvIi+Rj4CorOfCG4Gi
TLSH
T1D9F42B42DBFD4194F2F7A7348AB64343AA72BC59AB38D2CF1615561D0D367E09E38322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efc026b0f7b33cd7318590794518008d51c46bfaa4d764d195f3bddfcdd6e6c1

File Explorer

efc026b0f7b33cd7318590794518008d51c46bfaa4d764d195f3bddfcdd6e6c1

.exe 736KB

efc026b0f7b33cd7318590794518008d51c46bfaa4d764d195f3bddfcdd6e6c1

IMPHASH 6deeedaef32c03a5d0c46cfea44dbc30
SHA256 efc026b0f7b33cd7318590794518008d51c46bfaa4d764d195f3bddfcdd6e6c1
MD5 41ebfee344de713047d94d45f429d542
SHA1 864f3795b0701b5fcc79ddc267c9cecc08d8d2bb
SHA512 d59df3e48e3569d863de9aabf9c7e4977952eb629031a788b73c5ba44c4b781100cf48ffa6d8ae02c559f0958797ab3cc467891c5234eb0c7bd0dd743c4c2dd2
SSDEEP 6144:2/wqSFBa56a0o3yANOP6Keck6+I4lOkxhv+2+z4eJCpzpMi5wn2PqAC4CqTNjrOy:2/cu0Wy+cwpl/hvIi+Rj4CorOfCG4Gi
TLSH
T1D9F42B42DBFD4194F2F7A7348AB64343AA72BC59AB38D2CF1615561D0D367E09E38322
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

270544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\MouriNaruto\NanaZip\Output\Binaries\Release\x64\NanaZip.Core.Windows.pdb

shlwapi

SHAutoComplete

kernel32

FormatMessageW LocalFree GlobalAlloc GlobalFree GetProcAddress GetModuleHandleW GetSystemDirectoryW GetVersion CreateDirectoryW HeapFree SetLastError CreateFileW GetFileAttributesW CreateEventW CloseHandle HeapAlloc GetProcessHeap QueryPerformanceCounter MultiByteToWideChar WideCharToMultiByte GetCurrentThread GetCurrentThreadId MulDiv GetProcessId GetCurrentDirectoryW DeleteFileW RemoveDirectoryW SetFileAttributesW SetFileTime GetCurrentProcessId MoveFileW FindClose FindFirstFileW FindNextFileW GetLogicalDriveStringsW FindFirstStreamW FindNextStreamW GetFileSize SetEndOfFile SetFilePointer GlobalMemoryStatusEx GetSystemInfo GetModuleHandleA GetProcessAffinityMask FileTimeToSystemTime InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateSemaphoreW ResumeThread VirtualAlloc VirtualFree GetSystemTimeAsFileTime IsProcessorFeaturePresent GetProcessMitigationPolicy SetProcessMitigationPolicy SetThreadInformation VirtualProtect VirtualAllocEx VirtualProtectEx SystemTimeToFileTime SystemTimeToTzSpecificLocalTimeEx TzSpecificLocalTimeToSystemTimeEx SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualQuery SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleFileNameW GlobalUnlock GlobalLock GetTickCount Sleep WaitForMultipleObjects LoadLibraryExW GetCurrentProcess SetPriorityClass DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CompareFileTime GetLastError GetFileInformationByHandle WriteFile GetStdHandle ReadFile ExitProcess GetCommandLineW GetStartupInfoW InitializeSListHead

user32

GetSysColorBrush FillRect FrameRect OffsetRect GetWindowLongW SetWindowLongW EnumChildWindows GetClassNameW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo GetDpiForWindow GetWindowModuleFileNameW GetMenuBarInfo AttachThreadInput SetWindowPos SetActiveWindow GetForegroundWindow SetForegroundWindow GetWindowThreadProcessId CharUpperW GetSysColor GetClientRect ReleaseDC GetWindowDC GetMenuItemInfoW GetMenu GetWindowTextLengthW GetWindowTextW LoadStringW MonitorFromWindow SetWindowLongPtrW GetWindowLongPtrW GetMonitorInfoA MapDialogRect SystemParametersInfoW DialogBoxParamW GetComboBoxInfo OpenClipboard CloseClipboard EmptyClipboard SetClipboardData SetTimer LoadIconW LoadCursorW SetCursor EnableWindow InvalidateRect GetDlgItem SetFocus MoveWindow SetDlgItemTextW ShowWindow KillTimer GetParent IsDlgButtonChecked CheckDlgButton DestroyIcon GetWindowRect ScreenToClient SetWindowTextW EndDialog SendMessageW GetFocus PostMessageW GetKeyState MapWindowPoints

gdi32

SetTextColor SetBkColor GetStockObject CreateSolidBrush

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHCreateItemFromParsingName SHGetFileInfoW SHGetPathFromIDListW SHGetIDListFromObject

ole32

CoInitialize CoUninitialize CoCreateInstance CoTaskMemFree OleInitialize

oleaut32

VariantClear SysAllocStringLen SysFreeString SysStringLen SysAllocString

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea DwmGetWindowAttribute

uxtheme

DrawThemeTextEx SetWindowTheme OpenThemeData CloseThemeData DrawThemeBackground ord47 DrawThemeText GetThemeColor GetWindowTheme

ucrtbase

__current_exception __current_exception_context memcmp _beginthreadex _wcsicmp wcslen wcscmp wcsrchr malloc strncpy_s _stricmp _callnewh _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate _seh_filter_exe _set_app_type __setusermatherr _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _set_fmode _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode __C_specific_handler _purecall __std_exception_copy __std_exception_destroy __std_terminate __CxxFrameHandler4 memmove memset memcpy _CxxThrowException wcsstr free

comctl32

ord413 ord410 ord345

Name

.text

Size

278KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

341KB

Virtual Size

340KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

efc026b0f7b33cd7318590794518008d51c46bfaa4d764d195f3bddfcdd6e6c1

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

dwmapi

uxtheme

ucrtbase

comctl32

generic