ae2c759903d3ce829e691aabe9133e049c87bc8d913670bd7d12e8ce885ab3b6

General

Target
ae2c759903d3ce829e691aabe9133e049c87bc8d913670bd7d12e8ce885ab3b6
Size 180KB
Sample261027-sxpmlaez7r
SHA256 ae2c759903d3ce829e691aabe9133e049c87bc8d913670bd7d12e8ce885ab3b6
MD5 b264d815ecf87dce152764a89e0f0e8c
SHA1 ba2496d8ca8cff868c5401aa97b3cca2407d174b
SHA512 b628b1fd78b77e2efe9ad5c0c063e704560d24251a1f4b4bb45c7dbb4a2f4d2da2377c18366cacbef22d0b9963bd203912da9e1808b0dc9c704957f14bfd0268
SSDEEP 3072:fdGBTUdyb1mniGZgtvir53/okWUzPo3/vuBuUY:F1ycniDYqJUzD
TLSH
T192044A06B7A101F6E9B7C2398AA35A16FB727C05033497EF435006769E2B7D19B3DB90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae2c759903d3ce829e691aabe9133e049c87bc8d913670bd7d12e8ce885ab3b6

File Explorer

ae2c759903d3ce829e691aabe9133e049c87bc8d913670bd7d12e8ce885ab3b6

.dll 180KB

ae2c759903d3ce829e691aabe9133e049c87bc8d913670bd7d12e8ce885ab3b6

IMPHASH bb0274e11ae5bc2610f7389af75e7d5b
SHA256 ae2c759903d3ce829e691aabe9133e049c87bc8d913670bd7d12e8ce885ab3b6
MD5 b264d815ecf87dce152764a89e0f0e8c
SHA1 ba2496d8ca8cff868c5401aa97b3cca2407d174b
SHA512 b628b1fd78b77e2efe9ad5c0c063e704560d24251a1f4b4bb45c7dbb4a2f4d2da2377c18366cacbef22d0b9963bd203912da9e1808b0dc9c704957f14bfd0268
SSDEEP 3072:fdGBTUdyb1mniGZgtvir53/okWUzPo3/vuBuUY:F1ycniDYqJUzD
TLSH
T192044A06B7A101F6E9B7C2398AA35A16FB727C05033497EF435006769E2B7D19B3DB90
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

36292

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Workspace\ShellcodeLoader2026-main-oneExE-youhua\1011\LoadDll\x64\Release\Secur32.pdb

kernel32

FindFirstFileW FindNextFileW lstrlenW FindClose LocalAlloc OpenEventW Sleep SetEvent lstrcatW CloseHandle LoadLibraryW GetProcAddress GetModuleHandleW FreeLibrary lstrcpyW lstrcmpiW QueryPerformanceCounter GetLastError ReadFile CreateFileW GetFileSize WriteFile GetLocalTime GetModuleHandleA WriteConsoleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc GetStdHandle GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap SetFilePointerEx GetStringTypeW SetStdHandle HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode VirtualQuery

user32

wsprintfW MessageBoxW

Name

.text

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ae2c759903d3ce829e691aabe9133e049c87bc8d913670bd7d12e8ce885ab3b6

kernel32

user32

generic