WIP[.]Keygen[.]x86[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
WIP.Keygen.x86.exe
Size 1.2MB
Sample261030-xhvmhsfc87
SHA256 969195d3210d530d5de68be38777cce11244731f754b9d7f02982a8785c20ad5
MD5 3890dad268592e9eabddd22028de0ff1
SHA1 30390a8555f5063b0fe27b3fbb513f08645c23ef
SHA512 f85cd5deadecb6b40dfbccecd7a1d2d90b7338186aac286dd80764946658642e07223be06d41d176caf3f1d2d9025498ed9897b822d7e5dbb697111abc9741a1
SSDEEP 12288:b2bCstCOxEs2G17jgfefK747ZmhOzZiRZH2wgq:b2bCstC3G1i3
TLSH
T12C453A1033E88462C4B95AB59470C5B18FB0BE2A5B6AC78F76C07EEF39B17C05923657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WIP.Keygen.x86.exe

File Explorer

WIP.Keygen.x86.exe

.exe 1.2MB

WIP.Keygen.x86.exe

IMPHASH d8b4b796089200c34517c4f5a0aedbf7
SHA256 969195d3210d530d5de68be38777cce11244731f754b9d7f02982a8785c20ad5
MD5 3890dad268592e9eabddd22028de0ff1
SHA1 30390a8555f5063b0fe27b3fbb513f08645c23ef
SHA512 f85cd5deadecb6b40dfbccecd7a1d2d90b7338186aac286dd80764946658642e07223be06d41d176caf3f1d2d9025498ed9897b822d7e5dbb697111abc9741a1
SSDEEP 12288:b2bCstCOxEs2G17jgfefK747ZmhOzZiRZH2wgq:b2bCstC3G1i3
TLSH
T12C453A1033E88462C4B95AB59470C5B18FB0BE2A5B6AC78F76C07EEF39B17C05923657
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

66368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW FindClose MultiByteToWideChar GetLastError GetFileAttributesExW GetFullPathNameW GetProcAddress DeleteCriticalSection WideCharToMultiByte IsWow64Process LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc EnterCriticalSection FindFirstFileExW OutputDebugStringW LoadLibraryA GetModuleHandleW InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlUnwind InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_exit __p___argc __p___wargv _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _invalid_parameter_noinfo_noreturn _set_app_type _c_exit _seh_filter_exe _register_thread_local_exe_atexit_callback _errno _cexit _controlfp_s exit abort _crt_atexit _initialize_onexit_table _register_onexit_function terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf_s setvbuf _wfopen _set_fmode __stdio_common_vswprintf __acrt_iob_func fputwc fputws __stdio_common_vfwprintf fflush

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc calloc

api-ms-win-crt-string-l1-1-0

wcsnlen strcpy_s _wcsdup strcspn wcsncmp toupper

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-locale-l1-1-0

__pctype_func _unlock_locales localeconv _lock_locales ___lc_codepage_func ___mb_cur_max_func _configthreadlocale setlocale ___lc_locale_name_func

api-ms-win-crt-math-l1-1-0

__setusermatherr frexp

api-ms-win-crt-time-l1-1-0

_gmtime64_s wcsftime _time64