ShinraMeter-BPSR-windows-x64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ShinraMeter-BPSR-windows-x64.exe
Size 19.8MB
Sample261102-a67wesdg94
SHA256 6eabea6ab6a94806af280be41f7f3e2c523d51ba34fe35c808b1ac0e0d286ea8
MD5 da1492acec76ab47a28682c2a7fedac9
SHA1 6ec519d3a6bb9f8e8288474f44511d3f8064ab9b
SHA512 e61234880f410f2aaea680fad2dfd51bc27b0a74c69353236f144c23062f7523b01e4559cecd5bd2f26826ee1c271957077eabe08d6e8174f129dfeed208ee61
SSDEEP 196608:Lpg/849IYLtiwIS+05jTrJl92ewwImUn:f4m4tn+0JTr8eSV
TLSH
T1C9278C43F26391EDD12AC074835AA233FA31BC9D05357ABB5BE18B302E65F605B1DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ShinraMeter-BPSR-windows-x64.exe

File Explorer

ShinraMeter-BPSR-windows-x64.exe

.exe 19.8MB

ShinraMeter-BPSR-windows-x64.exe

IMPHASH 2a629c56c9d25b213a8cd66cbfb14c44
SHA256 6eabea6ab6a94806af280be41f7f3e2c523d51ba34fe35c808b1ac0e0d286ea8
MD5 da1492acec76ab47a28682c2a7fedac9
SHA1 6ec519d3a6bb9f8e8288474f44511d3f8064ab9b
SHA512 e61234880f410f2aaea680fad2dfd51bc27b0a74c69353236f144c23062f7523b01e4559cecd5bd2f26826ee1c271957077eabe08d6e8174f129dfeed208ee61
SSDEEP 196608:Lpg/849IYLtiwIS+05jTrJl92ewwImUn:f4m4tn+0JTr8eSV
TLSH
T1C9278C43F26391EDD12AC074835AA233FA31BC9D05357ABB5BE18B302E65F605B1DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

imm32

ImmAssociateContextEx ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

ntdll

NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

kernel32

GetTimeZoneInformationForYear FreeLibrary GetLastError GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW SetThreadErrorMode AddVectoredExceptionHandler CompareStringOrdinal CreateEventA CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection EnterCriticalSection ExitProcess FlsAlloc FlsFree FlsSetValue FormatMessageA FormatMessageW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetModuleHandleA GetModuleHandleW InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection IsThreadAFiber LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryW LocaleNameToLCID Module32FirstW Module32NextW MultiByteToWideChar OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RemoveVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte GetProcessHeap HeapAlloc HeapFree CloseHandle DuplicateHandle GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetStdHandle GlobalFree LocalFree SetConsoleMode SetConsoleTextAttribute SetLastError WriteConsoleW AreFileApisANSI CopyFileExW CreateDirectoryW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW DeleteFileA DeleteFileW FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FreeEnvironmentStringsW GetCommandLineW GetCurrentDirectoryW GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileType GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetNativeSystemInfo GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetTempPathW GetTickCount GetWindowsDirectoryW GlobalAlloc GlobalLock GlobalSize GlobalUnlock HeapCompact HeapCreate HeapDestroy HeapReAlloc HeapSize HeapValidate LockFile LockFileEx MapViewOfFile MoveFileExW RaiseException ReadFile ReadFileEx RtlUnwindEx SetEndOfFile SetEnvironmentVariableW SetFileInformationByHandle SetFilePointer SetFileTime SystemTimeToFileTime UnlockFile UnlockFileEx UnmapViewOfFile VirtualProtect VirtualQuery WriteFile WriteFileEx __C_specific_handler

bcryptprimitives

ProcessPrng

advapi32

ImpersonateAnonymousToken RevertToSelf

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

comdlg32

GetOpenFileNameW GetSaveFileNameW

dxgi

CreateDXGIFactory1

gdi32

ChoosePixelFormat CreateBitmap CreateCompatibleBitmap CreateRectRgn DeleteObject DescribePixelFormat GetDeviceCaps GetPixelFormat SetBitmapBits SetPixelFormat SwapBuffers

iphlpapi

GetExtendedTcpTable

ole32

OleInitialize RegisterDragDrop RevokeDragDrop CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SafeArrayCreateVector SafeArrayPutElement VariantClear GetErrorInfo SetErrorInfo SysAllocStringLen SysFreeString SysStringLen

opengl32

wglCreateContext wglDeleteContext wglGetCurrentContext wglGetProcAddress wglMakeCurrent

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW

uiautomationcore

UiaGetReservedMixedAttributeValue UiaGetReservedNotSupportedValue UiaHostProviderFromHwnd UiaLookupId UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaReturnRawElementProvider

user32

ChangeDisplaySettingsExW ClientToScreen CreateIconIndirect DisplayConfigGetDeviceInfo EnumDisplayMonitors GetClassInfoExA GetDC GetDisplayConfigBufferSizes GetDpiForWindow GetMonitorInfoW InvalidateRgn MonitorFromPoint MonitorFromRect MonitorFromWindow QueryDisplayConfig RedrawWindow RegisterClassExA RegisterClassExW ReleaseDC ScreenToClient ValidateRect AdjustWindowRectEx AppendMenuW CallWindowProcW ClipCursor CreateIcon CreateIconFromResourceEx CreatePopupMenu CreateWindowExA CreateWindowExW DefWindowProcA DefWindowProcW DestroyCursor DestroyIcon DestroyMenu DestroyWindow DispatchMessageW EnableMenuItem FlashWindowEx GetActiveWindow GetAsyncKeyState GetClientRect GetClipCursor GetCursorPos GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetPropW GetRawInputData GetSystemMenu GetSystemMetrics GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW IsIconic IsProcessDPIAware IsWindowVisible LoadCursorW LoadIconW MapVirtualKeyExW MapVirtualKeyW MessageBoxW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW RegisterRawInputDevices RegisterWindowMessageA RegisterWindowMessageW ReleaseCapture RemovePropW SendInput SendMessageW SetCapture SetCursor SetCursorPos SetForegroundWindow SetPropW SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA ToUnicodeEx TrackMouseEvent TrackPopupMenu TranslateMessage CloseClipboard CloseTouchInputHandle EmptyClipboard GetClipboardData GetTouchInputInfo IsClipboardFormatAvailable OpenClipboard RegisterClipboardFormatW RegisterTouchWindow SetClipboardData

uxtheme

SetWindowTheme

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

combase

CoCreateFreeThreadedMarshaler

comctl32

DefSubclassProc SetWindowSubclass

shell32

DragFinish DragQueryFileW Shell_NotifyIconW

shlwapi

AssocQueryStringW

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _fpreset _hypot _initterm _localtime64 _onexit abort acos acosf asin asinf atan atan2 atan2f atanf calloc ceil ceilf cos cosf cosh coshf exit exp expf floor floorf fmod fmodf fprintf free fwrite tanh log log10 logf malloc memchr memcmp memcpy memmove memset pow powf qsort realloc signal sin sinf sinh sinhf strchr strcmp strcspn strerror strlen strncmp strrchr strspn tan tanf vfprintf wcslen _hypot

Name

.text

Size

13.5MB

Virtual Size

13.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

196KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

574KB

Virtual Size

573KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ShinraMeter-BPSR-windows-x64.exe

dwmapi

imm32

ntdll

kernel32

bcryptprimitives

advapi32

api-ms-win-core-synch-l1-2-0

comdlg32

dxgi

gdi32

iphlpapi

ole32

oleaut32

opengl32

setupapi

uiautomationcore

user32

uxtheme

winhttp

combase

comctl32

shell32

shlwapi

msvcrt

generic