ef306dbe503ad825051751047f84dfadfffe885bd4fb9f615eb4c3f410bdbd0e

Sharing

Copy URL Twitter E-mail

General

Target
ef306dbe503ad825051751047f84dfadfffe885bd4fb9f615eb4c3f410bdbd0e
Size 197KB
Sample261110-sdkvasvvbv
SHA256 ef306dbe503ad825051751047f84dfadfffe885bd4fb9f615eb4c3f410bdbd0e
MD5 7951a6a23bd40247cc18aab83a81ab1b
SHA1 0780d6f7d6c6cd341310bce9dd3e70e96ce6a967
SHA512 fa41721aba4adc9ee76d40dc72c8a1fdbcdcdf42a6145a0d3d0d4a5c3601280f97d0ea7e597de1cf238d1f4e0daae3e21cc4eb423dcb13c7d874639aad9162db
SSDEEP 3072:xE3k9/3Td4G2pmKcXLIM61dhFXnEDcfidYvpBmKV0yl8EJcX+He8E9n:xwkx1KcXhwkKa3rXYe8E
TLSH
T1C9143B16E28A53F8E033E1747796DA39B13974113B22E5EF73748A313E71A82763B650
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ef306dbe503ad825051751047f84dfadfffe885bd4fb9f615eb4c3f410bdbd0e

File Explorer

ef306dbe503ad825051751047f84dfadfffe885bd4fb9f615eb4c3f410bdbd0e

.exe 197KB

ef306dbe503ad825051751047f84dfadfffe885bd4fb9f615eb4c3f410bdbd0e

IMPHASH 1f95895068516629e45cc8a0e50d05ce
SHA256 ef306dbe503ad825051751047f84dfadfffe885bd4fb9f615eb4c3f410bdbd0e
MD5 7951a6a23bd40247cc18aab83a81ab1b
SHA1 0780d6f7d6c6cd341310bce9dd3e70e96ce6a967
SHA512 fa41721aba4adc9ee76d40dc72c8a1fdbcdcdf42a6145a0d3d0d4a5c3601280f97d0ea7e597de1cf238d1f4e0daae3e21cc4eb423dcb13c7d874639aad9162db
SSDEEP 3072:xE3k9/3Td4G2pmKcXLIM61dhFXnEDcfidYvpBmKV0yl8EJcX+He8E9n:xwkx1KcXhwkKa3rXYe8E
TLSH
T1C9143B16E28A53F8E033E1747796DA39B13974113B22E5EF73748A313E71A82763B650
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

47:99:c7:80:be:e0:81:d8:95:fa:51:ad:9c:d1:46:f9:e9:db:3b:81:5e:26:26:3e:6a:43:a7:cb:02:fa:0a:7d:d4:6e:8e:bb:9e:77:13:8c:3b:52:6a:f8:3e:89:a4:b1

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Return Home Project,O=Return Home Project,C=US

Chains

Nov 10, 2026

CN=Return Home Project,O=Return Home Project,C=US

Minor OS version

Major OS version

Entry point

5312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetTokenInformation GetUserNameA GetUserNameW LookupAccountSidA OpenProcessToken

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenRandom BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

iphlpapi

GetAdaptersAddresses

kernel32

CloseHandle CreateDirectoryW CreateEventA CreateFileA CreateFileW CreatePipe CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW GetComputerNameA GetComputerNameExW GetComputerNameW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetDriveTypeA GetExitCodeProcess GetFileSize GetFileSizeEx GetLastError GetLogicalDrives GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetNativeSystemInfo GetProcAddress GetProcessHeap GetProcessIoCounters GetStartupInfoA GetTickCount GetTickCount64 HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByteEx IsWow64Process LeaveCriticalSection LoadLibraryA MultiByteToWideChar OpenProcess PeekNamedPipe Process32First Process32Next ProcessIdToSessionId QueryPerformanceCounter ReadFile RemoveDirectoryW SetCurrentDirectoryW SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualAlloc VirtualFree VirtualFreeEx VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _atoi64 _cexit _commode _errno _fmode _initterm _onexit _strdup _stricmp _strnicmp _time64 _vsnwprintf _wcsicmp _wfopen _wtoi abort atoi calloc exit fclose ferror fprintf fputc fread free fseek ftell fwrite getc islower isspace isupper isxdigit localeconv malloc mbstowcs memchr memcmp memcpy memset puts realloc signal strchr strcmp strcpy strerror strlen strncmp strncpy strrchr strstr strtok strtol strtoul tolower toupper towlower towupper ungetc vfprintf wcschr wcscmp wcscpy wcscpy_s wcslen wcsncmp wcsrchr

ole32

CoInitialize CoUninitialize

psapi

GetProcessMemoryInfo

ws2_32

inet_ntop

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetNumberValue cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithLength cJSON_ParseWithLengthOpts cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_SetValuestring cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ef306dbe503ad825051751047f84dfadfffe885bd4fb9f615eb4c3f410bdbd0e

PE Signature issue

advapi32

bcrypt

iphlpapi

kernel32

msvcrt

ole32

psapi

ws2_32

generic