h.zip
- SHA256 4931a2e6776f6f201c414de0ff1185a0b0fbe4a7ac8a2eca9c3818739ef7ed9b
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
h/OnlineFix64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target h.zip
- Size 10.4MB
- Sample261110-ybd7mac15v
- SHA256 4931a2e6776f6f201c414de0ff1185a0b0fbe4a7ac8a2eca9c3818739ef7ed9b
- MD5 e5d26991de3f60acc859e0b8eb4888f3
- SHA1 ae250f426a43a1b1fc3d35b855dfd4c5e5f9c8e2
- SHA512 2e17a4bf541c4f93216932bed5f4c1f813ba8ee5fbebdb16b8cbd31db08b6f806f4cbb44ca6dd6a7906a3659544ed02b1c19c0ff580c0bf1cb4138f167de1abc
- SSDEEP 196608:wwovZiOFpExCm1QS6xFrqlEaqwJMDY0GM11muvcnEPposLraiqwN8Z8fwHA:wPxHmxCm1QdFrWVXMr1uOnLdX1wg
- TLSH T1D0B6335EF24D60EDF4894148071A3B6551ACE32E63191AF9926FD84CECCA18C5E2BF4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/h/OnlineFix64.dll
File Explorer
-
h.zip.zip 10.4MB
-
h/OnlineFix.ini707B
-
h/OnlineFix64.dll.dll 12.5MB
h/OnlineFix.ini
- SHA256 e998c47221a6649c1a26fd64ca38b385bbfb49a3d8e09703a7cea0f3a2eeac6c
- MD5 fc1e5ab6ff09439dc087756c0de7eb29
- SHA1 f3764f1ab3be799c4893e44c918fb50d5cc57cc1
- SHA512 53b47dedb30a78e42f3fa25dff8e30974b598299c038d6a3d3cd74fdbc1a1fb84e3addf17f50406052c0dfebaac25f34eef65004492a7070d95bb8b5e71a2db9
- TLSH T1FA014ED6A86D383DD1E6AD892DE3395365B5E82431072950F8E64E8F2A06E60320B00C
- MD5 SHA1 SHA512 TLSH
h/OnlineFix64.dll
- IMPHASH 10c1b70987e42d05f256c6e82924ec7e
- SHA256 d687fcd5d3942793218036cde1b8c39d4ada63d2f4aa08778fc2722a4dc65f99
- MD5 a08579e67f040ceac017a908d252678f
- SHA1 2fcdfea9d8ed56dde71567d2c3c20621e0b12114
- SHA512 0ef07a2de614a13454df16628e7a1e5c306fee2913779e8eceddc63f8543bd8936a832050d2973102b60868b0e9953f84300fd91c9589ca3a9e3712a217e898c
- SSDEEP 196608:FUYcraHCNj3boX1FEqVgJGO2wRdwo3UN27hkApt4Q0dAaDR+u+t+:WmHoAgfRE8vptmDR+l
- TLSH T153D612C565C493BCC8848534E2441AFDF0C97C898DF9952BBFC758127AB1C99C8B6BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
20716901
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleA
user32
GetUserObjectInformationW
shell32
SHGetSpecialFolderPathA
ws2_32
ioctlsocket
wldap32
ord27
advapi32
RegisterEventSourceW
Breakpad_SteamMiniDumpInit
Breakpad_SteamSendMiniDump
Breakpad_SteamSetAppID
Breakpad_SteamSetSteamID
Breakpad_SteamWriteMiniDumpSetComment
Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId
CreateInterface
OnlineFix
ShellExecuteA
ShellExecuteW
Steam_BConnected
Steam_BGetCallback
Steam_BLoggedOn
Steam_BReleaseSteamPipe
Steam_ConnectToGlobalUser
Steam_CreateGlobalUser
Steam_CreateLocalUser
Steam_CreateSteamPipe
Steam_FreeLastCallback
Steam_GSBLoggedOn
Steam_GSBSecure
Steam_GSGetSteam2GetEncryptionKeyToSendToNewClient
Steam_GSGetSteamID
Steam_GSLogOff
Steam_GSLogOn
Steam_GSRemoveUserConnect
Steam_GSSendSteam2UserConnect
Steam_GSSendSteam3UserConnect
Steam_GSSendUserDisconnect
Steam_GSSendUserStatusResponse
Steam_GSSetServerType
Steam_GSSetSpawnCount
Steam_GSUpdateStatus
Steam_GetAPICallResult
Steam_GetGSHandle
Steam_InitiateGameConnection
Steam_IsKnownInterface
Steam_LogOff
Steam_LogOn
Steam_NotifyMissingInterface
Steam_ReleaseThreadLocalMemory
Steam_ReleaseUser
Steam_SetLocalIPBinding
Steam_TerminateGameConnection
Name
.text
Size
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
594KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ofme0
Size
Virtual Size
6.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.ofme1
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ofme2
Size
12.5MB
Virtual Size
12.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
664B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ