Hellforge Unlocker[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Hellforge Unlocker.zip
Size 2.6MB
Sample261113-3m4zmsgz2m
SHA256 58297a29a00311dbc37a9fb2871427cb661a3cc32463d40fd7d1a95192007fad
MD5 e3e80ccdbd1fd418dd66dfcf18c92425
SHA1 df52e36478e3affca7031d2271e3aca54520efd3
SHA512 35acd3e7c92516ca3daf9807372a5fdd6d12c7e62c4e71d28a71e794bf7dd924bc4283f50f59d1b0886cbba78fdb516adfcc314502f7ca313ae1ceadc78ce2bd
SSDEEP 49152:Je2j6HHW1WQ17hEOcXy2rCy+s1yyMqYsYRoWIS5IeYMsfyDrazuKlvktITBzgtH9:Je2jAAFE3Xyy+s12PRZIoIHYGlstIT9A
TLSH
T1ABC53363A4F151DB63F95989B533F480C0D7B29F11BAC7C7CDAD86A6C206B80ED99818
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Hellforge Unlocker.exe

File Explorer

Hellforge Unlocker.zip

.zip 2.6MB
Hellforge Unlocker.exe

.exe 6.0MB

Hellforge Unlocker.zip

SHA256 58297a29a00311dbc37a9fb2871427cb661a3cc32463d40fd7d1a95192007fad
MD5 e3e80ccdbd1fd418dd66dfcf18c92425
SHA1 df52e36478e3affca7031d2271e3aca54520efd3
SHA512 35acd3e7c92516ca3daf9807372a5fdd6d12c7e62c4e71d28a71e794bf7dd924bc4283f50f59d1b0886cbba78fdb516adfcc314502f7ca313ae1ceadc78ce2bd
SSDEEP 49152:Je2j6HHW1WQ17hEOcXy2rCy+s1yyMqYsYRoWIS5IeYMsfyDrazuKlvktITBzgtH9:Je2jAAFE3Xyy+s12PRZIoIHYGlstIT9A
TLSH
T1ABC53363A4F151DB63F95989B533F480C0D7B29F11BAC7C7CDAD86A6C206B80ED99818
MD5 SHA1 SHA512 SSDEEP TLSH

Hellforge Unlocker.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 2135fa73e6ec48e013fd39a66927f93f2e1f55fd1e454c84690c04bd08c7029d
MD5 c4e2214d6e84237f36d82907d79dd75f
SHA1 8ca32f20117f122460f6738baf3fc4c867cfe03d
SHA512 8dd78c29a95b339f01296f8b6f0302c2b8be08bc8fb6c724d13d18737bed1c04dfbef69aee54fa98dcb88d5d69b597d95a9d3964705e101b41908d941b79c83d
SSDEEP 49152:/WiKUjBnszQJSwva7Z3NCJ1Q0pkooqkcXpcEAw/mocBX1D2YS5EHa0qkrqxWxsVy:ehNwQwIqkcX2+YoE+6qk
TLSH
T16E563907ECA545E8C0EAD6358A669263BA717C484B3127D72F50F7382F76BD0AB79700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

476384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

222KB

Virtual Size

533KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Hellforge Unlocker.zip

Hellforge Unlocker.exe

kernel32

generic