054d96cd8c33598c322adc3d52146f3467c7c01a6a12f9bb3bf5bd2c5bfacc38

Sharing

Copy URL Twitter E-mail

General

Target
054d96cd8c33598c322adc3d52146f3467c7c01a6a12f9bb3bf5bd2c5bfacc38
Size 2.3MB
Sample261113-n8evbabs7r
SHA256 054d96cd8c33598c322adc3d52146f3467c7c01a6a12f9bb3bf5bd2c5bfacc38
MD5 c63092fddc0fe84fb07ee00746cc3e86
SHA1 fe812eea0fee14afc4a32d03caf238df0cfbaf6d
SHA512 667e652b1427ef61ee97fd18524aabec36fa6a2db5f490171fff395ab67d07168f09785347157f8373917c61a1758762c7ead8da56d0fd6b716e4b1b78644ffc
SSDEEP 49152:AIv7dZI0maOGjGObhJ4QNaOo10RzUNy6YppmXNwuAnb:fr7ZPzU3XNwu
TLSH
T15AB58C56F694A0A9D035A034AD93A66BE23274454B3182CB37E80B2D5FF37D01BB6F53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
054d96cd8c33598c322adc3d52146f3467c7c01a6a12f9bb3bf5bd2c5bfacc38

File Explorer

054d96cd8c33598c322adc3d52146f3467c7c01a6a12f9bb3bf5bd2c5bfacc38

.dll 2.3MB

054d96cd8c33598c322adc3d52146f3467c7c01a6a12f9bb3bf5bd2c5bfacc38

IMPHASH 83cbdc121090a08d26d2c91c5b36904d
SHA256 054d96cd8c33598c322adc3d52146f3467c7c01a6a12f9bb3bf5bd2c5bfacc38
MD5 c63092fddc0fe84fb07ee00746cc3e86
SHA1 fe812eea0fee14afc4a32d03caf238df0cfbaf6d
SHA512 667e652b1427ef61ee97fd18524aabec36fa6a2db5f490171fff395ab67d07168f09785347157f8373917c61a1758762c7ead8da56d0fd6b716e4b1b78644ffc
SSDEEP 49152:AIv7dZI0maOGjGObhJ4QNaOo10RzUNy6YppmXNwuAnb:fr7ZPzU3XNwu
TLSH
T15AB58C56F694A0A9D035A034AD93A66BE23274454B3182CB37E80B2D5FF37D01BB6F53
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1395268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Kutr Tvar\Downloads\Anticristo\CS2\Poltergeist_CS2\Poltergeist\x64\Release\Poltergeist.pdb

kernel32

IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter RemoveVectoredExceptionHandler VirtualProtect VirtualFree VirtualAlloc GetSystemInfo AddVectoredExceptionHandler VirtualQuery DisableThreadLibraryCalls GetEnvironmentVariableA FreeLibraryAndExitThread ExitThread Sleep GetTickCount64 CloseHandle CreateThread GetCurrentProcessId CreateDirectoryA RtlAddFunctionTable GetModuleHandleExA AddVectoredContinueHandler RemoveVectoredContinueHandler SetConsoleTextAttribute EnterCriticalSection SetConsoleScreenBufferSize GetStdHandle WriteConsoleA SetConsoleMode LeaveCriticalSection InitializeCriticalSection GetCurrentThreadId GetConsoleMode FreeConsole GetLocalTime SetConsoleOutputCP GetTickCount AllocConsole SetConsoleTitleW IsDebuggerPresent GetCurrentProcess QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared GetModuleFileNameW TryAcquireSRWLockExclusive RtlLookupFunctionEntry GetFileInformationByHandleEx MoveFileExW GetLastError AreFileApisANSI GetTempPathW SetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree InitializeSListHead LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock GetModuleHandleW GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable WideCharToMultiByte GlobalLock GlobalFree MultiByteToWideChar GlobalAlloc K32GetModuleInformation OutputDebugStringA IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext

user32

GetForegroundWindow GetKeyboardLayout TrackMouseEvent IsWindowUnicode ReleaseCapture SetCursorPos SetCursor GetCapture GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SetCapture GetClientRect ClientToScreen GetMessageExtraInfo ScreenToClient GetKeyNameTextA MapVirtualKeyA CallWindowProcW SetWindowLongPtrW ClipCursor GetAsyncKeyState DefWindowProcW GetKeyState LoadCursorW

shell32

ShellExecuteW SHGetKnownFolderPath

ole32

CoTaskMemFree

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

msvcp140

?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Throw_Cpp_error@std@@YAXH@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Winerror_map@std@@YAHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??Bios_base@std@@QEBA_NXZ _Mtx_trylock ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ _Thrd_yield

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memmove __C_specific_handler_noexcept __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler strstr memcpy memcmp memchr __std_type_info_destroy_list strrchr strchr __current_exception __current_exception_context _CxxThrowException

api-ms-win-crt-stdio-l1-1-0

fwrite __stdio_common_vfprintf fseek fclose fflush fread __stdio_common_vsscanf __acrt_iob_func _wfopen _fsopen __stdio_common_vsnprintf_s _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos ftell fgetc __stdio_common_vsprintf_s fputc fputs freopen_s __stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

_strnicmp strncpy_s isxdigit strnlen strcat_s strcpy_s strcmp strncpy strncmp _stricmp strncat_s tolower

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _errno _invoke_watson _wassert _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _initterm_e _initterm terminate _cexit abort

api-ms-win-crt-convert-l1-1-0

strtod strtoul strtoll strtoull atof

api-ms-win-crt-math-l1-1-0

acosf _fdclass asinf atan2f atanf _dclass tanf ceilf cosf floorf fmodf log remainderf log2f logf pow roundf powf sinf sqrtf _dsign _hypotf lroundf

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime _time64

Sharing

General

Malware Config

Signatures

File Explorer

054d96cd8c33598c322adc3d52146f3467c7c01a6a12f9bb3bf5bd2c5bfacc38

kernel32

user32

shell32

ole32

imm32

d3dcompiler_47

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

generic