ShadowsocksR-win[.]zip

General

Target
ShadowsocksR-win.zip
Size 686KB
Sample261113-vcc46sys4n
SHA256 a4fef3c602ded2fb21ab6503f194d897eb3033b16606627c39ff312a2fd0895f
MD5 3248b2e1cb2fbc76209b043d1b83a20a
SHA1 90df69ece3d2507d628e0b2e72b27ebf743a9784
SHA512 a81563914f94c0fd84ac82aafabf26f2e534568bcd884aa8162e19b72ac92c0414be7facca1d32c7a34f6eb8a0e389094203ec7dbfad4c8839f45f0b3fc5877b
SSDEEP 12288:63/a/Iw5FnzMVnSzCipiHO4gmHmqUJPjupTO/lK2YRot72pSHQ:63/inzinSztpiuvmH5UopTsYe9iT
TLSH
T1ACE4337DED2EEE28C3E5D8DFE169542129A2FFA5C919260235F377A417B0412DCF0409
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ShadowsocksR.exe

File Explorer

ShadowsocksR-win.zip

.zip 686KB
ShadowsocksR.exe

.exe 958KB

ShadowsocksR-win.zip

SHA256 a4fef3c602ded2fb21ab6503f194d897eb3033b16606627c39ff312a2fd0895f
MD5 3248b2e1cb2fbc76209b043d1b83a20a
SHA1 90df69ece3d2507d628e0b2e72b27ebf743a9784
SHA512 a81563914f94c0fd84ac82aafabf26f2e534568bcd884aa8162e19b72ac92c0414be7facca1d32c7a34f6eb8a0e389094203ec7dbfad4c8839f45f0b3fc5877b
SSDEEP 12288:63/a/Iw5FnzMVnSzCipiHO4gmHmqUJPjupTO/lK2YRot72pSHQ:63/inzinSztpiuvmH5UopTsYe9iT
TLSH
T1ACE4337DED2EEE28C3E5D8DFE169542129A2FFA5C919260235F377A417B0412DCF0409
MD5 SHA1 SHA512 SSDEEP TLSH

ShadowsocksR.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 26a049bc2ec394dd4f8029becadd0fb1c59ecfb1f85c284b5f2f17e53b3c637a
MD5 15988c6190052b9ef4cdd7c487091523
SHA1 c94fbef3098bc48da47650cc9acee1d520593e84
SHA512 1e2e49816cb2827beaa7fe2a686f3efaf43a932a16fe9951f3dffecccc62ec987a4ee2bd8f6610bea1f49f7bf8f1ecc9d084fd90038d77fb2f0d66a7f460f28d
SSDEEP 24576:KN7FDa1z5QTDy5uFroNc9wOi50VJiwf4/ZHlpzwgyROi:KNhmJ5Qfy5uFroNwwV50V3AhDXyw
TLSH
T1FB25BF4273E80E0BE5FFC3F9A9B6541193B0A526D6A9F7CD4C8230EE1AE1B90D941717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

963238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\admin\Desktop\shadowsocksr-csharp-master\shadowsocks-csharp\obj\Release\ShadowsocksR.pdb

ShadowsocksR-win.zip

ShadowsocksR.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

ShadowsocksR-win.zip

ShadowsocksR.exe

mscoree

dotnet