379ebead1fb22627691fbd82cdc97817[.]exe

General

Target
379ebead1fb22627691fbd82cdc97817.exe
Size 425KB
Sample220115-tp8wyaegg3
SHA256 1a10164e5cdc3ddbc96e75468254a421b1646b24934a6bde3313229fc6f26f0e
MD5 379ebead1fb22627691fbd82cdc97817
SHA1 9c8d1836d857ea0368fcc882b6b089900f203e08
SHA512 1be3d939a8dbb1a8bb44d56239aa1474e7f0123b40289747a3a0bb7dfc9fb0a581dca0752f6d26518e7d9e745d654e52a82809cec1afbafb285a044f6cae728c
SSDEEP 6144:0JEb+g8Yjk5egDV4jDfi0swLwn94drMZMY5/Ge9aPcziZnJ37Lf1Ik5eLe9g:cESg/k5eYaXLIXZMc9TW1J3Xfn5e
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

379ebead1fb22627691fbd82cdc97817.exe

.exe 425KB

379ebead1fb22627691fbd82cdc97817.exe

IMPHASH ef9a7197fca7a6c5b916d255436493be
SHA256 1a10164e5cdc3ddbc96e75468254a421b1646b24934a6bde3313229fc6f26f0e
MD5 379ebead1fb22627691fbd82cdc97817
SHA1 9c8d1836d857ea0368fcc882b6b089900f203e08
SHA512 1be3d939a8dbb1a8bb44d56239aa1474e7f0123b40289747a3a0bb7dfc9fb0a581dca0752f6d26518e7d9e745d654e52a82809cec1afbafb285a044f6cae728c
SSDEEP 6144:0JEb+g8Yjk5egDV4jDfi0swLwn94drMZMY5/Ge9aPcziZnJ37Lf1Ik5eLe9g:cESg/k5eYaXLIXZMc9TW1J3Xfn5e
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

221104

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeactivateActCtx GetVersionExW SetConsoleCP GetConsoleAliasesLengthA GetDefaultCommConfigA FindFirstFileExW GetDriveTypeA FreeEnvironmentStringsW SetProcessPriorityBoost SetVolumeMountPointW GetLongPathNameW CopyFileW TlsGetValue GetConsoleCursorInfo SetComputerNameExW SystemTimeToTzSpecificLocalTime FindAtomA ReleaseSemaphore CallNamedPipeA CreateMailslotW BuildCommDCBAndTimeoutsW VirtualProtect LoadLibraryA LocalAlloc TryEnterCriticalSection GetCommandLineW InterlockedDecrement GetCalendarInfoA DeleteFileA CreateActCtxW CreateRemoteThread SetSystemTimeAdjustment SetPriorityClass WritePrivateProfileStringW GetProcessHeap GlobalUnWire ReadConsoleOutputCharacterW GetStartupInfoW GetDiskFreeSpaceExA GetCPInfoExA GetWindowsDirectoryW GetSystemWow64DirectoryW GetProfileStringW WriteProfileSectionW GetProfileStringA GetLastError DeleteVolumeMountPointA DebugBreak lstrcmpA ReadFileScatter SetConsoleMode GetSystemWindowsDirectoryW TerminateProcess GlobalFindAtomA FindCloseChangeNotification GetTapeParameters GetMailslotInfo InterlockedExchange DefineDosDeviceW FindVolumeMountPointClose EndUpdateResourceA WriteConsoleA GetSystemTimeAdjustment WritePrivateProfileSectionA GetPrivateProfileStructA GetFileAttributesExA Process32NextW MoveFileW GetVolumePathNameA HeapUnlock lstrcmpW SetDefaultCommConfigA GetExitCodeProcess ResetEvent GetThreadContext MoveFileExW GlobalLock UnregisterWaitEx BuildCommDCBA PeekConsoleInputW GetBinaryTypeW CreateSemaphoreW TransmitCommChar WaitNamedPipeA GetOverlappedResult GetPrivateProfileSectionNamesW FindResourceExW EnumTimeFormatsW GetLocalTime CreateSemaphoreA GetPrivateProfileSectionW GetProcAddress SetFileShortNameA lstrcpyW VerLanguageNameW SetThreadExecutionState SetSystemTime LockFile VerSetConditionMask GetConsoleAliasA FlushConsoleInputBuffer AllocConsole GetAtomNameW GetConsoleAliasExesLengthA WriteConsoleInputW TransactNamedPipe EnumDateFormatsA GetCommState FileTimeToLocalFileTime _lopen GetConsoleAliasExesLengthW GetWriteWatch FreeEnvironmentStringsA GetModuleHandleW WriteConsoleOutputCharacterA GetConsoleMode HeapReAlloc OpenMutexA LocalLock GetCommMask SetEndOfFile FindClose CreateIoCompletionPort SetFileApisToANSI CancelWaitableTimer GetProcessHandleCount RegisterWaitForSingleObject GetConsoleAliasesLengthW GetCurrentProcessId lstrcpynA SetNamedPipeHandleState GetCompressedFileSizeA FindNextVolumeMountPointA GetFullPathNameA WriteProfileStringA DeleteAtom GlobalAddAtomW AssignProcessToJobObject QueryDosDeviceW InitializeCriticalSection Process32FirstW SetCurrentDirectoryA GetBinaryTypeA FindActCtxSectionGuid TerminateThread MoveFileA RaiseException HeapValidate IsBadReadPtr DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleFileNameW GetModuleHandleA GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InterlockedIncrement GetACP GetOEMCP GetCPInfo IsValidCodePage TlsAlloc TlsSetValue GetCurrentThreadId TlsFree SetLastError Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetEnvironmentStringsW HeapDestroy HeapCreate HeapFree VirtualFree GetModuleFileNameA WriteFile HeapAlloc HeapSize VirtualAlloc RtlUnwind InitializeCriticalSectionAndSpinCount OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW MultiByteToWideChar GetStringTypeA GetStringTypeW WideCharToMultiByte LCMapStringA LCMapStringW GetLocaleInfoA SetFilePointer GetConsoleCP FlushFileBuffers SetStdHandle GetConsoleOutputCP CloseHandle CreateFileA

user32

OemToCharA

advapi32

GetFileSecurityA

Name

.text

Size

356KB

Virtual Size

356KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.lolesa

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fuvoduj

Size

512B

Virtual Size

234B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mixew

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

379ebead1fb22627691fbd82cdc97817.exe

kernel32

user32

advapi32