2A3B5D211C1926990B33553CA2D9F490167D4A0A73E96[.]exe

General

Target
2A3B5D211C1926990B33553CA2D9F490167D4A0A73E96.exe
Size 584KB
Sample220208-2h875agbal
SHA256 2a3b5d211c1926990b33553ca2d9f490167d4a0a73e96da9de8f79fdb814d66c
MD5 9581807e44614094b42b235db963fdbe
SHA1 fb8b76895a58835da6db6a9a4b36fbe22b27429e
SHA512 d929ca07717a13ae52ea449ec54f73b2496a456ad9950596bb2cff5ada1067912f9907b6c8b3636121132e989af5a5d3dce4c97923283589e90bce2325c87832
SSDEEP 12288:RVSZ6SSrlnMTCCdXGVNjWegbnM5EPkJGPUFzwxwU24Xs9qyZ/m:RMZ/zntGjjWtbzUFgXtmm
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

2A3B5D211C1926990B33553CA2D9F490167D4A0A73E96.exe

.exe 584KB

2A3B5D211C1926990B33553CA2D9F490167D4A0A73E96.exe

IMPHASH e12c52f1062cf23fa570efddb059bf61
SHA256 2a3b5d211c1926990b33553ca2d9f490167d4a0a73e96da9de8f79fdb814d66c
MD5 9581807e44614094b42b235db963fdbe
SHA1 fb8b76895a58835da6db6a9a4b36fbe22b27429e
SHA512 d929ca07717a13ae52ea449ec54f73b2496a456ad9950596bb2cff5ada1067912f9907b6c8b3636121132e989af5a5d3dce4c97923283589e90bce2325c87832
SSDEEP 12288:RVSZ6SSrlnMTCCdXGVNjWegbnM5EPkJGPUFzwxwU24Xs9qyZ/m:RMZ/zntGjjWtbzUFgXtmm
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

410176

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetNamedPipeHandleStateW CreateNamedPipeA CallNamedPipeW TerminateThread GetExitCodeProcess GetVersionExW VerifyVersionInfoW SetConsoleCP GetConsoleAliasesLengthA VerLanguageNameW FindFirstFileExA VerifyVersionInfoA FreeEnvironmentStringsA GetProcessPriorityBoost SetVolumeMountPointW GetLongPathNameA CopyFileA TlsGetValue SetConsoleCursorInfo TzSpecificLocalTimeToSystemTime SetProcessShutdownParameters ReleaseMutex BuildCommDCBAndTimeoutsA GetProcAddress LoadLibraryA LocalAlloc SleepEx TlsSetValue MoveFileA GetCommandLineW InterlockedDecrement DeleteFileA CreateActCtxA SetFileAttributesA GetPrivateProfileIntW GetProcessHeap CreateNamedPipeW ReadConsoleOutputCharacterA GetStartupInfoA GetDiskFreeSpaceExW GetCPInfoExW GetWindowsDirectoryW GetSystemWow64DirectoryA SetLastError GetProfileStringA GetCalendarInfoW GetTickCount GetStringTypeW DebugBreak FindFirstFileA lstrcmpA WriteFile GetConsoleMode WriteProfileStringW lstrcatW SetFirmwareEnvironmentVariableA InterlockedExchange SetCriticalSectionSpinCount DefineDosDeviceW WriteConsoleW InterlockedIncrement GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileStructA TryEnterCriticalSection GetPrivateProfileStructW GetFileAttributesExW HeapWalk CreateIoCompletionPort PeekConsoleInputA GetNumberFormatW FindResourceExW SetLocalTime GetQueuedCompletionStatus CreateSemaphoreA GetThreadLocale SetFileShortNameA lstrcpyW ReplaceFileA MoveFileExA GetConsoleCP GetVolumePathNameA FlushConsoleInputBuffer SearchPathA FreeConsole GetConsoleAliasExesLengthW WriteConsoleInputA LocalShrink GetCommState EnumSystemLocalesW ProcessIdToSessionId SetMessageWaitingIndicator DeleteTimerQueueTimer GetWriteWatch OpenSemaphoreW GetConsoleScreenBufferInfo ClearCommBreak TlsAlloc GetSystemTimeAdjustment GetComputerNameW HeapValidate GetLastError WaitForMultipleObjectsEx SignalObjectAndWait GetSystemPowerStatus VirtualLock SetWaitableTimer ChangeTimerQueueTimer GetProcessHandleCount FatalAppExitA lstrcpynW SetNamedPipeHandleState FillConsoleOutputCharacterW GetCompressedFileSizeW FindNextVolumeMountPointA GetFullPathNameA WriteProfileStringA GlobalAddAtomW LeaveCriticalSection SetCurrentDirectoryW LockFile OpenMutexW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection EncodePointer DecodePointer IsBadReadPtr RtlUnwind RaiseException GetModuleHandleW ExitProcess HeapSetInformation GetStartupInfoW WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo GetModuleFileNameW InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent HeapAlloc GetModuleFileNameA HeapReAlloc HeapSize HeapQueryInformation TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree HeapCreate GetACP GetOEMCP IsValidCodePage GetCurrentThreadId TlsFree GetStdHandle LoadLibraryW GetLocaleInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetLocaleInfoA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID OutputDebugStringA OutputDebugStringW SetFilePointer SetStdHandle CreateFileW CloseHandle FlushFileBuffers

Name

.text

Size

508KB

Virtual Size

508KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

35KB

Virtual Size

539KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xud

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wow

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2A3B5D211C1926990B33553CA2D9F490167D4A0A73E96.exe

kernel32