b15e4f5305001f865f0527da9152248a[.]exe

General

Target
b15e4f5305001f865f0527da9152248a.exe
Size 387KB
Sample220524-dfkvradcc3
SHA256 8e0efcf448b565fe2fe24840fcde0c9f44703a5d3e9563dc35cf56a9359ec9b7
MD5 b15e4f5305001f865f0527da9152248a
SHA1 54ca41da50940b1b529bb2a1ed54de1bd9f2021a
SHA512 daf8c205d674a3c3d221e8eb46270e609cccf65607718871d9b66f8a767a30a14498705ddc306ea7518c9dc57cee11dd525b6ee793a24df7f1a4743b77a4e77b
SSDEEP 6144:abtcA1o8axNIaMXmlCBL932NPPW8yWO+AlDEzu2y85Bf+:abvOx/ILXmw93l8dTYe55N+
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

b15e4f5305001f865f0527da9152248a.exe

.exe 387KB

b15e4f5305001f865f0527da9152248a.exe

IMPHASH 28bd666374957ad640bfcdff27cdedf7
SHA256 8e0efcf448b565fe2fe24840fcde0c9f44703a5d3e9563dc35cf56a9359ec9b7
MD5 b15e4f5305001f865f0527da9152248a
SHA1 54ca41da50940b1b529bb2a1ed54de1bd9f2021a
SHA512 daf8c205d674a3c3d221e8eb46270e609cccf65607718871d9b66f8a767a30a14498705ddc306ea7518c9dc57cee11dd525b6ee793a24df7f1a4743b77a4e77b
SSDEEP 6144:abtcA1o8axNIaMXmlCBL932NPPW8yWO+AlDEzu2y85Bf+:abvOx/ILXmw93l8dTYe55N+
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

39872

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize lstrcmpA WriteConsoleInputW TryEnterCriticalSection WritePrivateProfileStructA GetConsoleAliasesLengthW CopyFileExW SetComputerNameExA GetDriveTypeW lstrcpynA GetConsoleAliasExesLengthA FindResourceW BuildCommDCBAndTimeoutsA LoadResource UpdateResourceA InterlockedIncrement _lwrite GetQueuedCompletionStatus VerSetConditionMask MoveFileExW ReadConsoleA InterlockedDecrement ZombifyActCtx WritePrivateProfileSectionA SetDefaultCommConfigW GetSystemWindowsDirectoryW GetNamedPipeHandleStateA GetProfileSectionA SetConsoleScreenBufferSize InterlockedCompareExchange WriteConsoleInputA GetComputerNameW ConnectNamedPipe GetModuleHandleW GetTickCount VirtualFree GetConsoleAliasesLengthA GetDllDirectoryW GetPrivateProfileStringW GetConsoleTitleA ReadConsoleOutputA GetConsoleAliasExesW GetDateFormatA GetCommandLineA CreateActCtxW EnumResourceTypesA SetProcessPriorityBoost GetDriveTypeA GetPriorityClass GetVolumePathNameW GlobalAlloc GetPrivateProfileIntA GetSystemDirectoryW SetFileShortNameW LoadLibraryW IsProcessInJob CopyFileW AssignProcessToJobObject GetCalendarInfoW ReadProcessMemory GetSystemWow64DirectoryW GetSystemWindowsDirectoryA FormatMessageW GetSystemTimeAdjustment GetVersionExW GetFileAttributesA SetConsoleMode GetConsoleAliasW GetWriteWatch VerifyVersionInfoA WriteConsoleW GetBinaryTypeA TerminateProcess GetAtomNameW GetMailslotInfo GetCompressedFileSizeA GetTimeZoneInformation CreateFileW lstrcatA GetOverlappedResult GetACP lstrlenW FindNextVolumeMountPointW CreateMailslotW DeactivateActCtx GetNamedPipeHandleStateW GetConsoleAliasesW ReleaseActCtx SetCurrentDirectoryA GetStartupInfoA GetCPInfoExW FillConsoleOutputCharacterW GetHandleInformation GetLastError GetLongPathNameW ReadConsoleOutputCharacterA CreateNamedPipeA EnumDateFormatsExA CreateTimerQueueTimer WriteProfileSectionA SetComputerNameA VerLanguageNameW GlobalGetAtomNameA DefineDosDeviceA ResetEvent OpenWaitableTimerA GetLocalTime LoadLibraryA UnhandledExceptionFilter InterlockedExchangeAdd SetCalendarInfoW WritePrivateProfileStringA MoveFileA SetConsoleOutputCP GetExitCodeThread AddAtomW GetProfileStringA VirtualLock HeapLock GetCommMask HeapWalk GetTapeParameters FoldStringW SetSystemTime GlobalWire GetModuleFileNameA GetPrivateProfileSectionNamesA FindNextFileA EnumDateFormatsA FindFirstChangeNotificationA lstrcatW FreeEnvironmentStringsW FindNextFileW GetStringTypeW BuildCommDCBA VirtualProtect OutputDebugStringA SetThreadAffinityMask EndUpdateResourceA GetVersionExA GetVersion DeleteFileW GetCurrentProcessId MoveFileWithProgressW GetFileInformationByHandle DebugBreak FindActCtxSectionStringW SuspendThread lstrcpyA SetUnhandledExceptionFilter WideCharToMultiByte DeleteFileA GetStartupInfoW HeapValidate IsBadReadPtr RaiseException Sleep GetProcAddress ExitProcess WriteFile GetStdHandle LeaveCriticalSection EnterCriticalSection SetStdHandle GetFileType GetConsoleCP GetConsoleMode GetCurrentProcess IsDebuggerPresent GetModuleFileNameW GetOEMCP GetCPInfo IsValidCodePage TlsGetValue TlsAlloc TlsSetValue GetCurrentThreadId TlsFree SetLastError SetHandleCount DeleteCriticalSection QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW GetCommandLineW HeapDestroy HeapCreate HeapFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP MultiByteToWideChar SetFilePointer RtlUnwind OutputDebugStringW LCMapStringA LCMapStringW GetStringTypeA GetLocaleInfoA CreateFileA CloseHandle FlushFileBuffers

Name

.text

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

178KB

Virtual Size

433KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kimaka

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.lawenep

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tizaw

Size

512B

Virtual Size

34B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b15e4f5305001f865f0527da9152248a.exe

kernel32