01daf72691dfa5c526c1c6782ac736f8[.]exe

General

Target
01daf72691dfa5c526c1c6782ac736f8.exe
Size 378KB
Sample220525-k3a3dshee5
SHA256 e8bc1142bebbd4cdd5b18e4db7ea39ac690988d1690632ddc4fc4618d6e6e614
MD5 01daf72691dfa5c526c1c6782ac736f8
SHA1 1f01de9b008ead35a251886e096553ef9fb050df
SHA512 adc9c36a4f303caf21836fedcdb2491cff02d57ea2e2ae2a627075db55efecfade6394051c985f33acd8a93594c071dd52c421f285c37ecc56ac63e2a5a29187
SSDEEP 6144:jql+qheDDTjaJ4IbIc9kyaw18ea/Na4YCi0hBgaqE0tbBzmgz:e1h2XjW4Ib3ke4NaNCi0TqEwbB
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

01daf72691dfa5c526c1c6782ac736f8.exe

.exe 378KB

01daf72691dfa5c526c1c6782ac736f8.exe

IMPHASH d99a1551d1fad2f9650d811240a089e9
SHA256 e8bc1142bebbd4cdd5b18e4db7ea39ac690988d1690632ddc4fc4618d6e6e614
MD5 01daf72691dfa5c526c1c6782ac736f8
SHA1 1f01de9b008ead35a251886e096553ef9fb050df
SHA512 adc9c36a4f303caf21836fedcdb2491cff02d57ea2e2ae2a627075db55efecfade6394051c985f33acd8a93594c071dd52c421f285c37ecc56ac63e2a5a29187
SSDEEP 6144:jql+qheDDTjaJ4IbIc9kyaw18ea/Na4YCi0hBgaqE0tbBzmgz:e1h2XjW4Ib3ke4NaNCi0TqEwbB
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

40112

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize FindResourceA lstrcmpA WriteConsoleInputW TryEnterCriticalSection WriteConsoleOutputCharacterW WritePrivateProfileStructA GetConsoleAliasesLengthW CopyFileExW GetModuleHandleExA SetComputerNameExA GetDriveTypeW lstrcpynA GetConsoleAliasExesLengthA BuildCommDCBAndTimeoutsA LoadResource UpdateResourceA _lwrite GetQueuedCompletionStatus VerSetConditionMask MoveFileExW ReadConsoleA InterlockedDecrement ZombifyActCtx WritePrivateProfileSectionA SetDefaultCommConfigW GetSystemWindowsDirectoryW GetNamedPipeHandleStateA GetProfileSectionA SetConsoleScreenBufferSize InterlockedCompareExchange WriteConsoleInputA GetComputerNameW ConnectNamedPipe GetModuleHandleW GetTickCount VirtualFree GetConsoleAliasesLengthA GetDllDirectoryW GetPrivateProfileStringW GetConsoleTitleA ReadConsoleOutputA GetConsoleAliasExesW GetDateFormatA GetCommandLineA CreateActCtxW EnumResourceTypesA SetProcessPriorityBoost GetDriveTypeA GetPriorityClass GetVolumePathNameW GlobalAlloc GetPrivateProfileIntA GetSystemDirectoryW SetFileShortNameW LoadLibraryW IsProcessInJob CopyFileW AssignProcessToJobObject GetCalendarInfoW ReadProcessMemory GetSystemWow64DirectoryW GetSystemWindowsDirectoryA FormatMessageW GetSystemTimeAdjustment GetVersionExW GetFileAttributesA SetConsoleMode GetConsoleAliasW GetWriteWatch VerifyVersionInfoA WriteConsoleW GetBinaryTypeA TerminateProcess GetAtomNameW GetMailslotInfo GetCompressedFileSizeA GetTimeZoneInformation CreateFileW lstrcatA GetOverlappedResult GetACP lstrlenW FindNextVolumeMountPointW CreateMailslotW DeactivateActCtx GetNamedPipeHandleStateW GetConsoleAliasesW ReleaseActCtx SetCurrentDirectoryA GetStartupInfoA GetCPInfoExW FillConsoleOutputCharacterW GetHandleInformation GetLastError GetLongPathNameW ReadConsoleOutputCharacterA CreateNamedPipeA EnumDateFormatsExA CreateTimerQueueTimer WriteProfileSectionA SetComputerNameA VerLanguageNameW GlobalGetAtomNameA BuildCommDCBW DefineDosDeviceA ResetEvent OpenWaitableTimerA GetLocalTime LoadLibraryA UnhandledExceptionFilter InterlockedExchangeAdd SetCalendarInfoW WritePrivateProfileStringA MoveFileA SetConsoleOutputCP GetExitCodeThread AddAtomW GetProfileStringA VirtualLock HeapLock GetCommMask HeapWalk GetTapeParameters FoldStringW SetSystemTime GlobalWire GetModuleFileNameA GetPrivateProfileSectionNamesA FindNextFileA EnumDateFormatsA FindFirstChangeNotificationA lstrcatW FreeEnvironmentStringsW FindNextFileW GetStringTypeW VirtualProtect OutputDebugStringA SetThreadAffinityMask OpenSemaphoreW EndUpdateResourceA GetVersionExA GetVersion DeleteFileW GetCurrentProcessId DeleteAtom MoveFileWithProgressW GetFileInformationByHandle DebugBreak FindActCtxSectionStringW SuspendThread lstrcpyA SetUnhandledExceptionFilter WideCharToMultiByte DeleteFileA HeapValidate IsBadReadPtr RaiseException Sleep InterlockedIncrement GetProcAddress ExitProcess WriteFile GetStdHandle LeaveCriticalSection EnterCriticalSection SetStdHandle GetFileType GetConsoleCP GetConsoleMode GetCurrentProcess IsDebuggerPresent GetModuleFileNameW GetOEMCP GetCPInfo IsValidCodePage TlsGetValue TlsAlloc TlsSetValue GetCurrentThreadId TlsFree SetLastError SetHandleCount DeleteCriticalSection QueryPerformanceCounter GetSystemTimeAsFileTime FreeEnvironmentStringsA GetEnvironmentStrings GetEnvironmentStringsW HeapDestroy HeapCreate HeapFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP MultiByteToWideChar SetFilePointer RtlUnwind OutputDebugStringW LCMapStringA LCMapStringW GetStringTypeA GetLocaleInfoA CreateFileA CloseHandle FlushFileBuffers

Name

.text

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

169KB

Virtual Size

424KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.zazi

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nete

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vatehu

Size

512B

Virtual Size

34B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

01daf72691dfa5c526c1c6782ac736f8.exe

kernel32