F0003-960063[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
F0003-960063.exe
Size 1.2MB
Sample220613-l43pgabfd6
SHA256 72b22fc9be1cc59b6b8677642a4803eeeadebe06987b78db80e5149de5f7f44b
MD5 6fe5939a4a600e12921d7b22b381f7b3
SHA1 3de1d7d51d99e04e0e45a963ebff0a83a0581573
SHA512 7c04801c078c61c03b1fd19fbcb1d71009aa7ff22d00fabf4c2591106fa387898517183b51213e0794f6c33ce2a9d05cf421fa4d845947082b2135939d83f7b6
SSDEEP 6144:tWTFrcq9gXQNkCkNfY0tmS3Qg4wE/1Y6fqNIDhlUu+4RYkKWJZjaRiZruLLt8Rgu:teHgAyC70wyeMWZX7LXH
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

F0003-960063.exe

.exe 1.2MB

F0003-960063.exe

IMPHASH fca4f8d84cc12e6d18c40bb06f8fe20f
SHA256 72b22fc9be1cc59b6b8677642a4803eeeadebe06987b78db80e5149de5f7f44b
MD5 6fe5939a4a600e12921d7b22b381f7b3
SHA1 3de1d7d51d99e04e0e45a963ebff0a83a0581573
SHA512 7c04801c078c61c03b1fd19fbcb1d71009aa7ff22d00fabf4c2591106fa387898517183b51213e0794f6c33ce2a9d05cf421fa4d845947082b2135939d83f7b6
SSDEEP 6144:tWTFrcq9gXQNkCkNfY0tmS3Qg4wE/1Y6fqNIDhlUu+4RYkKWJZjaRiZruLLt8Rgu:teHgAyC70wyeMWZX7LXH
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

6981

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnumSystemLocalesEx EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesW HeapCreate HeapSetInformation InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetPerformanceInfo K32GetProcessMemoryInfo ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlUnwind SearchPathW EnterCriticalSection SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetProcessShutdownParameters SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SignalObjectAndWait Sleep SleepConditionVariableSRW Wow64GetThreadContext WriteConsoleW WriteFile WriteProcessMemory lstrlenW VirtualProtect VirtualAlloc LeaveCriticalSection GetModuleHandleA CloseHandle GetProcAddress GetConsoleWindow GetConsoleOutputCP GetStringTypeW WideCharToMultiByte MultiByteToWideChar GetOEMCP GetFileType LCMapStringW CompareStringW GetStdHandle GetModuleFileNameW GetModuleHandleExW EncodePointer DuplicateHandle GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx SetConsoleCtrlHandler HeapFree LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW OutputDebugStringW CreateEventW GetModuleHandleW UnhandledExceptionFilter TerminateProcess CreateFileW

user32

GetMessageW GetProcessWindowStation ShowWindow MessageBoxA UnregisterClassW TranslateMessage SetProcessWindowStation SetProcessDPIAware SendMessageTimeoutW RegisterClassW PostMessageW IsWindow GetWindowThreadProcessId GetUserObjectInformationW GetThreadDesktop

advapi32

EventUnregister EventRegister EqualSid DuplicateTokenEx DuplicateToken CreateWellKnownSid CreateRestrictedToken CreateProcessAsUserW CopySid ConvertStringSidToSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW AccessCheck

shell32

SHGetFolderPathW SHGetKnownFolderPath CommandLineToArgvW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW