8ea696780f3410219edc5bc6f01717ca[.]exe

General

Target
8ea696780f3410219edc5bc6f01717ca.exe
Size 400KB
Sample220703-klez1seee2
SHA256 aea334344d5c829f85f217d6097388c9be1f1c02cc129cf61fe3f12cd0e57c43
MD5 8ea696780f3410219edc5bc6f01717ca
SHA1 30ba61563b85d81396cfdbaedf8b57def926248a
SHA512 1f36a9b8027b462c7a54b210dcfc79a9d78ed851f06dd04db0a8704f124d1427f7c7a1c041ef75c2b7b2f88aea4c00cd7fc72638003bb08501e459d07396fff3
SSDEEP 12288:aYuDAvSaTEz8RrM2zGiCl/zv5RWwsx6tX:0kToErkhzv5RWwt
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

8ea696780f3410219edc5bc6f01717ca.exe

.exe 400KB

8ea696780f3410219edc5bc6f01717ca.exe

IMPHASH cb4395d76810971be3a7db036e37014b
SHA256 aea334344d5c829f85f217d6097388c9be1f1c02cc129cf61fe3f12cd0e57c43
MD5 8ea696780f3410219edc5bc6f01717ca
SHA1 30ba61563b85d81396cfdbaedf8b57def926248a
SHA512 1f36a9b8027b462c7a54b210dcfc79a9d78ed851f06dd04db0a8704f124d1427f7c7a1c041ef75c2b7b2f88aea4c00cd7fc72638003bb08501e459d07396fff3
SSDEEP 12288:aYuDAvSaTEz8RrM2zGiCl/zv5RWwsx6tX:0kToErkhzv5RWwt
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

47168

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FlushConsoleInputBuffer GetNamedPipeHandleStateW GetQueuedCompletionStatus ExitProcess GetProcessId GetVersionExA VerifyVersionInfoA WriteConsoleInputA EnumDateFormatsA FillConsoleOutputCharacterA FindNextFileA CopyFileExW BuildCommDCBAndTimeoutsW VirtualLock WriteProfileStringW VerifyVersionInfoW GetFileType DeleteFileA FindNextVolumeMountPointW TlsGetValue ResetWriteWatch WriteConsoleInputW GetConsoleTitleW GetComputerNameExW GetTimeZoneInformation GetThreadPriority CallNamedPipeW LoadLibraryA GetSystemDirectoryA GetDriveTypeW BuildCommDCBAndTimeoutsA ReleaseActCtx GetProfileSectionW GetCommandLineA InterlockedIncrement CreateActCtxW FindResourceW FormatMessageA GetModuleFileNameA CreateJobObjectA InitializeCriticalSection GetNumberOfConsoleMouseButtons FindNextVolumeA GetExitCodeThread CreateNamedPipeW WritePrivateProfileStringW GetConsoleAliasesLengthW WriteProfileSectionA AddAtomW InterlockedDecrement GetVersionExW HeapFree _hread GetStartupInfoW ConnectNamedPipe GetCPInfoExW GetSystemWow64DirectoryW GetLastError GetPrivateProfileIntA GetConsoleAliasExesA DebugBreak EndUpdateResourceA GetTickCount InterlockedExchangeAdd VirtualQueryEx DeleteVolumeMountPointW OpenFileMappingA GetModuleHandleW SetDefaultCommConfigA VirtualAlloc GetSystemWindowsDirectoryA TerminateProcess GetOEMCP GetNamedPipeHandleStateA GetDiskFreeSpaceExA IsProcessInJob WriteConsoleW GetProcAddress lstrcpyA ReadConsoleOutputA SetThreadContext FoldStringA WritePrivateProfileStringA GetHandleInformation WritePrivateProfileSectionA DeleteCriticalSection GetFileAttributesA GetCurrentActCtx CopyFileW GlobalMemoryStatus SetTapeParameters GetDevicePowerState ResetEvent UnlockFile DisableThreadLibraryCalls GetOverlappedResult SetCommTimeouts InterlockedCompareExchange MoveFileA LocalAlloc SetCommMask SetFileShortNameW GetFileAttributesW GetConsoleAliasW ConvertFiberToThread SetComputerNameW GetConsoleAliasesA ReadConsoleInputW EnumDateFormatsW SetConsoleOutputCP MoveFileWithProgressW GetStdHandle GetLocalTime FoldStringW OpenSemaphoreA GetModuleHandleExA AddAtomA LoadLibraryW ActivateActCtx GetFileSize UnregisterWait UnhandledExceptionFilter SetProcessShutdownParameters lstrcpynW GlobalUnWire FillConsoleOutputCharacterW GetCompressedFileSizeA ReadConsoleW WriteConsoleOutputCharacterW TerminateJobObject CreateFileW DeactivateActCtx FreeUserPhysicalPages GetConsoleAliasesLengthA SetLastError SetUnhandledExceptionFilter RaiseException GetStartupInfoA HeapValidate IsBadReadPtr EnterCriticalSection LeaveCriticalSection GetModuleFileNameW GetModuleHandleA GetCurrentProcess IsDebuggerPresent CloseHandle SetStdHandle WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode Sleep QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount TlsAlloc TlsSetValue TlsFree HeapDestroy HeapCreate VirtualFree HeapAlloc HeapSize HeapReAlloc GetACP GetCPInfo IsValidCodePage RtlUnwind InitializeCriticalSectionAndSpinCount OutputDebugStringA OutputDebugStringW FlushFileBuffers WriteConsoleA GetConsoleOutputCP MultiByteToWideChar SetFilePointer LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA CreateFileA ReadFile

Name

.text

Size

194KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

185KB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.jitob

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yico

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wes

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voxoni

Size

512B

Virtual Size

50B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8ea696780f3410219edc5bc6f01717ca.exe

kernel32