25bd4c59ce54b70a79305a70bfd03e4e[.]exe

General

Target
25bd4c59ce54b70a79305a70bfd03e4e.exe
Size 435KB
Sample220708-kepwmshdcm
SHA256 5d49e406c7f5e07138a3bea72dde6eac26aefd2f479b9898a2e752f67b5d40af
MD5 25bd4c59ce54b70a79305a70bfd03e4e
SHA1 c99d4b07d3df3ed4c94722eb47be2abed4e388a0
SHA512 18606584acb6b1e2b75c09a8c16352074a2a23bce2ae4bda97b229cadf1588ee87b7e034b99bd6441ebc39a161538bff8675aba8c654fd71574b6854ddae4d57
SSDEEP 6144:TWCk/zAsXpknF9KK+IkG7NmjiLVjOO0wMp6l1AE7TDm2brv5dIwer/NIpIkbG:XQ5Xp2F9TjkG8jiLVt5l1A6Djv7eNIy
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

25bd4c59ce54b70a79305a70bfd03e4e.exe

.exe 435KB

25bd4c59ce54b70a79305a70bfd03e4e.exe

IMPHASH 16c6db61a45b1cc9e03eb41acced74bb
SHA256 5d49e406c7f5e07138a3bea72dde6eac26aefd2f479b9898a2e752f67b5d40af
MD5 25bd4c59ce54b70a79305a70bfd03e4e
SHA1 c99d4b07d3df3ed4c94722eb47be2abed4e388a0
SHA512 18606584acb6b1e2b75c09a8c16352074a2a23bce2ae4bda97b229cadf1588ee87b7e034b99bd6441ebc39a161538bff8675aba8c654fd71574b6854ddae4d57
SSDEEP 6144:TWCk/zAsXpknF9KK+IkG7NmjiLVjOO0wMp6l1AE7TDm2brv5dIwer/NIpIkbG:XQ5Xp2F9TjkG8jiLVt5l1A6Djv7eNIy
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

54576

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenMutexW GetCurrentProcess GetNamedPipeHandleStateW GetQueuedCompletionStatus FillConsoleOutputCharacterW EnumSystemCodePagesW LocalUnlock GetVolumeNameForVolumeMountPointA GetVersionExA VerifyVersionInfoA WriteConsoleInputA EnumDateFormatsW FindNextFileA CopyFileExW BuildCommDCBAndTimeoutsW VirtualLock WriteProfileStringA VerifyVersionInfoW GetFileInformationByHandle DeleteFileA FindNextVolumeMountPointW TlsGetValue LoadResource WriteConsoleInputW GetConsoleTitleA GetComputerNameExW OpenEventA GetModuleHandleA GetSystemDirectoryA GetDriveTypeW BuildCommDCBAndTimeoutsA LoadLibraryA GetShortPathNameW ReleaseActCtx DeleteFileW GetCommandLineA InterlockedIncrement InterlockedExchange CopyFileW CreateActCtxW FormatMessageW GetModuleFileNameA EnterCriticalSection FindNextVolumeW GetExitCodeThread CreateNamedPipeW GetUserDefaultLCID GetConsoleAliasesLengthW WriteProfileSectionA AddAtomA InterlockedDecrement GetVersionExW HeapSize _hwrite InterlockedCompareExchange GetStartupInfoA CreateMailslotA GetCPInfoExW GetSystemWow64DirectoryW SetLastError GetPrivateProfileIntW GetConsoleAliasExesW DebugBreak EndUpdateResourceW GetTickCount VirtualQuery OpenFileMappingA GetModuleHandleW GetDefaultCommConfigA VirtualAlloc TerminateProcess GetACP CreateIoCompletionPort GetDiskFreeSpaceExA DefineDosDeviceA GetExitCodeProcess EnumResourceTypesA SetConsoleTextAttribute EndUpdateResourceA IsProcessInJob MoveFileA lstrcpynW WriteConsoleA GetProcAddress lstrcatA LoadLibraryW ReadConsoleOutputA GetStartupInfoW FoldStringW WritePrivateProfileStringW SetHandleInformation WritePrivateProfileStructA DeleteCriticalSection GetFileAttributesA GetCurrentActCtx CopyFileA CancelDeviceWakeupRequest ResetEvent LockFile MoveFileW DisableThreadLibraryCalls GetOverlappedResult GetCommTimeouts FormatMessageA InterlockedExchangeAdd GlobalAlloc SetThreadPriorityBoost SetFileShortNameA GetFileAttributesW SetCalendarInfoW ConvertFiberToThread SetComputerNameA GetConsoleAliasesW EnumDateFormatsA SetTimeZoneInformation SetConsoleOutputCP MoveFileWithProgressW GetStdHandle GetLocalTime FoldStringA EnumSystemLocalesW ActivateActCtx CopyFileExA CreateMemoryResourceNotification OpenSemaphoreA GetModuleHandleExA AddAtomW _hread GetFileType UnhandledExceptionFilter GetConsoleAliasesLengthA GetProcessShutdownParameters lstrcpynA GlobalUnWire GetCompressedFileSizeA ReadConsoleA FreeUserPhysicalPages WriteConsoleOutputCharacterW TerminateJobObject CreateFileA SetTimerQueueTimer SetUnhandledExceptionFilter RaiseException HeapValidate IsBadReadPtr LeaveCriticalSection GetModuleFileNameW IsDebuggerPresent GetLastError SetFilePointer SetStdHandle WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode Sleep ExitProcess SetHandleCount QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW TlsAlloc TlsSetValue TlsFree HeapDestroy HeapCreate HeapFree VirtualFree HeapAlloc HeapReAlloc GetOEMCP GetCPInfo IsValidCodePage RtlUnwind InitializeCriticalSectionAndSpinCount OutputDebugStringA WriteConsoleW OutputDebugStringW FlushFileBuffers GetConsoleOutputCP MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA CloseHandle ReadFile

user32

CharUpperA

Name

.text

Size

234KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

174KB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.potel

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.docap

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.towed

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xoha

Size

512B

Virtual Size

150B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

25bd4c59ce54b70a79305a70bfd03e4e.exe

kernel32

user32