62d858df93a1ef71f5ed7ed1d8111395[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
62d858df93a1ef71f5ed7ed1d8111395.exe
Size 2.5MB
Sample221014-cq92yscde4
SHA256 4d771099702b61244d44ce4d6c6ffdacd79bfead7b5774eb0ec8a1e7e9470056
MD5 62d858df93a1ef71f5ed7ed1d8111395
SHA1 5b0e71ff65b489438ccd4cd75fed0f848259511d
SHA512 ccfb0456b365fc0715dc3bf39bd838b8e8e16682bfe8dcc6f450236a73fffc0d52194fb59e7603da1627cade187add46e82ac490b2ff4c32e63da33298e2b481
SSDEEP 12288:scOdNT8feftQC9zoGzNkcOpHWbF6fa90osMjw:hUTtMXHWcMj
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

62d858df93a1ef71f5ed7ed1d8111395.exe

.exe 2.5MB

62d858df93a1ef71f5ed7ed1d8111395.exe

IMPHASH f2cedb2d1bd9c774402238127a7c03eb
SHA256 4d771099702b61244d44ce4d6c6ffdacd79bfead7b5774eb0ec8a1e7e9470056
MD5 62d858df93a1ef71f5ed7ed1d8111395
SHA1 5b0e71ff65b489438ccd4cd75fed0f848259511d
SHA512 ccfb0456b365fc0715dc3bf39bd838b8e8e16682bfe8dcc6f450236a73fffc0d52194fb59e7603da1627cade187add46e82ac490b2ff4c32e63da33298e2b481
SSDEEP 12288:scOdNT8feftQC9zoGzNkcOpHWbF6fa90osMjw:hUTtMXHWcMj
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

70386

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesW HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetPerformanceInfo K32GetProcessMemoryInfo ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlUnwind SearchPathW SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetProcessShutdownParameters SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SignalObjectAndWait Sleep SleepConditionVariableSRW Wow64GetThreadContext WriteConsoleW WriteFile WriteProcessMemory GetConsoleMode GetProcAddress GetModuleHandleW lstrcmpiW RaiseException GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW VirtualAllocEx VirtualProtectEx InterlockedDecrement InterlockedIncrement DeleteCriticalSection DecodePointer GlobalAlloc GlobalLock GlobalUnlock GlobalSize LeaveCriticalSection GetTimeZoneInformation CreateThread OutputDebugStringA SetEnvironmentVariableA GetOEMCP FindNextFileA FindFirstFileExA GetStringTypeW GetUserDefaultLCID GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetFullPathNameA GetFullPathNameW ReadConsoleW GetStdHandle WideCharToMultiByte GetModuleFileNameA GetModuleHandleExW SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType CreateFileW InterlockedFlushSList TlsFree TlsSetValue TlsGetValue TlsAlloc GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW TerminateProcess UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx CloseHandle LoadLibraryExA VirtualFree VirtualAlloc GetConsoleCP GetComputerNameExW GetCommandLineW GetCommandLineA GetCPInfo GetACP FreeLibrary FreeEnvironmentStringsW FormatMessageA FlushViewOfFile FlushFileBuffers FindNextFileW FindFirstFileExW FindClose FileTimeToSystemTime ExpandEnvironmentStringsW ExitProcess EnumSystemLocalesW EnumSystemLocalesEx EnterCriticalSection EncodePointer lstrlenW DuplicateHandle FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetProcessHeap HeapAlloc OutputDebugStringW

user32

SetProcessDPIAware SendMessageTimeoutW RegisterClassW PostMessageW IsWindow GetWindowThreadProcessId GetUserObjectInformationW SetProcessWindowStation TranslateMessage UnregisterClassW CharNextW PostQuitMessage GetWindowPlacement GetThreadDesktop GetProcessWindowStation GetMessageW RegisterClassExW CreateWindowExW LoadCursorW GetClassInfoExW GetClientRect DestroyWindow SetWindowPos CheckMenuItem ModifyMenuW ShowWindow SetWindowPlacement MessageBoxW SendMessageW LoadIconW GetDesktopWindow LoadMenuW CallWindowProcW GetWindowLongW SetWindowLongW DispatchMessageW PostThreadMessageW MessageBoxA DefWindowProcW

advapi32

RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW EventUnregister EventRegister EqualSid DuplicateTokenEx DuplicateToken CreateWellKnownSid CreateRestrictedToken CreateProcessAsUserW CopySid ConvertStringSidToSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW AccessCheck RegQueryValueExW

shell32

SHGetKnownFolderPath SHGetFolderPathW CommandLineToArgvW

ole32

CoTaskMemRealloc CoTaskMemFree GetHGlobalFromStream CreateStreamOnHGlobal CoUninitialize CoRevokeClassObject CoRegisterClassObject StringFromGUID2 CoInitialize CoCreateInstance CoSuspendClassObjects CoTaskMemAlloc

oleaut32

SysFreeString UnRegisterTypeLi VarUI4FromStr LoadTypeLi VarBstrCat SysAllocStringLen SysStringLen RegisterTypeLi SysAllocString

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

373KB

Virtual Size

373KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

460B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ