f7804b28924475bb1d81a1bd0e9a8da396e8e199aab7584b90e4da5a1b00b49b[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
f7804b28924475bb1d81a1bd0e9a8da396e8e199aab7584b90e4da5a1b00b49b.exe
Size 545KB
Sample221114-fb9peseg97
SHA256 f7804b28924475bb1d81a1bd0e9a8da396e8e199aab7584b90e4da5a1b00b49b
MD5 bdcfaa15c2afef3f66a0fdce7fcc1cbd
SHA1 eae325decfa0d906a2a5ca96fe0fa520ef87a79b
SHA512 da996cbee230e158bfd55cd3dc063eadfd67c08bcf35be3d5934c853ba4736a232ec63b0fc53b6133deff87e7a6fcfcf0789167bc55011da357110e411d31708
SSDEEP 12288:Ces9JMYkt+FY4QhvblqGNxq9bdPH9KMR+s/:CLkYY4Q1Rr09bdPK6
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

f7804b28924475bb1d81a1bd0e9a8da396e8e199aab7584b90e4da5a1b00b49b.exe

.exe 545KB

f7804b28924475bb1d81a1bd0e9a8da396e8e199aab7584b90e4da5a1b00b49b.exe

IMPHASH 04d4bb28aff7ca41d7ab5ffbe778d7b2
SHA256 f7804b28924475bb1d81a1bd0e9a8da396e8e199aab7584b90e4da5a1b00b49b
MD5 bdcfaa15c2afef3f66a0fdce7fcc1cbd
SHA1 eae325decfa0d906a2a5ca96fe0fa520ef87a79b
SHA512 da996cbee230e158bfd55cd3dc063eadfd67c08bcf35be3d5934c853ba4736a232ec63b0fc53b6133deff87e7a6fcfcf0789167bc55011da357110e411d31708
SSDEEP 12288:Ces9JMYkt+FY4QhvblqGNxq9bdPH9KMR+s/:CLkYY4Q1Rr09bdPK6
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

59424

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

oleaut32

SysFreeString SysStringLen

shell32

CommandLineToArgvW SHGetKnownFolderPath SHGetSpecialFolderPathW ShellExecuteW

shlwapi

PathCombineW PathFileExistsW StrChrW

user32

CharLowerBuffW

wininet

DeleteUrlCacheContainerW GetUrlCacheEntryBinaryBlob UrlCacheCreateContainer

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateDirectoryW CreateEventW CreateFileW CreateProcessW DebugBreak DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetExitCodeProcess GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExW LocalFree MultiByteToWideChar OutputDebugStringW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

ole32

CoInitializeEx CoTaskMemFree

urlmon

CreateUri

Name

.text

Size

334KB

Virtual Size

333KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ