a1cec0a0c95da81e12bd8b29d12a5648[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
a1cec0a0c95da81e12bd8b29d12a5648.exe
Size 5.2MB
Sample221205-ccph4aef87
SHA256 615eb453def2c376eb3577d573511feb06939e5160981d1f0b4e396fd80fa35b
MD5 a1cec0a0c95da81e12bd8b29d12a5648
SHA1 c3745e40c0d5c8f07915becdaef270bf16b6473e
SHA512 53922c806b87b02ab033ea8f479c8840a978420c20dcb4426a83c5faed412fc3e6b2535f24a14e772bacc9141c63c64578abcc30bee4644abd6f587defeeef9b
SSDEEP 98304:9qixHg1vHQ1/HGTZLtj/HGmuSPLLh5qRc+s+pUH1Dyti44HH:9qrHOGTZLtLHFJ+s++VDytQn
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

a1cec0a0c95da81e12bd8b29d12a5648.exe

.exe 5.2MB

a1cec0a0c95da81e12bd8b29d12a5648.exe

IMPHASH 2fd7cedd88e8728d9e072a062e6e8708
SHA256 615eb453def2c376eb3577d573511feb06939e5160981d1f0b4e396fd80fa35b
MD5 a1cec0a0c95da81e12bd8b29d12a5648
SHA1 c3745e40c0d5c8f07915becdaef270bf16b6473e
SHA512 53922c806b87b02ab033ea8f479c8840a978420c20dcb4426a83c5faed412fc3e6b2535f24a14e772bacc9141c63c64578abcc30bee4644abd6f587defeeef9b
SSDEEP 98304:9qixHg1vHQ1/HGTZLtj/HGmuSPLLh5qRc+s+pUH1Dyti44HH:9qrHOGTZLtLHFJ+s++VDytQn
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

10232969

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionEx lstrlenA lstrcatA GetModuleHandleA SetCurrentDirectoryA Sleep GetModuleHandleExA GetFileAttributesA GetBinaryTypeA QueryFullProcessImageNameA GetSystemDirectoryA GlobalAlloc lstrcpyA SetFileAttributesA VerSetConditionMask WideCharToMultiByte VerifyVersionInfoW GetSystemTimeAsFileTime HeapFree HeapAlloc GetProcAddress lstrcpynA GetProcessHeap AreFileApisANSI TryEnterCriticalSection HeapCreate EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile FindClose GetTempPathW CreateMutexW WaitForSingleObject GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc GetSystemInfo LoadLibraryW HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId SystemTimeToFileTime FreeLibrary GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers WriteConsoleW CloseHandle CreateFileA GetLastError CreateFileW SetFilePointer WriteFile UnlockFileEx ReadFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW CreateDirectoryW FindFirstFileExW FindNextFileW SetFilePointerEx GetFileInformationByHandleEx QueryPerformanceFrequency LCMapStringEx EncodePointer DecodePointer GetCPInfo GetStringTypeW SetLastError GetThreadTimes GetCurrentThread InterlockedPushEntrySList RaiseException RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetFileType ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleFileNameW GetStdHandle GetConsoleMode ReadConsoleW GetConsoleOutputCP SetStdHandle CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx GetTimeZoneInformation IsValidCodePage VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle IsProcessorFeaturePresent DecodePointer GetCommandLineA RaiseException HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc VirtualQuery LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

CharNextA CharUpperBuffW

advapi32

RegCloseKey RegCreateKeyExA RegSetValueExA OpenProcessToken RegOpenKeyExA GetTokenInformation CryptReleaseContext

shell32

ShellExecuteA

ole32

CoCreateInstance CoInitializeEx CoUninitialize

Name

.text

Size

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.TAXI0

Size

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.TAXI1

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.TAXI2

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ