b1aaf46b9ad59cce96b50b01a7b57a83[.]exe

General

Target
b1aaf46b9ad59cce96b50b01a7b57a83.exe
Size 1.3MB
Sample221206-g1f9vaed4x
SHA256 bacdddfabf0476948f55a43f5bda407afa2f1cd4884e973a1722e3f674cc2a94
MD5 b1aaf46b9ad59cce96b50b01a7b57a83
SHA1 88e096acd8b176844b904cd3de8bd7a568c1513b
SHA512 ef6afd3fd040e045832f81490a50a941db2444a3aeaf75ceec1ca61fefcbfd5af0956a7cf5bd4e3cb13bf0019ffd7232aecb993601b1954d40167b114be65594
SSDEEP 24576:F2k+mpoFYW3BDVgiFxRfgvBrS7zui/EzQgzeGm490OlP0lldTRLlZV9N/:Ik+eRW3BDVgGxdGk7KnzQ/eplmlZRLlv
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

b1aaf46b9ad59cce96b50b01a7b57a83.exe

.exe 1.3MB

b1aaf46b9ad59cce96b50b01a7b57a83.exe

IMPHASH f2a7669845a558af78441959111ad23e
SHA256 bacdddfabf0476948f55a43f5bda407afa2f1cd4884e973a1722e3f674cc2a94
MD5 b1aaf46b9ad59cce96b50b01a7b57a83
SHA1 88e096acd8b176844b904cd3de8bd7a568c1513b
SHA512 ef6afd3fd040e045832f81490a50a941db2444a3aeaf75ceec1ca61fefcbfd5af0956a7cf5bd4e3cb13bf0019ffd7232aecb993601b1954d40167b114be65594
SSDEEP 24576:F2k+mpoFYW3BDVgiFxRfgvBrS7zui/EzQgzeGm490OlP0lldTRLlZV9N/:Ik+eRW3BDVgGxdGk7KnzQ/eplmlZRLlv
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

4d:a3:a1:0b:3b:68:70:05:e7:28:7b:40:f5:66:f6:a2:b9:b6:e5:04:bc:b5:07:bf:f6:dd:a9:b8:81:1b:1b:07

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

17468

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement HeapFree GetCurrentThread GetProcessHeap IsBadReadPtr LoadLibraryW Sleep ReadConsoleOutputW GetStdHandle GetProcAddress GetThreadId HeapAlloc GetCurrentProcessId LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetConsoleTitleW VirtualQuery GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW ExitProcess WriteFile GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId GetLastError InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage VirtualAlloc HeapReAlloc RtlUnwind HeapSize GetLocaleInfoA WideCharToMultiByte GetModuleHandleA

user32

PostQuitMessage IsIconic DrawIcon GetDC ReleaseDC GetActiveWindow GetSystemMetrics SendMessageW

gdi32

GetPixel

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b1aaf46b9ad59cce96b50b01a7b57a83.exe

PE Signature issue

kernel32

user32

gdi32