899c63ad442ad628054c96ec16c6049f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
899c63ad442ad628054c96ec16c6049f.exe
Size 2.7MB
Sample221229-kr6d6acg33
SHA256 591c4b18225fb41ce754ffc0bb30d7cda046f768469470da4757c04613ec00ed
MD5 899c63ad442ad628054c96ec16c6049f
SHA1 5167c7e242b76f4338f35fbf2b7352d278f65148
SHA512 909a3601191cfc1e02976581d9efb56c562de26a34b4c7939d660837a7874692edbc242b517cb89605556e2df58035375b45a4934d50f0a0be810f78acb419e7
SSDEEP 49152:NOhkDcRTciEZoO5gECCKptLWi2BrR82f3/9huZrDCKgJPyYpVXn:NnDAZCGLWi2BtTf3/uZrDMP7p
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

899c63ad442ad628054c96ec16c6049f.exe

.exe 2.7MB

899c63ad442ad628054c96ec16c6049f.exe

IMPHASH 612edbc3b53f6e607818891b34ab969c
SHA256 591c4b18225fb41ce754ffc0bb30d7cda046f768469470da4757c04613ec00ed
MD5 899c63ad442ad628054c96ec16c6049f
SHA1 5167c7e242b76f4338f35fbf2b7352d278f65148
SHA512 909a3601191cfc1e02976581d9efb56c562de26a34b4c7939d660837a7874692edbc242b517cb89605556e2df58035375b45a4934d50f0a0be810f78acb419e7
SSDEEP 49152:NOhkDcRTciEZoO5gECCKptLWi2BrR82f3/9huZrDCKgJPyYpVXn:NnDAZCGLWi2BtTf3/uZrDMP7p
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

1681792

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

WSAIoctl WSAGetLastError WSAStartup gethostbyname socket shutdown setsockopt send select recv ntohs inet_ntoa inet_addr htons bind closesocket connect ioctlsocket getsockname getsockopt __WSAFDIsSet

kernel32

SetConsoleTitleA GetStdHandle SetConsoleMode SetCurrentConsoleFontEx LoadLibraryExA WaitForSingleObject ReadConsoleA OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep GetConsoleMode GetLastError AttachConsole Process32Next CloseHandle GetProcAddress VirtualAllocEx GetCurrentProcessId CreateRemoteThread VirtualFreeEx AllocConsole CompareFileTime GetSystemTime GetLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WriteProcessMemory GetCurrentDirectoryA GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW GetFullPathNameW SetFileAttributesW SetFilePointer MoveFileW GetSystemTimeAsFileTime GetTickCount FormatMessageA GetComputerNameW GetACP GetOEMCP QueryPerformanceCounter GetCurrentThreadId CreateThread GetFileSize ReadFile SetEndOfFile WriteFile LoadLibraryW LoadLibraryA GetVersionExA FreeLibrary SetLastError Process32First GetModuleHandleW SetConsoleTextAttribute UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW

user32

MessageBoxA FindWindowA

advapi32

RegOpenKeyExW RegOpenKeyExA AdjustTokenPrivileges OpenProcessToken RegCloseKey CryptSignHashA CryptSetHashParam CryptDestroyHash CryptCreateHash RegQueryValueExA CryptExportKey CryptDestroyKey CryptGenRandom CryptGetUserKey CryptGetProvParam CryptReleaseContext CryptAcquireContextA

msvcp140

?_Xlength_error@std@@YAXPBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?uncaught_exception@std@@YA_NXZ

vcruntime140

_except_handler4_common _CxxThrowException __current_exception_context __current_exception memmove memchr memcpy strchr wcsstr strstr memset __std_terminate __std_exception_copy __std_exception_destroy __CxxFrameHandler3

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-stdio-l1-1-0

_fseeki64 fread _fileno fflush ferror _telli64 _filelengthi64 _filelength _set_fmode _chsize_s fwrite fseek __p__commode __acrt_iob_func fclose fopen_s freopen_s __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

isalnum towupper wcscpy_s _strnicmp towlower toupper tolower _stricmp strncmp

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _controlfp_s _register_onexit_function system _register_thread_local_exe_atexit_callback _c_exit _cexit _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _invalid_parameter_noinfo_noreturn _set_app_type _initialize_onexit_table _seh_filter_exe

api-ms-win-crt-time-l1-1-0

_mktime64 _time64 _localtime64_s _tzset

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-convert-l1-1-0

_atoi64 atoi

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale