0e9be246e37eceffedcf036d5bce39e9[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
0e9be246e37eceffedcf036d5bce39e9.exe
Size 5.9MB
Sample230109-ancbssfb55
SHA256 6f8164ef913d021af0766b111ab0fe1790f6d87568d2ec2aad75c6797c0b6ddd
MD5 0e9be246e37eceffedcf036d5bce39e9
SHA1 f312a3ea84511be2512692384f7611f1c128ffe9
SHA512 531a08e4614a01a367c7ca6704f8589558157d6c615657e8a510dca09756ae5ff3a008a06f803d1cb00c3db6aecc6c2d0d840de244d50d1ef74ba9aa51c6332c
SSDEEP 49152:zYTbKuW0rl+W1iKKsmBwIFCqg4Xr3H6gWPKBnpuhpFqo3m1lnQwOXOZOJSmSMqWq:6+G7z5sqGMv79Ce6Q+K8g/rWlVkTh
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

0e9be246e37eceffedcf036d5bce39e9.exe

.exe 5.9MB

0e9be246e37eceffedcf036d5bce39e9.exe

IMPHASH 172121c476cbbec70372074c5e997bd0
SHA256 6f8164ef913d021af0766b111ab0fe1790f6d87568d2ec2aad75c6797c0b6ddd
MD5 0e9be246e37eceffedcf036d5bce39e9
SHA1 f312a3ea84511be2512692384f7611f1c128ffe9
SHA512 531a08e4614a01a367c7ca6704f8589558157d6c615657e8a510dca09756ae5ff3a008a06f803d1cb00c3db6aecc6c2d0d840de244d50d1ef74ba9aa51c6332c
SSDEEP 49152:zYTbKuW0rl+W1iKKsmBwIFCqg4Xr3H6gWPKBnpuhpFqo3m1lnQwOXOZOJSmSMqWq:6+G7z5sqGMv79Ce6Q+K8g/rWlVkTh
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

3854396

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

secur32

AcquireCredentialsHandleA FreeCredentialsHandle ApplyControlToken DeleteSecurityContext DecryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW QueryContextAttributesW EncryptMessage

kernel32

IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter WriteConsoleW GetSystemTimeAsFileTime TlsSetValue CloseHandle ReleaseSRWLockExclusive AcquireSRWLockExclusive GetProcAddress Sleep GetModuleHandleA RtlVirtualUnwind TryAcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW GetSystemInfo SetHandleInformation GetCurrentProcessId PostQueuedCompletionStatus CreateIoCompletionPort GetQueuedCompletionStatusEx SetFileCompletionNotificationModes FreeEnvironmentStringsW ReleaseMutex FindClose CompareStringOrdinal GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee SwitchToThread GetCurrentProcess GetCurrentThread RtlCaptureContext RtlLookupFunctionEntry SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW DuplicateHandle SetFilePointerEx GetStdHandle WriteFileEx SleepEx ReadFileEx WaitForSingleObject TerminateProcess QueryPerformanceCounter WakeAllConditionVariable WakeConditionVariable QueryPerformanceFrequency HeapAlloc GetProcessHeap HeapFree HeapReAlloc WaitForSingleObjectEx LoadLibraryA CreateMutexA CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileW GetFinalPathNameByHandleW GetConsoleMode GetModuleHandleW FormatMessageW GetModuleFileNameW ExitProcess GetFullPathNameW CreateNamedPipeW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW CreateThread TlsGetValue GetCurrentThreadId

advapi32

RegQueryValueExW RegOpenKeyExW GetUserNameW SystemFunction036 RegCloseKey

ws2_32

WSAStartup WSACleanup WSAGetLastError freeaddrinfo getaddrinfo WSAIoctl setsockopt WSASend send recv shutdown getsockopt ioctlsocket connect bind WSASocketW getpeername getsockname closesocket

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertOpenStore CertAddCertificateContextToStore CertGetCertificateChain CertEnumCertificatesInStore CertDuplicateCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertCloseStore CertDuplicateStore

ntdll

NtDeviceIoControlFile NtCancelIoFileEx NtCreateFile RtlNtStatusToDosError

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider

vcruntime140

memmove memcmp memset __CxxFrameHandler3 __current_exception_context _CxxThrowException __C_specific_handler __current_exception memcpy

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e exit _get_initial_narrow_environment _c_exit __p___argc _set_app_type _initialize_narrow_environment _register_thread_local_exe_atexit_callback _exit __p___argv _seh_filter_exe terminate _crt_atexit _register_onexit_function _initialize_onexit_table _configure_narrow_argv _cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode