4fd90fe5fb7e102df4418b85bccd15b5[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
4fd90fe5fb7e102df4418b85bccd15b5.exe
Size 2.6MB
Sample230113-va4jcaed3s
SHA256 5c5c3747d7ace4b8a38568fecc6e1da7acec0e365ee78ff885470356ad5ea1da
MD5 4fd90fe5fb7e102df4418b85bccd15b5
SHA1 0890ff66f17f0b41f59dc9e53369ed88ca8318ed
SHA512 1bbdad274643feb1fe008b1d51e0427a31c3ba5a19981b832bb06f8fac02f0c36d6f35915585545173e2adbf3cc3d1e24ceca10aed5736c48a1ed9215e95ccdb
SSDEEP 49152:kdLvvuND6JcUu0XYoLXN16aUvpnmgieLt/EhA8nFJ5QVa/o:eDvuZF0BRkaUvpnmJet/J8b5Q4
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

4fd90fe5fb7e102df4418b85bccd15b5.exe

.exe 2.6MB

4fd90fe5fb7e102df4418b85bccd15b5.exe

IMPHASH 476e0d8710d77d835e610a586e499b5b
SHA256 5c5c3747d7ace4b8a38568fecc6e1da7acec0e365ee78ff885470356ad5ea1da
MD5 4fd90fe5fb7e102df4418b85bccd15b5
SHA1 0890ff66f17f0b41f59dc9e53369ed88ca8318ed
SHA512 1bbdad274643feb1fe008b1d51e0427a31c3ba5a19981b832bb06f8fac02f0c36d6f35915585545173e2adbf3cc3d1e24ceca10aed5736c48a1ed9215e95ccdb
SSDEEP 49152:kdLvvuND6JcUu0XYoLXN16aUvpnmgieLt/EhA8nFJ5QVa/o:eDvuZF0BRkaUvpnmJet/J8b5Q4
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

1591825

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

htons inet_ntoa ntohs recv select send setsockopt shutdown socket gethostbyname WSAStartup WSAGetLastError WSAIoctl inet_addr bind closesocket connect ioctlsocket getsockname getsockopt __WSAFDIsSet

kernel32

LoadLibraryExA GetEnvironmentVariableA GetVolumeInformationA WaitForSingleObject OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep GetLastError AttachConsole LoadLibraryA DeleteFileA Process32Next CloseHandle GetSystemInfo GetLocalTime GetProcAddress VirtualAllocEx GetCurrentProcessId FreeLibrary CreateRemoteThread VirtualFreeEx AllocConsole CompareFileTime GetSystemTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation InitializeCriticalSection EnterCriticalSection SetConsoleTitleA DeleteCriticalSection GetCurrentDirectoryA GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW SetCurrentConsoleFontEx GetFileAttributesW GetFullPathNameW SetFileAttributesW SetFilePointer MoveFileW GetSystemTimeAsFileTime GetTickCount FormatMessageA GetComputerNameW GetACP GetOEMCP QueryPerformanceCounter GetCurrentThreadId CreateThread GetFileSize ReadFile SetEndOfFile WriteFile LoadLibraryW GetVersionExA SetLastError WriteProcessMemory Process32First GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW LeaveCriticalSection InitializeSListHead

user32

FindWindowA

advapi32

RegCloseKey CryptAcquireContextA RegOpenKeyExW RegOpenKeyExA AdjustTokenPrivileges OpenProcessToken RegQueryValueExA CryptSignHashA CryptSetHashParam CryptDestroyHash CryptCreateHash CryptExportKey CryptDestroyKey CryptGenRandom CryptGetUserKey CryptGetProvParam CryptReleaseContext

shell32

ShellExecuteA

msvcp140

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?always_noconv@codecvt_base@std@@QBE_NXZ ??Bid@locale@std@@QAEIXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?_Xlength_error@std@@YAXPBD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ

iphlpapi

GetAdaptersInfo

vcruntime140

_except_handler4_common _CxxThrowException __current_exception_context __current_exception memmove memchr memcpy wcsstr strstr memset __std_terminate __std_exception_copy __std_exception_destroy __CxxFrameHandler3 strchr

api-ms-win-crt-stdio-l1-1-0

ferror _fileno _filelengthi64 _filelength _chsize_s fseek fopen_s _telli64 fclose fflush __acrt_iob_func fputc _get_stream_buffer_pointers freopen_s _fseeki64 fread fsetpos ungetc setvbuf _set_fmode fgetpos __stdio_common_vsprintf fwrite __stdio_common_vfprintf __p__commode fgetc

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-string-l1-1-0

isalnum towupper towlower _stricmp toupper tolower _strnicmp strncmp wcscpy_s

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _invalid_parameter_noinfo_noreturn _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _controlfp_s terminate _initialize_onexit_table system _initialize_narrow_environment _configure_narrow_argv _crt_atexit

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s _tzset _mktime64

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-convert-l1-1-0

_atoi64 atoi _itoa

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale