e1e4da80af8bd3968719ba99b670cfb3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
e1e4da80af8bd3968719ba99b670cfb3.exe
Size 2.7MB
Sample230222-e234wshh25
SHA256 d79d342e5af21638f0d08ebef466dbaa2838cb9a45614894d436f17aeadca3d8
MD5 e1e4da80af8bd3968719ba99b670cfb3
SHA1 841acf0067a4b9847a4a11562e35090cab47718f
SHA512 f0da116b1479496e76f81ec00c6ac6875494a57b0d1593f4ae3a7a6afc2106183da6b1864c337b54aa067034e62d1cae909ce4880ce95fdb24e1e7584d677d34
SSDEEP 49152:Sg0887CGdfXU4fB68ffkz4GG2S7vF2P8tyzkppGEjAI9fV4xeVQZhgo1C1SG:T0f7CZFSs6F2P8YzkppGEjf73VYhz1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

e1e4da80af8bd3968719ba99b670cfb3.exe

.exe 2.7MB

e1e4da80af8bd3968719ba99b670cfb3.exe

IMPHASH 18b314a5b04b566b00aebdc385da7a13
SHA256 d79d342e5af21638f0d08ebef466dbaa2838cb9a45614894d436f17aeadca3d8
MD5 e1e4da80af8bd3968719ba99b670cfb3
SHA1 841acf0067a4b9847a4a11562e35090cab47718f
SHA512 f0da116b1479496e76f81ec00c6ac6875494a57b0d1593f4ae3a7a6afc2106183da6b1864c337b54aa067034e62d1cae909ce4880ce95fdb24e1e7584d677d34
SSDEEP 49152:Sg0887CGdfXU4fB68ffkz4GG2S7vF2P8tyzkppGEjAI9fV4xeVQZhgo1C1SG:T0f7CZFSs6F2P8YzkppGEjf73VYhz1
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

1593905

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

htons inet_addr ntohs recv select send setsockopt shutdown socket gethostbyname WSAStartup WSAGetLastError WSAIoctl inet_ntoa bind closesocket connect ioctlsocket getsockname getsockopt __WSAFDIsSet

kernel32

LoadLibraryExA GetEnvironmentVariableA GetVolumeInformationA WaitForSingleObject OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep GetLastError AttachConsole LoadLibraryA Process32Next CloseHandle GetSystemInfo GetLocalTime GetProcAddress VirtualAllocEx GetCurrentProcessId FreeLibrary CreateRemoteThread VirtualFreeEx AllocConsole CompareFileTime GetSystemTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetConsoleTitleA GetCurrentDirectoryA GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW SetCurrentConsoleFontEx GetFullPathNameW SetFileAttributesW SetFilePointer MoveFileW GetSystemTimeAsFileTime GetTickCount FormatMessageA GetComputerNameW GetACP GetOEMCP QueryPerformanceCounter GetCurrentThreadId CreateThread GetFileSize ReadFile SetEndOfFile WriteFile LoadLibraryW GetVersionExA SetLastError WriteProcessMemory Process32First GetFileAttributesW GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW DeleteCriticalSection InitializeSListHead

user32

FindWindowA

advapi32

RegCloseKey CryptAcquireContextA RegOpenKeyExW RegOpenKeyExA AdjustTokenPrivileges OpenProcessToken RegQueryValueExA CryptSignHashA CryptSetHashParam CryptDestroyHash CryptCreateHash CryptExportKey CryptDestroyKey CryptGenRandom CryptGetUserKey CryptGetProvParam CryptReleaseContext

shell32

ShellExecuteA

msvcp140

?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?always_noconv@codecvt_base@std@@QBE_NXZ ??Bid@locale@std@@QAEIXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?_Xlength_error@std@@YAXPBD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

iphlpapi

GetAdaptersInfo

vcruntime140

_CxxThrowException __current_exception_context __current_exception _except_handler4_common memchr memcpy strchr wcsstr strstr memset __std_terminate __std_exception_copy __std_exception_destroy memmove __CxxFrameHandler3

api-ms-win-crt-stdio-l1-1-0

ferror _fileno _filelength fgetpos _chsize_s fseek fgetc ungetc fopen_s __stdio_common_vfprintf fsetpos fread _fseeki64 fwrite _telli64 freopen_s fclose fflush __acrt_iob_func fputc _get_stream_buffer_pointers _set_fmode _filelengthi64 __stdio_common_vsprintf setvbuf __p__commode

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-filesystem-l1-1-0

_lock_file remove _unlock_file

api-ms-win-crt-string-l1-1-0

isalnum towupper towlower wcscpy_s toupper _strnicmp strncmp _stricmp tolower

api-ms-win-crt-runtime-l1-1-0

exit _exit _initterm _set_app_type _get_narrow_winmain_command_line _initterm_e _invalid_parameter_noinfo_noreturn _seh_filter_exe _cexit system _crt_atexit _register_onexit_function _controlfp_s terminate _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _c_exit

api-ms-win-crt-time-l1-1-0

_time64 _tzset _mktime64 _localtime64_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh malloc

api-ms-win-crt-convert-l1-1-0

_atoi64 atoi _itoa

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale