57494e075f2db4e3b06f1772a106d1aa[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
57494e075f2db4e3b06f1772a106d1aa.exe
Size 5.8MB
Sample230613-1dlqlacc3w
SHA256 0a0c50dbc5d0c9811bfd0552ddd075e0e1df2cf07049cc546e41f9bf08cb8290
MD5 57494e075f2db4e3b06f1772a106d1aa
SHA1 a5b116f5801bd1adad5adc4f8da68aaaae565c98
SHA512 f79d003f98d3a9443c5d39b5b672be55c8f621ce0f0f54eea10d6d7e4d4447f81c8f0d27ebde3b939c64cc3498e10d32a7ac26205491155e908c091fde88c626
SSDEEP 98304:qoqwCSVZ/CBn6VqfRPsFfk/2LwgJzCpyUmdD3WV6O90dEC6KZ6YolvgFI48gQdz7:hqYVCBn6oJefe2LZzAm66jX/FAgW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57494e075f2db4e3b06f1772a106d1aa.exe

File Explorer

57494e075f2db4e3b06f1772a106d1aa.exe

.exe 5.8MB

57494e075f2db4e3b06f1772a106d1aa.exe

IMPHASH 846876fcfaab8d0675698c01a809ad4d
SHA256 0a0c50dbc5d0c9811bfd0552ddd075e0e1df2cf07049cc546e41f9bf08cb8290
MD5 57494e075f2db4e3b06f1772a106d1aa
SHA1 a5b116f5801bd1adad5adc4f8da68aaaae565c98
SHA512 f79d003f98d3a9443c5d39b5b672be55c8f621ce0f0f54eea10d6d7e4d4447f81c8f0d27ebde3b939c64cc3498e10d32a7ac26205491155e908c091fde88c626
SSDEEP 98304:qoqwCSVZ/CBn6VqfRPsFfk/2LwgJzCpyUmdD3WV6O90dEC6KZ6YolvgFI48gQdz7:hqYVCBn6oJefe2LZzAm66jX/FAgW
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10930082

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

InitializeCriticalSectionEx lstrlenA lstrcatA GetModuleHandleA SetCurrentDirectoryA Sleep GetModuleHandleExA GetFileAttributesA GetBinaryTypeA QueryFullProcessImageNameA GetSystemDirectoryA GlobalAlloc lstrcpyA SetFileAttributesA VerSetConditionMask WideCharToMultiByte VerifyVersionInfoW GetSystemTimeAsFileTime HeapFree HeapAlloc GetProcAddress lstrcpynA GetProcessHeap AreFileApisANSI TryEnterCriticalSection HeapCreate EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile FindClose GetTempPathW CreateMutexW WaitForSingleObject GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc GetSystemInfo LoadLibraryW HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId SystemTimeToFileTime FreeLibrary GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers WriteConsoleW CloseHandle CreateFileA GetLastError CreateFileW SetFilePointer WriteFile UnlockFileEx ReadFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW CreateDirectoryW FindFirstFileExW FindNextFileW SetFilePointerEx GetFileInformationByHandleEx QueryPerformanceFrequency LCMapStringEx EncodePointer DecodePointer GetCPInfo GetStringTypeW SetLastError GetCurrentThread GetThreadTimes RtlUnwindEx InterlockedPushEntrySList RtlPcToFileHeader RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetFileType ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleFileNameW GetStdHandle GetConsoleMode ReadConsoleW GetConsoleOutputCP SetStdHandle CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx GetTimeZoneInformation IsValidCodePage GetACP RtlUnwind GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle HeapReAlloc FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DecodePointer HeapAlloc RtlUnwindEx LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation GetVersion HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

CharNextA CharUpperBuffW

advapi32

RegCloseKey RegCreateKeyExA RegSetValueExA OpenProcessToken RegOpenKeyExA GetTokenInformation CryptReleaseContext

shell32

ShellExecuteA

ole32

CoCreateInstance CoInitializeEx CoUninitialize

Name

.text

Size

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp;""@

Size

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp;""@

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp;""@

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ