e150446405fcffexeexeexeex[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
e150446405fcffexeexeexeex.exe
Size 2.1MB
Sample230711-g94rhaee83
SHA256 74886acb42e35583993adf2df92272ede38e8a4a3a4a44608e02b38d7b1a2f2e
MD5 e150446405fcffb91b4dfe60c4139df5
SHA1 792b74d1764bfa1d0ff4e5470da92084f1064c96
SHA512 401b600e5fd9ae9070d1195d441fd9416abafdc4dfb82578c3a9be89ab7ce2a6407b9fed244974a8cfc7cab09509ef088b0675335881f709a7c81295b2f233e7
SSDEEP 49152:p9yiCJ5rFwnANZGEXeZ+9Sx8egOSDAmosh3ANkTTl:CJ5rFwnApe1gOS9V3AM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e150446405fcffexeexeexeex.exe

File Explorer

e150446405fcffexeexeexeex.exe

.exe 2.1MB

e150446405fcffexeexeexeex.exe

IMPHASH fcdcf4239ade4bb66e6f89d5914ca08e
SHA256 74886acb42e35583993adf2df92272ede38e8a4a3a4a44608e02b38d7b1a2f2e
MD5 e150446405fcffb91b4dfe60c4139df5
SHA1 792b74d1764bfa1d0ff4e5470da92084f1064c96
SHA512 401b600e5fd9ae9070d1195d441fd9416abafdc4dfb82578c3a9be89ab7ce2a6407b9fed244974a8cfc7cab09509ef088b0675335881f709a7c81295b2f233e7
SSDEEP 49152:p9yiCJ5rFwnANZGEXeZ+9Sx8egOSDAmosh3ANkTTl:CJ5rFwnApe1gOS9V3AM
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

317472

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindClose DeleteFileA VirtualFree GetEnvironmentVariableA VirtualAlloc CreateFileMappingA SetFileTime GetFileAttributesA GetFileAttributesW ReadFile CreateFileW lstrcatA DeviceIoControl lstrcpyW SetLastError GetComputerNameA FindResourceA FreeResource LoadResource WaitForSingleObject GetProcessHeap GetSystemWow64DirectoryA SizeofResource CreateEventA CreateProcessA GetSystemDirectoryA ResetEvent GetLocalTime GetExitCodeThread LockResource GetSystemInfo WinExec FreeLibrary IsBadReadPtr LoadLibraryA VirtualProtect GetModuleHandleW GetSystemDirectoryW LoadLibraryW GetCurrentThreadId InterlockedIncrement ExpandEnvironmentStringsA LocalAlloc ResumeThread SetFilePointer SystemTimeToFileTime CreateDirectoryA GetCurrentDirectoryA LocalFileTimeToFileTime GetDriveTypeA GetPrivateProfileStringA GetFileSize WaitNamedPipeW ReadProcessMemory SetNamedPipeHandleState VirtualFreeEx VirtualAllocEx SleepEx lstrlenW CreateProcessW WriteProcessMemory VirtualProtectEx lstrcpyA GetVersionExW GetCurrentDirectoryW GetModuleFileNameW GetVersion VirtualQueryEx GetCurrentThread CreateRemoteThread GetWindowsDirectoryW CreateFileMappingW CreateMutexW OpenMutexW OpenFileMappingW CreateEventW OpenEventW ExitThread FlushInstructionCache ReleaseMutex GetThreadContext InterlockedCompareExchange SetEndOfFile GetDriveTypeW SetEnvironmentVariableA CompareStringW GetTimeZoneInformation InterlockedExchange GetStringTypeW GetFullPathNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers LocalFree FormatMessageA GetTickCount lstrlenA FileTimeToLocalFileTime CreateToolhelp32Snapshot Process32Next lstrcmpiA FileTimeToSystemTime GetProcessTimes Process32First WriteFile WaitNamedPipeA GetSystemTime OpenFileMappingA GetCurrentProcessId CloseHandle CreateMutexA GetModuleHandleA GetModuleFileNameA GetProcAddress GetLastError MultiByteToWideChar TerminateProcess Sleep WideCharToMultiByte OpenProcess FlushViewOfFile UnmapViewOfFile MapViewOfFile CreateFileA ExitProcess OutputDebugStringA DeleteCriticalSection AddVectoredExceptionHandler EnterCriticalSection HeapCreate LeaveCriticalSection InitializeCriticalSection HeapFree GetCurrentProcess HeapAlloc VirtualQuery LCMapStringW GetConsoleMode GetConsoleCP GetStartupInfoW SetHandleCount InitializeCriticalSectionAndSpinCount SetStdHandle HeapSize IsValidCodePage GetOEMCP GetACP GetCPInfo RaiseException InterlockedDecrement TlsFree TlsSetValue TlsGetValue TlsAlloc IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind FindFirstFileExA HeapSetInformation GetCommandLineA HeapReAlloc GetStdHandle WriteConsoleW GetFileType PeekNamedPipe GetFileInformationByHandle MoveFileA CreateThread DecodePointer EncodePointer GetSystemTimeAsFileTime DuplicateHandle

user32

GetThreadDesktop GetUserObjectInformationA OpenInputDesktop wsprintfA CharNextA GetParent EnumWindows PeekMessageA GetSystemMetrics GetWindowThreadProcessId GetMessageA TranslateMessage DispatchMessageA CloseDesktop

advapi32

OpenSCManagerA InitializeSecurityDescriptor SetSecurityDescriptorDacl GetLengthSid GetKernelObjectSecurity AllocateAndInitializeSid FreeSid GetTokenInformation LookupPrivilegeValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyW RegDeleteKeyW CreateServiceW OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatus ChangeServiceConfigW StartServiceW ControlService OpenProcessToken QueryServiceStatusEx StartServiceA CreateServiceA EnumDependentServicesA DeleteService CloseServiceHandle OpenServiceA RegDeleteValueA RegEnumKeyExA RegDeleteKeyA RegCloseKey RegOpenKeyA BuildExplicitAccessWithNameA RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegSetValueExA SetNamedSecurityInfoA SetEntriesInAclA AdjustTokenPrivileges LookupPrivilegeValueA

shell32

ShellExecuteExA SHFileOperationA

shlwapi

PathIsDirectoryA PathIsRootA PathFindFileNameA PathStripToRootA PathFileExistsA PathRemoveFileSpecA PathAddBackslashA

psapi

GetMappedFileNameA

ws2_32

getsockname htons inet_addr connect gethostname WSACleanup WSAStartup WSAGetLastError recv send socket ntohs bind getsockopt getpeername WSASetLastError freeaddrinfo getaddrinfo __WSAFDIsSet select ioctlsocket closesocket setsockopt gethostbyname

imagehlp

CheckSumMappedFile

iphlpapi

GetAdaptersInfo

Name

.text

Size

995KB

Virtual Size

994KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cpp0

Size

577KB

Virtual Size

577KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

386KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ