57962D6E4DEA092778CA4B98D68EE62D11A8CFA88FD7F[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
57962D6E4DEA092778CA4B98D68EE62D11A8CFA88FD7F.exe
Size 7.5MB
Sample230716-dcj42sdc7s
SHA256 57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355
MD5 fde4ec171a6e988c9640d8f8dcf35aea
SHA1 47d357a4e617b46e47ddc8aa9869f33a3c9fffb8
SHA512 b6635f142fe3e8f0b5c1b7a51813d3f7b52942ae8f70d12e8293423bb092326171106b5d2c8c222e3d3a2b54a4c1ce26ab6c3e58ccc6dedfe37220d93e9c4b48
SSDEEP 98304:9bRwXuv0bjY0mqBvzKczYA3IycQ6XpyWzI/vjhugtsoQYWb7lFGo:MeMVvaAPHzhug4pU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57962D6E4DEA092778CA4B98D68EE62D11A8CFA88FD7F.exe

File Explorer

57962D6E4DEA092778CA4B98D68EE62D11A8CFA88FD7F.exe

.exe 7.5MB

57962D6E4DEA092778CA4B98D68EE62D11A8CFA88FD7F.exe

IMPHASH 846876fcfaab8d0675698c01a809ad4d
SHA256 57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355
MD5 fde4ec171a6e988c9640d8f8dcf35aea
SHA1 47d357a4e617b46e47ddc8aa9869f33a3c9fffb8
SHA512 b6635f142fe3e8f0b5c1b7a51813d3f7b52942ae8f70d12e8293423bb092326171106b5d2c8c222e3d3a2b54a4c1ce26ab6c3e58ccc6dedfe37220d93e9c4b48
SSDEEP 98304:9bRwXuv0bjY0mqBvzKczYA3IycQ6XpyWzI/vjhugtsoQYWb7lFGo:MeMVvaAPHzhug4pU
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8930473

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

InitializeCriticalSectionEx lstrlenA lstrcatA GetModuleHandleA SetCurrentDirectoryA Sleep GetModuleHandleExA GetFileAttributesA GetBinaryTypeA QueryFullProcessImageNameA GetSystemDirectoryA GlobalAlloc lstrcpyA SetFileAttributesA VerSetConditionMask WideCharToMultiByte VerifyVersionInfoW GetSystemTimeAsFileTime HeapFree HeapAlloc GetProcAddress lstrcpynA GetProcessHeap AreFileApisANSI TryEnterCriticalSection HeapCreate EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile FindClose GetTempPathW CreateMutexW WaitForSingleObject GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc GetSystemInfo LoadLibraryW HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId SystemTimeToFileTime FreeLibrary GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers WriteConsoleW CloseHandle CreateFileA GetLastError CreateFileW SetFilePointer WriteFile UnlockFileEx ReadFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW CreateDirectoryW FindFirstFileExW FindNextFileW SetFilePointerEx GetFileInformationByHandleEx QueryPerformanceFrequency LCMapStringEx EncodePointer DecodePointer GetCPInfo GetStringTypeW SetLastError GetCurrentThread GetThreadTimes RtlUnwindEx InterlockedPushEntrySList RtlPcToFileHeader RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetFileType ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleFileNameW GetStdHandle GetConsoleMode ReadConsoleW GetConsoleOutputCP SetStdHandle CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx GetTimeZoneInformation IsValidCodePage GetACP RtlUnwind GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle HeapReAlloc FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DecodePointer HeapAlloc RtlUnwindEx LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation GetVersion HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

CharNextA CharUpperBuffW

advapi32

RegCloseKey RegCreateKeyExA RegSetValueExA OpenProcessToken RegOpenKeyExA GetTokenInformation CryptReleaseContext

shell32

ShellExecuteA

ole32

CoCreateInstance CoInitializeEx CoUninitialize

Name

.text

Size

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp:-~&

Size

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp:-~&

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp:-~&

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

145KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ