download (2)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
download (2).exe
Size 94KB
Sample231114-2fb5lshe6v
SHA256 04da900802fffa84f291d919b7c8e361101b800ab0ac9f4aae85091034ebce68
MD5 91d2a3fe5ab539405833a142c1af3441
SHA1 d4184fa38656ad3b633d3e6d21ec620f24e68b97
SHA512 30802fa1b89175c296a76d94a0911dcf9b6fc5c68c7e7f14d2840bb74316d8d7a294580d1cd667d416712b91ce5a539da1f8058b43b72f65a3d183a09f8b02b4
SSDEEP 1536:d3C/OlIbLWsAESAbNVwjlkG7CnsvJLqfsWJF9d09dlHiYW:Q/OlIGTE1bnSKG7NtqvpMt1W
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
download (2).exe

File Explorer

download (2).exe

.dll 94KB

download (2).exe

IMPHASH 4864ef392e799527a3270226ac167624
SHA256 04da900802fffa84f291d919b7c8e361101b800ab0ac9f4aae85091034ebce68
MD5 91d2a3fe5ab539405833a142c1af3441
SHA1 d4184fa38656ad3b633d3e6d21ec620f24e68b97
SHA512 30802fa1b89175c296a76d94a0911dcf9b6fc5c68c7e7f14d2840bb74316d8d7a294580d1cd667d416712b91ce5a539da1f8058b43b72f65a3d183a09f8b02b4
SSDEEP 1536:d3C/OlIbLWsAESAbNVwjlkG7CnsvJLqfsWJF9d09dlHiYW:Q/OlIGTE1bnSKG7NtqvpMt1W
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

crypt32

CryptStringToBinaryA CryptImportPublicKeyInfo CryptDecodeObjectEx

kernel32

CreateFileW WriteConsoleW VirtualQuery GetSystemTimeAsFileTime LocalFree GetProcAddress CreateThread CloseHandle GetModuleHandleA LocalAlloc VirtualProtect SetFilePointerEx GetConsoleMode GetConsoleOutputCP WriteFile QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers

user32

wsprintfA wsprintfW

advapi32

RegCreateKeyExA RegQueryValueExW CryptDestroyHash CryptDestroyKey RegCloseKey CryptAcquireContextW CryptEncrypt CryptReleaseContext CryptCreateHash CryptDeriveKey CryptHashData RegSetValueExW

ntdll

RtlUnwindEx RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

Name

.text

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

download (2).exe

crypt32

kernel32

user32

advapi32

ntdll

generic