95DC60868AF1E69C7C960D6615BE4C2B[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
95DC60868AF1E69C7C960D6615BE4C2B.exe
Size 2.8MB
Sample231203-ya74baef31
SHA256 24b671e05fc7f6f0bf06c3d7c6dff686208821c07342ba15e2633f3fc3deb0bd
MD5 95dc60868af1e69c7c960d6615be4c2b
SHA1 2c85a5c5089b38817044c90a204ce285d25e955d
SHA512 14554e7b9c2c2520919dfeb8657cf56c955db4901f64b08dbf058496378c1aeacd5050b1abe948ff722734663ce9a030e9159a4f83228f60fd9cff2e3570d303
SSDEEP 49152:J6d4eQvjVKtkxtUW9SfNcxqo5gQtGxTVuKb2kCtu44nd6n8cw:sd4rGpBoW1VuKbCAd6nN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95DC60868AF1E69C7C960D6615BE4C2B.exe

File Explorer

95DC60868AF1E69C7C960D6615BE4C2B.exe

.exe 2.8MB

95DC60868AF1E69C7C960D6615BE4C2B.exe

IMPHASH daffa07f4866e55483a8d9259c73c697
SHA256 24b671e05fc7f6f0bf06c3d7c6dff686208821c07342ba15e2633f3fc3deb0bd
MD5 95dc60868af1e69c7c960d6615be4c2b
SHA1 2c85a5c5089b38817044c90a204ce285d25e955d
SHA512 14554e7b9c2c2520919dfeb8657cf56c955db4901f64b08dbf058496378c1aeacd5050b1abe948ff722734663ce9a030e9159a4f83228f60fd9cff2e3570d303
SSDEEP 49152:J6d4eQvjVKtkxtUW9SfNcxqo5gQtGxTVuKb2kCtu44nd6n8cw:sd4rGpBoW1VuKbCAd6nN
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1892022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle CompareStringW CreateDirectoryW CreateFileA CreateFileW CreateProcessW CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExA GetComputerNameW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLangID GetSystemDefaultUILanguage GetSystemTimeAsFileTime GetTimeZoneInformation GetUserDefaultLangID GetUserDefaultUILanguage GetVolumeInformationW HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW MultiByteToWideChar PeekNamedPipe Process32FirstW Process32NextW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile RtlUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter WideCharToMultiByte WinExec WriteConsoleW WriteFile lstrcatW lstrcmpW lstrcmpiW lstrlenW HeapAlloc HeapFree ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

EnumDisplayDevicesA GetDC GetDesktopWindow GetSystemMetrics ReleaseDC SystemParametersInfoW wsprintfW

advapi32

GetCurrentHwProfileW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCW DeleteDC DeleteObject GetDIBits GetObjectW SelectObject

shlwapi

PathFileExistsW

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

iphlpapi

GetAdaptersInfo

wininet

HttpAddRequestHeadersA InternetQueryDataAvailable InternetReadFile

crypt32

CryptStringToBinaryA

Name

.text

Size

Virtual Size

464KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.\vmp\*0

Size

Virtual Size

980KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.\vmp\*1

Size

1024B

Virtual Size

1020B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.\vmp\*2

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

329KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

95DC60868AF1E69C7C960D6615BE4C2B.exe

kernel32

user32

advapi32

gdi32

shlwapi

winhttp

iphlpapi

wininet

crypt32

generic