12215739230da8a13e0315ce8e95520b[.]exe

General

Target
12215739230da8a13e0315ce8e95520b.exe
Size 179KB
Sample231227-sdvz9sfdcm
SHA256 b147e01adab38814de93411e47cf77461d9aed0e28bc92410d2aa508fe63175a
MD5 12215739230da8a13e0315ce8e95520b
SHA1 eb6081fdbab5f4d22807d459cc28d58b41623f7f
SHA512 728f3d410159db9288f636f6191405a3b0b992993912e7f62d167d8e4553c016ba5f047f34e4c3483c3b0d92ba7a9a9cd9afdba7a65561515bf4ee463458087e
SSDEEP 3072:dJvvAK4Lv7A7lpXJWahuHyz5m6d02kDuOcTGQVgyRDU8EEAcm:zvAK4Lv7A7lpXJWaAHyz5/aTLByUn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12215739230da8a13e0315ce8e95520b.exe

File Explorer

12215739230da8a13e0315ce8e95520b.exe

.exe 179KB

12215739230da8a13e0315ce8e95520b.exe

IMPHASH b95b642310153d3ab6209ebaab8148ab
SHA256 b147e01adab38814de93411e47cf77461d9aed0e28bc92410d2aa508fe63175a
MD5 12215739230da8a13e0315ce8e95520b
SHA1 eb6081fdbab5f4d22807d459cc28d58b41623f7f
SHA512 728f3d410159db9288f636f6191405a3b0b992993912e7f62d167d8e4553c016ba5f047f34e4c3483c3b0d92ba7a9a9cd9afdba7a65561515bf4ee463458087e
SSDEEP 3072:dJvvAK4Lv7A7lpXJWahuHyz5m6d02kDuOcTGQVgyRDU8EEAcm:zvAK4Lv7A7lpXJWaAHyz5/aTLByUn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

15513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetComputerNameW BackupSeek GetModuleHandleW GetProcessHeap GetConsoleAliasesLengthA GetWindowsDirectoryA GetVolumePathNameW GlobalFindAtomA LoadLibraryW GetSystemWindowsDirectoryA WriteConsoleW CreateFileW InterlockedExchange GetLastError SetLastError GetProcAddress VirtualAlloc BeginUpdateResourceW SetComputerNameA OpenMutexA LocalAlloc InterlockedIncrement CreateHardLinkW AddAtomW RemoveDirectoryW BeginUpdateResourceA GetCommMask OpenJobObjectW FindFirstVolumeMountPointA FindFirstChangeNotificationA OpenFileMappingW GetStringTypeW VirtualProtect _lopen GetVersionExA EnumResourceLanguagesW SuspendThread lstrcpyA DebugActiveProcess LoadResource DnsHostnameToComputerNameA InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetStartupInfoW RaiseException RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize HeapReAlloc GetLocaleInfoA GetStringTypeA MultiByteToWideChar LCMapStringA WideCharToMultiByte LCMapStringW LoadLibraryA InitializeCriticalSectionAndSpinCount

user32

CharLowerBuffA

gdi32

GetDeviceGammaRamp

advapi32

BackupEventLogA

Sharing