6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe
Size 2.5MB
Sample240102-231rgsecg4
SHA256 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0
MD5 14e777412523173eb4dc71e384bf6f57
SHA1 69cb197a2336a58924f8f71bb65ac43e6668533a
SHA512 7251eda0171dd058435786066e31a2a054c1319e4f7e701441a4483e3edff5be4a27e5408ba413bb6e6d7919310f9f030e9d5106feccb2763e1ecb22baf02794
SSDEEP 49152:EPTt5uBMb2Rw/y0bgJjFmriZ7IT2dPWR8lFPYwPmfn3HQIyOcf:+pBb160bgJjwrF6gqp7yXQIyO4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe

File Explorer

6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe

.exe 2.5MB

6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe

IMPHASH 646167cce332c1c252cdcb1839e0cf48
SHA256 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0
MD5 14e777412523173eb4dc71e384bf6f57
SHA1 69cb197a2336a58924f8f71bb65ac43e6668533a
SHA512 7251eda0171dd058435786066e31a2a054c1319e4f7e701441a4483e3edff5be4a27e5408ba413bb6e6d7919310f9f030e9d5106feccb2763e1ecb22baf02794
SSDEEP 49152:EPTt5uBMb2Rw/y0bgJjFmriZ7IT2dPWR8lFPYwPmfn3HQIyOcf:+pBb160bgJjwrF6gqp7yXQIyO4
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

GetTokenInformation RegDeleteValueA RegOpenKeyExA RegQueryInfoKeyA FreeSid OpenProcessToken RegSetValueExA RegCreateKeyExA LookupPrivilegeValueA AllocateAndInitializeSid RegQueryValueExA EqualSid RegCloseKey AdjustTokenPrivileges

kernel32

_lopen _llseek CompareStringA GetLastError GetFileAttributesA GetSystemDirectoryA LoadLibraryA DeleteFileA GlobalAlloc GlobalFree CloseHandle WritePrivateProfileStringA IsDBCSLeadByte GetWindowsDirectoryA SetFileAttributesA GetProcAddress GlobalLock LocalFree RemoveDirectoryA FreeLibrary _lclose CreateDirectoryA GetPrivateProfileIntA GetPrivateProfileStringA GlobalUnlock ReadFile SizeofResource WriteFile GetDriveTypeA lstrcmpA SetFileTime SetFilePointer FindResourceA CreateMutexA GetVolumeInformationA ExpandEnvironmentStringsA GetCurrentDirectoryA FreeResource GetVersion SetCurrentDirectoryA GetTempPathA LocalFileTimeToFileTime CreateFileA SetEvent TerminateThread GetVersionExA LockResource GetSystemInfo CreateThread ResetEvent LoadResource ExitProcess GetModuleHandleW CreateProcessA FormatMessageA GetTempFileNameA DosDateTimeToFileTime CreateEventA GetExitCodeProcess FindNextFileA LocalAlloc GetShortPathNameA MulDiv GetDiskFreeSpaceA EnumResourceLanguagesA GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW Sleep FindClose GetCurrentProcess FindFirstFileA WaitForSingleObject GetModuleFileNameA LoadLibraryExA

gdi32

GetDeviceCaps

user32

SetWindowLongA GetDlgItemTextA DialogBoxIndirectParamA ShowWindow MsgWaitForMultipleObjects SetWindowPos GetDC GetWindowRect DispatchMessageA GetDesktopWindow CharUpperA SetDlgItemTextA ExitWindowsEx MessageBeep EndDialog CharPrevA LoadStringA CharNextA EnableWindow ReleaseDC SetForegroundWindow PeekMessageA GetDlgItem SendMessageA SendDlgItemMessageA MessageBoxA SetWindowTextA GetWindowLongA CallWindowProcA GetSystemMetrics

msvcrt

_controlfp ?terminate@@YAXXZ _acmdln _initterm __setusermatherr _except_handler4_common memcpy _ismbblead __p__fmode _cexit _exit exit __set_app_type __getmainargs _amsg_exit __p__commode _XcptFilter memcpy_s _vsnprintf memset

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA