425b312c607eaa405059b4928a65cba8[.]exe

General

Target
425b312c607eaa405059b4928a65cba8.exe
Size 420KB
Sample240107-wqjpjscef5
SHA256 ea25dcf8f74b1d1094825d695807839f48230a800420cd2c57a05f7f6fe5a5bb
MD5 425b312c607eaa405059b4928a65cba8
SHA1 3caefbcad6d742e8c1849ec2d8ce092c0c75152f
SHA512 89d9c201da31815db48bbb0fea5268044a412dac91677f8d9fc9a7ff1b9eec9d0c8b3c864b340148a22cacbd6b2e3a37dbfd94170ccba3d059ee261c402d1fa6
SSDEEP 12288:hET5GSUENyq2QSfyrVVM6O83C1+ZOXzh:aTXUENRFlZVMusYOj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
425b312c607eaa405059b4928a65cba8.exe

File Explorer

425b312c607eaa405059b4928a65cba8.exe

.exe 420KB

425b312c607eaa405059b4928a65cba8.exe

IMPHASH 6801e04a0c2ca60ac2497c0d8723846b
SHA256 ea25dcf8f74b1d1094825d695807839f48230a800420cd2c57a05f7f6fe5a5bb
MD5 425b312c607eaa405059b4928a65cba8
SHA1 3caefbcad6d742e8c1849ec2d8ce092c0c75152f
SHA512 89d9c201da31815db48bbb0fea5268044a412dac91677f8d9fc9a7ff1b9eec9d0c8b3c864b340148a22cacbd6b2e3a37dbfd94170ccba3d059ee261c402d1fa6
SSDEEP 12288:hET5GSUENyq2QSfyrVVM6O83C1+ZOXzh:aTXUENRFlZVMusYOj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

221408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeactivateActCtx GetVersionExW SetConsoleCP GetConsoleAliasesLengthA GetDefaultCommConfigA FindFirstFileExW GetDriveTypeA FreeEnvironmentStringsA SetProcessPriorityBoost SetVolumeMountPointW GetLongPathNameW CopyFileA TlsGetValue GetConsoleCursorInfo SetComputerNameExA SystemTimeToTzSpecificLocalTime FindAtomA ReleaseSemaphore CallNamedPipeA CreateMailslotA BuildCommDCBAndTimeoutsW VirtualProtect LoadLibraryA LocalAlloc TryEnterCriticalSection GetCommandLineW InterlockedDecrement GetCalendarInfoA DeleteFileA CreateActCtxW CreateRemoteThread SetSystemTimeAdjustment SetPriorityClass WritePrivateProfileStringW GetProcessHeap GlobalUnWire ReadConsoleOutputCharacterW GetStartupInfoW GetDiskFreeSpaceExA GetCPInfoExA GetWindowsDirectoryW GetSystemWow64DirectoryW GetLastError GetProfileStringW WriteProfileSectionW GetProfileStringA SetLastError DeleteVolumeMountPointA DebugBreak lstrcmpA ReadFileScatter SetConsoleMode GetVersion GetSystemWindowsDirectoryW GlobalFindAtomA FindCloseChangeNotification GetTapeParameters SetMailslotInfo InterlockedExchange DefineDosDeviceW FindVolumeMountPointClose EndUpdateResourceA WriteConsoleA GetSystemTimeAdjustment WritePrivateProfileSectionA GetPrivateProfileStructW GetFileAttributesExA MoveFileW GetVolumePathNameA HeapUnlock lstrcmpW SetDefaultCommConfigW GetExitCodeProcess ResetEvent GetThreadContext MoveFileExW GetProcAddress GlobalLock UnregisterWaitEx BuildCommDCBW PeekConsoleInputW GetBinaryTypeW CreateSemaphoreW TransmitCommChar WaitNamedPipeA GetOverlappedResult GetPrivateProfileSectionNamesW FindResourceExW EnumTimeFormatsW GetLocalTime CreateSemaphoreA FreeEnvironmentStringsW GetPrivateProfileSectionW SetFileShortNameA lstrcpyA VerLanguageNameW SetThreadExecutionState SetSystemTime LockFile VerSetConditionMask GetConsoleAliasA FlushConsoleInputBuffer FreeConsole GetAtomNameW GetConsoleAliasExesLengthA WriteConsoleInputW TransactNamedPipe EnumDateFormatsA SetCommState FileTimeToLocalFileTime _lopen GetConsoleAliasExesLengthW GetWriteWatch GetModuleHandleW WriteConsoleOutputCharacterA GetConsoleMode HeapFree OpenMutexA LocalLock GetCommMask SetEndOfFile FindClose CreateIoCompletionPort SetFileApisToANSI CancelWaitableTimer GetProcessHandleCount UnregisterWait GetConsoleAliasesLengthW GetCurrentProcessId lstrcpynA SetNamedPipeHandleState GetCompressedFileSizeA FindNextVolumeMountPointW GetFullPathNameA WriteProfileStringA DeleteAtom GlobalAddAtomW AssignProcessToJobObject QueryDosDeviceW InitializeCriticalSection Process32NextW SetCurrentDirectoryA GetBinaryTypeA FindActCtxSectionGuid TerminateProcess MoveFileA RaiseException HeapValidate IsBadReadPtr DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleFileNameW GetModuleHandleA GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InterlockedIncrement GetACP GetOEMCP GetCPInfo IsValidCodePage TlsAlloc TlsSetValue GetCurrentThreadId TlsFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree GetModuleFileNameA WriteFile HeapAlloc HeapSize HeapReAlloc VirtualAlloc RtlUnwind InitializeCriticalSectionAndSpinCount OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW MultiByteToWideChar GetStringTypeA GetStringTypeW WideCharToMultiByte LCMapStringA LCMapStringW GetLocaleInfoA SetFilePointer GetConsoleCP FlushFileBuffers SetStdHandle GetConsoleOutputCP CloseHandle CreateFileA

user32

OemToCharA

advapi32

GetFileSecurityA

Name

.text

Size

356KB

Virtual Size

356KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.jud

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dine

Size

512B

Virtual Size

234B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.peciziy

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

425b312c607eaa405059b4928a65cba8.exe

kernel32

user32

advapi32

generic