8f951988acb3a0d53fe2d66cfd60b7a0[.]exe

General

Target
8f951988acb3a0d53fe2d66cfd60b7a0.exe
Size 205KB
Sample240111-cez3lsdda4
SHA256 9024a473b6244e9aef3f65da784300194ff67434a204b445e5099ea80c19f949
MD5 8f951988acb3a0d53fe2d66cfd60b7a0
SHA1 9c39e8de9925b1102c39cbaabd01839c7e0c2e3e
SHA512 8bc796f9f523d20d2fc10d36ba8fa60bf0e412733b75ee0bfcc82716f3d6fbe86b0af614f885d5f294694ebd60f1e74040b7ad044357896a5611821b69ce30e8
SSDEEP 3072:EdrEskahJisaAN0yunrtMxxFF3m7SfdBm2HQWRlMuqBL2A:kEskaFVunrqvldBcz+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f951988acb3a0d53fe2d66cfd60b7a0.exe

File Explorer

8f951988acb3a0d53fe2d66cfd60b7a0.exe

.exe 205KB

8f951988acb3a0d53fe2d66cfd60b7a0.exe

IMPHASH 7e32959e1e010773874596cbc1a01e01
SHA256 9024a473b6244e9aef3f65da784300194ff67434a204b445e5099ea80c19f949
MD5 8f951988acb3a0d53fe2d66cfd60b7a0
SHA1 9c39e8de9925b1102c39cbaabd01839c7e0c2e3e
SHA512 8bc796f9f523d20d2fc10d36ba8fa60bf0e412733b75ee0bfcc82716f3d6fbe86b0af614f885d5f294694ebd60f1e74040b7ad044357896a5611821b69ce30e8
SSDEEP 3072:EdrEskahJisaAN0yunrtMxxFF3m7SfdBm2HQWRlMuqBL2A:kEskaFVunrqvldBcz+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5205

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalUnlock TlsGetValue HeapFree FreeEnvironmentStringsA GetModuleHandleW GetConsoleAliasesA GetLocaleInfoW GetAtomNameW CompareStringW LCMapStringA GetConsoleOutputCP GetLastError GetProcAddress LoadLibraryA LocalAlloc VirtualLock GetModuleFileNameA DeleteCriticalSection LocalFree GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread Sleep HeapSize ExitProcess WriteFile GetStdHandle GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection FatalAppExitA EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage SetConsoleCtrlHandler FreeLibrary InterlockedExchange InitializeCriticalSectionAndSpinCount RtlUnwind GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringW GetTimeZoneInformation CompareStringA SetEnvironmentVariableA

Name

.text

Size

128KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gisayi

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.lusasa

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8f951988acb3a0d53fe2d66cfd60b7a0.exe

kernel32

generic