11012024_1137_final_f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

11012024_1137_final_f.exe
Size

456KB
MD5

5dff365d4162f958820dea8bfb8360bf
SHA1

4f04b1e52570ffcdff2e4a9f1994878ef5aa035a
SHA256

3a007281a8b7c1b0090942206dfd18d39e9c8f2e7c10fda104b644b842568c06
SHA512

8ff1e36c1e6c6ed3cbcaa065a0ecc30da57b934f78f41513494a47a36dd125ff71461e9619a483a51d03405790c7fd4e18e08a21883d5e354a7b2f0d05b80998
SSDEEP

12288:OTWFHvqbW2CLgEFnIZewwirOTXmwDX/hk5f:OSCW24gEFnIZewwrXN5kJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11012024_1137_final_f.exe

Files

11012024_1137_final_f.exe
.exe windows:6 windows x86 arch:x86

Password: infected

cd45af25648552ba9f495cbe71b71256

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
WinExec
CreateToolhelp32Snapshot
Process32NextW
GetDiskFreeSpaceExW
DeleteCriticalSection
CloseHandle
GetSystemInfo
GlobalMemoryStatusEx
WriteConsoleW
CreateFileW
SetStdHandle
DecodePointer
HeapAlloc
HeapReAlloc
GlobalFree
GetLastError
MultiByteToWideChar
HeapSize
InitializeCriticalSectionEx
GetModuleHandleExW
Process32FirstW
HeapFree
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
ReadConsoleW
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
QueryPerformanceCounter
WideCharToMultiByte
GetCurrentThreadId
GetStringTypeW
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
EncodePointer
GetLocaleInfoEx
LCMapStringEx
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
RaiseException
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
SetEndOfFile

advapi32

CryptDestroyKey
RegCloseKey
CryptAcquireContextW
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
RegSetValueExW
CryptDestroyHash
RegOpenKeyExW
CryptReleaseContext

winhttp

WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpAddRequestHeaders
WinHttpWriteData
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpCrackUrl
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpOpen
WinHttpGetProxyForUrl

Sections

.text
Size: 340KB - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

cd45af25648552ba9f495cbe71b71256

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

winhttp

Sections

.text Size: 340KB - Virtual size: 340KB

.rdata Size: 80KB - Virtual size: 80KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 340KB - Virtual size: 340KB

.rdata
Size: 80KB - Virtual size: 80KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 16KB - Virtual size: 16KB