ad1e983cf567b1dc01c123b5e90ae9a8[.]exe

General

Target
ad1e983cf567b1dc01c123b5e90ae9a8.exe
Size 256KB
Sample240112-mv6kfaeddm
SHA256 5bd2b2d7fd28e9ae752fd2e5b669d4b7882f733bb22a4217a4822c5325246647
MD5 ad1e983cf567b1dc01c123b5e90ae9a8
SHA1 22bd21477e92f2f914f077016414907c0dc12fea
SHA512 c75dbbb26978d369c5a4600e46574ebb5e1e49306aa25fca9225d49e5a08e5113b1b59aa085a23e24c1db794dbab574d36186c2b6daae4763ae527ba15a7804a
SSDEEP 3072:xSfU5wqLWYLlsOS24ZV1TJi9N1K4SSy8PpaeMbZ07KY5Z8GRk3xZ077X+4rm7TV:IfUjLGZV10yWZDnE3xU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad1e983cf567b1dc01c123b5e90ae9a8.exe

File Explorer

ad1e983cf567b1dc01c123b5e90ae9a8.exe

.exe 256KB

ad1e983cf567b1dc01c123b5e90ae9a8.exe

IMPHASH 7b1df25cb3b9a53041bb12b024d69535
SHA256 5bd2b2d7fd28e9ae752fd2e5b669d4b7882f733bb22a4217a4822c5325246647
MD5 ad1e983cf567b1dc01c123b5e90ae9a8
SHA1 22bd21477e92f2f914f077016414907c0dc12fea
SHA512 c75dbbb26978d369c5a4600e46574ebb5e1e49306aa25fca9225d49e5a08e5113b1b59aa085a23e24c1db794dbab574d36186c2b6daae4763ae527ba15a7804a
SSDEEP 3072:xSfU5wqLWYLlsOS24ZV1TJi9N1K4SSy8PpaeMbZ07KY5Z8GRk3xZ077X+4rm7TV:IfUjLGZV10yWZDnE3xU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalUnlock TlsGetValue HeapFree FreeEnvironmentStringsA GetModuleHandleW GetConsoleAliasesA LoadLibraryW GetLocaleInfoW GetAtomNameW CompareStringW LCMapStringA GetConsoleOutputCP GetLastError GetProcAddress GetLongPathNameA CreateNamedPipeA SetComputerNameA OpenWaitableTimerA LoadLibraryA LocalAlloc SetCurrentDirectoryW VirtualLock FindAtomA GetModuleFileNameA CreateWaitableTimerW DebugBreakProcess DeleteCriticalSection LocalFree SetFileAttributesW GetStartupInfoW RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection FatalAppExitA EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage SetConsoleCtrlHandler FreeLibrary InterlockedExchange InitializeCriticalSectionAndSpinCount GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA MultiByteToWideChar GetStringTypeW WideCharToMultiByte LCMapStringW GetTimeZoneInformation CompareStringA SetEnvironmentVariableA

Name

.text

Size

157KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nuhik

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

417B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ad1e983cf567b1dc01c123b5e90ae9a8.exe

kernel32

generic