29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6[.]exe

General

Target
29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6.exe
Size 286KB
Sample240205-back3sehf6
SHA256 29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6ca601c1bb197f73a712
MD5 ed6cc7a333a220b9ae5462894b49ff2f
SHA1 f0612fed471943d529a61b1a2fb38867deb19439
SHA512 33c71ab88096c85562a322c2f3dbd1a16a81fc7f34db95abe45b5af9023e4a7ba72917028266f2d8c2e4441fff2c8e3140b08835c93f8fb8da018bcb03e21ec2
SSDEEP 6144:94AzlTq8VH6iZMwSp/AwO025v3fsTkHd1s:94AzleYH6ISp/Awr21PsTk92
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6.exe

File Explorer

29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6.exe

.exe 286KB

29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6.exe

IMPHASH 4f1b3bf8bd66597d926a89d7a07a5f88
SHA256 29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6ca601c1bb197f73a712
MD5 ed6cc7a333a220b9ae5462894b49ff2f
SHA1 f0612fed471943d529a61b1a2fb38867deb19439
SHA512 33c71ab88096c85562a322c2f3dbd1a16a81fc7f34db95abe45b5af9023e4a7ba72917028266f2d8c2e4441fff2c8e3140b08835c93f8fb8da018bcb03e21ec2
SSDEEP 6144:94AzlTq8VH6iZMwSp/AwO025v3fsTkHd1s:94AzleYH6ISp/Awr21PsTk92
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement MoveFileExW OpenJobObjectA SetDefaultCommConfigW CreateDirectoryW FreeEnvironmentStringsA GetTickCount GetConsoleAliasesLengthA TzSpecificLocalTimeToSystemTime GetSystemTimes WideCharToMultiByte LoadLibraryW GetLocaleInfoW CompareStringW GetStartupInfoW WritePrivateProfileStringW FlushFileBuffers GetConsoleAliasesW EndUpdateResourceW SetLastError GetProcAddress GetProcessHeaps CreateNamedPipeA EnumDateFormatsExA ResetEvent OpenWaitableTimerA LoadLibraryA GetProcessWorkingSetSize LocalAlloc DnsHostnameToComputerNameA FreeEnvironmentStringsW GetCurrentDirectoryA FileTimeToLocalFileTime GetVolumeInformationW IsValidLocale EnumSystemLocalesA GetLocaleInfoA HeapAlloc SetCurrentDirectoryA GetModuleHandleExA EncodePointer DecodePointer GetCommandLineA HeapSetInformation TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW HeapCreate HeapDestroy Sleep HeapSize EnterCriticalSection LeaveCriticalSection GetModuleFileNameA GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId GetLastError InterlockedDecrement GetCurrentThread QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FatalAppExitA SetConsoleCtrlHandler FreeLibrary InterlockedExchange HeapReAlloc RtlUnwind HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode LCMapStringW MultiByteToWideChar GetStringTypeW SetFilePointer IsProcessorFeaturePresent CloseHandle WriteConsoleW SetStdHandle CreateFileW GetUserDefaultLCID RaiseException

user32

DestroyIcon GetClassLongW

advapi32

ReadEventLogA GetServiceKeyNameA

Name

.text

Size

199KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nixos

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gukuvud

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6.exe

kernel32

user32

advapi32

generic