1f973adbd542db0e2accb9ff334c9189[.]exe

General

Target
1f973adbd542db0e2accb9ff334c9189.exe
Size 243KB
Sample240205-bmsstshbfm
SHA256 8dd8887d8acd43b2e8a7b0bed168933dcddf4cb3083906f6ef864e451041ae18
MD5 1f973adbd542db0e2accb9ff334c9189
SHA1 713260984c002819d10b11e63b6bf28873641950
SHA512 970793042d19130b2742ec2afd8543321f096be72f1eeecb666fe716ae15d0aaade7e28102a1bca7e6beefd0f8fafbcbf1cd564be293be9205b04c80cb072c00
SSDEEP 3072:94uOsKcdFdzR/9sA+cqRf8qWy6/dbgZyvhid/8VrOgGet6P0s4iNx:9ocFdzR/9sAqWyQeyvA/89OAt1s
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f973adbd542db0e2accb9ff334c9189.exe

File Explorer

1f973adbd542db0e2accb9ff334c9189.exe

.exe 243KB

1f973adbd542db0e2accb9ff334c9189.exe

IMPHASH 4f1b3bf8bd66597d926a89d7a07a5f88
SHA256 8dd8887d8acd43b2e8a7b0bed168933dcddf4cb3083906f6ef864e451041ae18
MD5 1f973adbd542db0e2accb9ff334c9189
SHA1 713260984c002819d10b11e63b6bf28873641950
SHA512 970793042d19130b2742ec2afd8543321f096be72f1eeecb666fe716ae15d0aaade7e28102a1bca7e6beefd0f8fafbcbf1cd564be293be9205b04c80cb072c00
SSDEEP 3072:94uOsKcdFdzR/9sA+cqRf8qWy6/dbgZyvhid/8VrOgGet6P0s4iNx:9ocFdzR/9sAqWyQeyvA/89OAt1s
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement MoveFileExW OpenJobObjectA SetDefaultCommConfigW CreateDirectoryW FreeEnvironmentStringsA GetTickCount GetConsoleAliasesLengthA TzSpecificLocalTimeToSystemTime GetSystemTimes WideCharToMultiByte LoadLibraryW GetLocaleInfoW CompareStringW GetStartupInfoW WritePrivateProfileStringW FlushFileBuffers GetConsoleAliasesW EndUpdateResourceW SetLastError GetProcAddress GetProcessHeaps CreateNamedPipeA EnumDateFormatsExA ResetEvent OpenWaitableTimerA LoadLibraryA GetProcessWorkingSetSize LocalAlloc DnsHostnameToComputerNameA FreeEnvironmentStringsW GetCurrentDirectoryA FileTimeToLocalFileTime GetVolumeInformationW IsValidLocale EnumSystemLocalesA GetLocaleInfoA HeapAlloc SetCurrentDirectoryA GetModuleHandleExA EncodePointer DecodePointer GetCommandLineA HeapSetInformation TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW HeapCreate HeapDestroy Sleep HeapSize EnterCriticalSection LeaveCriticalSection GetModuleFileNameA GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId GetLastError InterlockedDecrement GetCurrentThread QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FatalAppExitA SetConsoleCtrlHandler FreeLibrary InterlockedExchange HeapReAlloc RtlUnwind HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode LCMapStringW MultiByteToWideChar GetStringTypeW SetFilePointer IsProcessorFeaturePresent CloseHandle WriteConsoleW SetStdHandle CreateFileW GetUserDefaultLCID RaiseException

user32

DestroyIcon GetClassLongW

advapi32

ReadEventLogA GetServiceKeyNameA

Name

.text

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vuk

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ruxane

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1f973adbd542db0e2accb9ff334c9189.exe

kernel32

user32

advapi32

generic