d1b4b083e0ea20a087018bde31c37a75[.]exe

General

Target
d1b4b083e0ea20a087018bde31c37a75.exe
Size 234KB
Sample240208-e2h4qabb4w
SHA256 a578ab8f490d32d4ec916f02ce6ed22ef4572bf21db481dcce5b1b2ccf228d92
MD5 d1b4b083e0ea20a087018bde31c37a75
SHA1 fe5a597a8a0dcf26204e99ef8f7abf2c9359e47f
SHA512 30d41aa90f517119ac77ac0cc9fc86d6f17ccde315dfd05cdbbc7b27e38039a3c2772583c8cf206c21f5a92980cbf1a64f759b364529f88cbdaaa4d85350eb6d
SSDEEP 3072:TxNWLlW4AF8ju87wabOCgCebjiRfo9Nb/ccu57+WC8Xdt5vS5WvtDm:jWLlq8T0cebjiRgvO7LFS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1b4b083e0ea20a087018bde31c37a75.exe

File Explorer

d1b4b083e0ea20a087018bde31c37a75.exe

.exe 234KB

d1b4b083e0ea20a087018bde31c37a75.exe

IMPHASH e268ec620c18bdda69b0c5cd425393f7
SHA256 a578ab8f490d32d4ec916f02ce6ed22ef4572bf21db481dcce5b1b2ccf228d92
MD5 d1b4b083e0ea20a087018bde31c37a75
SHA1 fe5a597a8a0dcf26204e99ef8f7abf2c9359e47f
SHA512 30d41aa90f517119ac77ac0cc9fc86d6f17ccde315dfd05cdbbc7b27e38039a3c2772583c8cf206c21f5a92980cbf1a64f759b364529f88cbdaaa4d85350eb6d
SSDEEP 3072:TxNWLlW4AF8ju87wabOCgCebjiRfo9Nb/ccu57+WC8Xdt5vS5WvtDm:jWLlq8T0cebjiRgvO7LFS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\cebodemoxo-lokopiwixapi\faxoc80\celagicilot52\tayiti.pdb

kernel32

GetComputerNameW GetFileAttributesExA GetTickCount FindNextVolumeMountPointA GetUserDefaultLangID AssignProcessToJobObject GetSystemPowerStatus VerifyVersionInfoA GetModuleFileNameW InterlockedExchange GetLogicalDriveStringsA GetLastError GetProcAddress VirtualAlloc SetVolumeLabelW MoveFileW LoadLibraryA AddConsoleAliasW LocalAlloc GetNumberFormatW RemoveDirectoryW QueryDosDeviceW GlobalFindAtomW EnumResourceTypesW CreateWaitableTimerW GetConsoleTitleW VirtualProtect CompareStringA DeleteFileW GetCurrentProcessId GetFileInformationByHandle UnregisterWaitEx GetVolumeInformationW CreateFileA WriteConsoleA SetComputerNameW SetStdHandle WriteConsoleW GetModuleHandleW Sleep ExitProcess GetStartupInfoW GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree WriteFile GetModuleFileNameA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetModuleHandleA RaiseException RtlUnwind HeapAlloc HeapReAlloc HeapSize GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle GetConsoleOutputCP

user32

SetMenu

gdi32

GetCharABCWidthsFloatW

winhttp

WinHttpReadData

Sharing