2d4d09f14a17cc7def79ac2a85c9ac4e[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2d4d09f14a17cc7def79ac2a85c9ac4e.exe
Size 4.0MB
Sample240320-bphqmsdg4s
SHA256 bbfd32be787e01f9b2514e32edfae246cf019ca6fb95c85d53a7776174f3becf
MD5 2d4d09f14a17cc7def79ac2a85c9ac4e
SHA1 6c3fa733f28358fb952da97351591c02618faa87
SHA512 89205a0c73517e89f723d1216b845bcb671409ad638453d84e1ea2a7b5250e926d178b52171913f344989be60e686cfe01e1612683922e3b528438ea8078369e
SSDEEP 49152:GPdSGteudmSRhf8svaG8HhYksMlS4vgFk6IIFCifc2EKSz:l1HFsMlUFc+0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d4d09f14a17cc7def79ac2a85c9ac4e.exe

File Explorer

2d4d09f14a17cc7def79ac2a85c9ac4e.exe

.exe 4.0MB

2d4d09f14a17cc7def79ac2a85c9ac4e.exe

IMPHASH 5be0c3fb5455485f86b34acab16fd5ee
SHA256 bbfd32be787e01f9b2514e32edfae246cf019ca6fb95c85d53a7776174f3becf
MD5 2d4d09f14a17cc7def79ac2a85c9ac4e
SHA1 6c3fa733f28358fb952da97351591c02618faa87
SHA512 89205a0c73517e89f723d1216b845bcb671409ad638453d84e1ea2a7b5250e926d178b52171913f344989be60e686cfe01e1612683922e3b528438ea8078369e
SSDEEP 49152:GPdSGteudmSRhf8svaG8HhYksMlS4vgFk6IIFCifc2EKSz:l1HFsMlUFc+0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

435472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegDeleteValueW RegSetValueExW OpenProcessToken GetTokenInformation DuplicateTokenEx OpenThreadToken RevertToSelf ImpersonateLoggedOnUser CheckTokenMembership LookupPrivilegeValueW AdjustTokenPrivileges EventWrite EventRegister EventEnabled

bcrypt

BCryptImportKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptEncrypt BCryptGenRandom BCryptDecrypt

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader CloseThreadpoolIo ExitProcess MultiByteToWideChar GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentProcessorNumber GetCurrentProcess GetCurrentThread WaitForSingleObject Sleep CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable WaitForMultipleObjectsEx GetLastError SetLastError GetFullPathNameW GetLongPathNameW LocalAlloc GetConsoleOutputCP WideCharToMultiByte GetProcAddress RaiseFailFastException CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CreateDirectoryW CreateFileW DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetCurrentDirectoryW GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW LoadLibraryExW ReadFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetThreadErrorMode CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW GetExitCodeProcess CreateProcessW TerminateProcess OpenProcess K32EnumProcesses GetProcessId CreatePipe GetCPInfoExW GetConsoleCP VirtualAllocEx GetThreadContext SetThreadContext WriteProcessMemory VirtualProtect FlushProcessWriteBuffers QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId WaitForSingleObjectEx VirtualQuery RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread SuspendThread FlushInstructionCache VirtualAlloc VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetTickCount GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry InitializeSListHead GetCurrentProcessId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

ole32

CoGetApartmentType CoCreateGuid CoTaskMemFree CoWaitForMultipleHandles CoTaskMemAlloc CoInitializeEx CoUninitialize

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

sin __setusermatherr modf tan ceil cos floor pow

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh calloc _set_new_mode

api-ms-win-crt-string-l1-1-0

strcpy_s strncpy_s _stricmp wcsncmp _wcsicmp strcmp

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _initterm_e _crt_atexit _c_exit _cexit __p___wargv _initterm _get_initial_wide_environment __p___argc terminate _initialize_wide_environment _configure_wide_argv _register_onexit_function _initialize_onexit_table abort _set_app_type _seh_filter_exe _exit exit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsprintf_s __stdio_common_vsscanf __acrt_iob_func _set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

461KB

Virtual Size

461KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

191KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2d4d09f14a17cc7def79ac2a85c9ac4e.exe

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic