9eeff9d34d3c5144dddf9cb876eb3121881399a04217a9b71c0d0ebc0703dccf

Sharing

Copy URL Twitter E-mail

General

Target
9eeff9d34d3c5144dddf9cb876eb3121881399a04217a9b71c0d0ebc0703dccf
Size 337KB
Sample240320-mxt97aff4v
SHA256 9eeff9d34d3c5144dddf9cb876eb3121881399a04217a9b71c0d0ebc0703dccf
MD5 3cba4fcf73bdda143d7e9b9bf894a379
SHA1 132eab0a8c1a571c605e4642a6d1303242a6979c
SHA512 b0d63586463afd1e83d4007c4f9c0083411c8c663179ed9dbe8253b11f2228877567eb46f8a7683b8341c4d50fcfffa9c58a24982527480177b349fa7194c0cb
SSDEEP 6144:f0UEeLo+tRGwFfdhi/G45TDjwCZpwCc4O9dbh:ceLo+tRnFfz941ECTwCcNh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9eeff9d34d3c5144dddf9cb876eb3121881399a04217a9b71c0d0ebc0703dccf

File Explorer

9eeff9d34d3c5144dddf9cb876eb3121881399a04217a9b71c0d0ebc0703dccf

.exe 337KB

9eeff9d34d3c5144dddf9cb876eb3121881399a04217a9b71c0d0ebc0703dccf

IMPHASH 37dab67974f355f99aed8d0f398c9d70
SHA256 9eeff9d34d3c5144dddf9cb876eb3121881399a04217a9b71c0d0ebc0703dccf
MD5 3cba4fcf73bdda143d7e9b9bf894a379
SHA1 132eab0a8c1a571c605e4642a6d1303242a6979c
SHA512 b0d63586463afd1e83d4007c4f9c0083411c8c663179ed9dbe8253b11f2228877567eb46f8a7683b8341c4d50fcfffa9c58a24982527480177b349fa7194c0cb
SSDEEP 6144:f0UEeLo+tRGwFfdhi/G45TDjwCZpwCc4O9dbh:ceLo+tRnFfz941ECTwCcNh
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

112472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetEvent GetDiskFreeSpaceExW GetCurrentThread TerminateThread LoadLibraryA GetNativeSystemInfo CreateThread SetVolumeMountPointW GetProcAddress SetFilePointerEx DeleteCriticalSection ExitProcess GetCurrentProcessId GetModuleHandleW CopyFileW WideCharToMultiByte GetVolumePathNamesForVolumeNameW lstrcpyW SleepEx GetDiskFreeSpaceExA CreateEventA FindNextVolumeW lstrcmpiW CreateIoCompletionPort GetTickCount lstrcmpW MoveFileW GetDriveTypeW GetComputerNameA TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32NextW QueryDosDeviceW GetFinalPathNameByHandleW Sleep DuplicateHandle CreateEventW GetWindowsDirectoryW FindVolumeClose GetFileType GetTickCount64 lstrcatW GetSystemTimeAsFileTime GetSystemInfo GlobalMemoryStatusEx WriteConsoleW SetEndOfFile ReadConsoleW HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers MultiByteToWideChar SetFileAttributesW PostQueuedCompletionStatus GetLocaleInfoA GetModuleHandleA GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject FindClose lstrlenA GetQueuedCompletionStatus SetErrorMode InitializeCriticalSection LeaveCriticalSection WaitForMultipleObjects GetModuleFileNameW GetUserDefaultLangID WriteFile FindNextFileW GetCommandLineW EnterCriticalSection FindFirstVolumeW FindFirstFileExW lstrlenW GetFileSizeEx GetLogicalDrives ReadFile LocalFree CloseHandle GetLastError GetCurrentProcess SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW QueryPerformanceCounter K32GetModuleFileNameExW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree HeapReAlloc GetStdHandle GetModuleHandleExW LoadLibraryExW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW InitializeSListHead GetStringTypeW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary

user32

CreateWindowExW GetCursorPos MessageBoxW DefWindowProcW RegisterClassW

advapi32

QueryServiceStatusEx OpenProcessToken SetNamedSecurityInfoW ControlService EnumDependentServicesW QueryServiceConfigW ChangeServiceConfigW OpenServiceW EnumServicesStatusW CreateServiceW RegCloseKey CryptAcquireContextW CloseServiceHandle RegQueryValueExA CryptGenRandom OpenSCManagerW RegSetValueExW StartServiceW RegOpenKeyExA RegOpenKeyExW OpenThreadToken CryptReleaseContext GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid SetEntriesInAclW FreeSid

shell32

CommandLineToArgvW ShellExecuteW

netapi32

NetShareEnum NetApiBufferFree

shlwapi

wnsprintfA StrCmpNIW StrCmpNW StrStrIW PathFileExistsW SHDeleteKeyW UrlUnescapeA UrlEscapeA wnsprintfW

iphlpapi

GetIpNetTable

ws2_32

inet_ntoa

wininet

InternetQueryDataAvailable InternetCloseHandle InternetConnectW InternetSetOptionW InternetCrackUrlW InternetOpenW InternetQueryOptionW HttpOpenRequestW InternetReadFile HttpSendRequestW

Sharing

General

Malware Config

Signatures

File Explorer

9eeff9d34d3c5144dddf9cb876eb3121881399a04217a9b71c0d0ebc0703dccf

kernel32

user32

advapi32

shell32

netapi32

shlwapi

iphlpapi

ws2_32

wininet

generic