f4c37292b365c19e6d2feeb6a17c4049[.]exe

General

Target
f4c37292b365c19e6d2feeb6a17c4049.exe
Size 780KB
Sample240424-l43dpsgf7w
SHA256 444cf71032e7c7be2a79255af4fb38bab0333fb0a060ecc3fe91473d26ebce83
MD5 f4c37292b365c19e6d2feeb6a17c4049
SHA1 a7c201719a6c4e58f57baa2a88b110d72f3daefe
SHA512 8436f1f96c2ea3487e1205d2f0dbf8db33fc622a9d863f39402802a8c16bb05897477ba58d57fcb7d7a6bb265c52a25331ac5505dd3ac2c6b3fc2823eb56f805
SSDEEP 12288:6DcWGLixjy0li5QMCgpMeahQ+siBwpBezGbkhvYesVmKiOAfc4Cz9fA1iqCD:6iily4i3CgeSKBtXKiMt9fa8D
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4c37292b365c19e6d2feeb6a17c4049.exe

File Explorer

f4c37292b365c19e6d2feeb6a17c4049.exe

.exe 780KB

f4c37292b365c19e6d2feeb6a17c4049.exe

IMPHASH 0c221599ea7b9c4f042cfb23a69ed3b1
SHA256 444cf71032e7c7be2a79255af4fb38bab0333fb0a060ecc3fe91473d26ebce83
MD5 f4c37292b365c19e6d2feeb6a17c4049
SHA1 a7c201719a6c4e58f57baa2a88b110d72f3daefe
SHA512 8436f1f96c2ea3487e1205d2f0dbf8db33fc622a9d863f39402802a8c16bb05897477ba58d57fcb7d7a6bb265c52a25331ac5505dd3ac2c6b3fc2823eb56f805
SSDEEP 12288:6DcWGLixjy0li5QMCgpMeahQ+siBwpBezGbkhvYesVmKiOAfc4Cz9fA1iqCD:6iily4i3CgeSKBtXKiMt9fa8D
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16207

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\wif lijozilog\lonoderedes.pdb

kernel32

LocalCompact GetComputerNameW CreateHardLinkA BackupSeek GetTickCount GetConsoleAliasesA EnumTimeFormatsA GetUserDefaultLangID SetCommState LoadLibraryW GetLocaleInfoW ReadConsoleInputA WriteConsoleW MultiByteToWideChar GetTempPathW InterlockedExchange GetLastError ChangeTimerQueueTimer SetLastError FindResourceExW GetProcAddress SetFileAttributesA BuildCommDCBW LoadLibraryA LocalAlloc GetExitCodeThread AddAtomW RemoveDirectoryW GlobalFindAtomW GetModuleFileNameA GetOEMCP GlobalUnWire LoadLibraryExA SetCalendarInfoA GetWindowsDirectoryW GetConsoleProcessList GetVolumeInformationW GetThreadLocale GetSystemDefaultLangID GetStringTypeW OutputDebugStringW EncodePointer DecodePointer IsProcessorFeaturePresent GetCommandLineA RaiseException RtlUnwind IsDebuggerPresent HeapFree HeapAlloc ExitProcess GetModuleHandleExW WideCharToMultiByte HeapSize EnterCriticalSection LeaveCriticalSection GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW CloseHandle GetCurrentThreadId GetProcessHeap WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW IsValidCodePage GetACP GetCPInfo HeapReAlloc LCMapStringW GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle FlushFileBuffers CreateFileW

advapi32

DeregisterEventSource

winhttp

WinHttpOpen

Sharing