2f48e39c1fa623b569c7580066026dc25e629fcd4a9cdb8a58d22e45c9eb99c2[.]exe

General

Target
2f48e39c1fa623b569c7580066026dc25e629fcd4a9cdb8a58d22e45c9eb99c2.exe
Size 762KB
Sample240425-blff4scg6x
SHA256 2f48e39c1fa623b569c7580066026dc25e629fcd4a9cdb8a58d22e45c9eb99c2
MD5 03cea6f6022a3a08d1ea003091a3e502
SHA1 643e34573258d1511921c8d97a5b3c26d6c70b62
SHA512 560ec4d84a74b9089d12a6e00b02acb8fa1364f75172a2fd0916c030350ff9fe32ea137a3fdd8df3648870c82935131fdee9de6d00066d97f9d073cf85648e42
SSDEEP 12288:e2ZPFVL/YNfMNwpo4id34UcFg522Af3mhQIDBYHJD9wICzXXRXGoKU:e2tcMNqo3/c+52TvsQ0CjCdKU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f48e39c1fa623b569c7580066026dc25e629fcd4a9cdb8a58d22e45c9eb99c2.exe

File Explorer

2f48e39c1fa623b569c7580066026dc25e629fcd4a9cdb8a58d22e45c9eb99c2.exe

.exe 762KB

2f48e39c1fa623b569c7580066026dc25e629fcd4a9cdb8a58d22e45c9eb99c2.exe

IMPHASH 0c221599ea7b9c4f042cfb23a69ed3b1
SHA256 2f48e39c1fa623b569c7580066026dc25e629fcd4a9cdb8a58d22e45c9eb99c2
MD5 03cea6f6022a3a08d1ea003091a3e502
SHA1 643e34573258d1511921c8d97a5b3c26d6c70b62
SHA512 560ec4d84a74b9089d12a6e00b02acb8fa1364f75172a2fd0916c030350ff9fe32ea137a3fdd8df3648870c82935131fdee9de6d00066d97f9d073cf85648e42
SSDEEP 12288:e2ZPFVL/YNfMNwpo4id34UcFg522Af3mhQIDBYHJD9wICzXXRXGoKU:e2tcMNqo3/c+52TvsQ0CjCdKU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16207

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xinasu.pdb

kernel32

LocalCompact GetComputerNameW CreateHardLinkA BackupSeek GetTickCount GetConsoleAliasesA EnumTimeFormatsA GetUserDefaultLangID SetCommState LoadLibraryW GetLocaleInfoW ReadConsoleInputA WriteConsoleW MultiByteToWideChar GetTempPathW InterlockedExchange GetLastError ChangeTimerQueueTimer SetLastError FindResourceExW GetProcAddress SetFileAttributesA BuildCommDCBW LoadLibraryA LocalAlloc GetExitCodeThread AddAtomW RemoveDirectoryW GlobalFindAtomW GetModuleFileNameA GetOEMCP GlobalUnWire LoadLibraryExA SetCalendarInfoA GetWindowsDirectoryW GetConsoleProcessList GetVolumeInformationW GetThreadLocale GetSystemDefaultLangID GetStringTypeW OutputDebugStringW EncodePointer DecodePointer IsProcessorFeaturePresent GetCommandLineA RaiseException RtlUnwind IsDebuggerPresent HeapFree HeapAlloc ExitProcess GetModuleHandleExW WideCharToMultiByte HeapSize EnterCriticalSection LeaveCriticalSection GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW CloseHandle GetCurrentThreadId GetProcessHeap WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW IsValidCodePage GetACP GetCPInfo HeapReAlloc LCMapStringW GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle FlushFileBuffers CreateFileW

advapi32

DeregisterEventSource

winhttp

WinHttpOpen

Sharing