6413bc29d9283235785333b926cc8ab9066ca41fef4d35c051922d4cb0cb8382

General

Target
6413bc29d9283235785333b926cc8ab9066ca41fef4d35c051922d4cb0cb8382
Size 308KB
Sample240428-m9rd3aee4v
SHA256 6413bc29d9283235785333b926cc8ab9066ca41fef4d35c051922d4cb0cb8382
MD5 e5e811848cc1171eb787dd205469492a
SHA1 cc78d712fc1d9add90239e2401b524db853ad7cd
SHA512 f23e7947f2785d5d9540f75b69995a767d785501c79e84d7f74bc167cb9be044c475f1fb6dd22913888105cb5975440b724b22bb5d94bb569ed1ae48a0477612
SSDEEP 6144:BYAtS/qyYW22cZrag3QaSjUCnrEUAF0YON:BYAQqyDZcZrag3Hoy8N
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6413bc29d9283235785333b926cc8ab9066ca41fef4d35c051922d4cb0cb8382

File Explorer

6413bc29d9283235785333b926cc8ab9066ca41fef4d35c051922d4cb0cb8382

.exe 308KB

6413bc29d9283235785333b926cc8ab9066ca41fef4d35c051922d4cb0cb8382

IMPHASH 34576bf4e58e15eb1f3c9fdbb2158318
SHA256 6413bc29d9283235785333b926cc8ab9066ca41fef4d35c051922d4cb0cb8382
MD5 e5e811848cc1171eb787dd205469492a
SHA1 cc78d712fc1d9add90239e2401b524db853ad7cd
SHA512 f23e7947f2785d5d9540f75b69995a767d785501c79e84d7f74bc167cb9be044c475f1fb6dd22913888105cb5975440b724b22bb5d94bb569ed1ae48a0477612
SSDEEP 6144:BYAtS/qyYW22cZrag3QaSjUCnrEUAF0YON:BYAQqyDZcZrag3Hoy8N
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16859

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\hezaxexabarex_poyinubivi-xuneca_goyewen.pdb

kernel32

GetSystemDefaultLangID GlobalMemoryStatus FindResourceA GetLocaleInfoA LoadLibraryExW InterlockedDecrement GetComputerNameW GetSystemDefaultLCID BackupSeek GetConsoleAliasesA GetWindowsDirectoryA EnumTimeFormatsW SetCommState GlobalAlloc GetVolumeInformationA LoadLibraryW LocalShrink TerminateThread ReadConsoleInputA WriteConsoleW GetModuleFileNameW GetACP MultiByteToWideChar GetLastError ChangeTimerQueueTimer SetLastError GetThreadLocale GetProcAddress RemoveDirectoryA InterlockedExchangeAdd SetCalendarInfoW CreateHardLinkW CreateEventW QueryDosDeviceW AddAtomA GlobalFindAtomW BuildCommDCBA VirtualProtect GetConsoleProcessList GetTempPathA SetFileAttributesW EncodePointer DecodePointer HeapReAlloc ExitProcess GetModuleHandleExW AreFileApisANSI WideCharToMultiByte GetCommandLineA RaiseException RtlUnwind IsProcessorFeaturePresent IsDebuggerPresent HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode DeleteCriticalSection HeapSize GetProcessHeap GetStdHandle GetFileType GetStartupInfoW CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetOEMCP GetCPInfo GetCurrentThreadId GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx LCMapStringW OutputDebugStringW GetStringTypeW CreateFileW SetEndOfFile ReadFile ReadConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

6413bc29d9283235785333b926cc8ab9066ca41fef4d35c051922d4cb0cb8382

kernel32

generic