052f4b87994b5aee20f9d69ef631c9648f6b90524575be78cba9a0bd17228050[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
052f4b87994b5aee20f9d69ef631c9648f6b90524575be78cba9a0bd17228050.exe
Size 467KB
Sample240501-bdb4qadh48
SHA256 052f4b87994b5aee20f9d69ef631c9648f6b90524575be78cba9a0bd17228050
MD5 775af421a2e7cc4d2cdb81142168f9c8
SHA1 502514f61d9411039839d35f2888dce15ced2962
SHA512 d592d66b15551040c332bf6d359cf591940c36b0c4ed3e83171bdc228e3f66364ee06e7e92e706977d29299200eb4d36db83616edec3853f300aaf02dc2dade3
SSDEEP 12288:kx2+JCy0qUNFqoAmy0MumPyX1PEtFw8IK/X0JRmvrm:kx2H7JdaumKXTIOQj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
052f4b87994b5aee20f9d69ef631c9648f6b90524575be78cba9a0bd17228050.exe

File Explorer

052f4b87994b5aee20f9d69ef631c9648f6b90524575be78cba9a0bd17228050.exe

.exe 467KB

052f4b87994b5aee20f9d69ef631c9648f6b90524575be78cba9a0bd17228050.exe

IMPHASH 2c1368ad24b4b6fe959b8613f7b6e0fb
SHA256 052f4b87994b5aee20f9d69ef631c9648f6b90524575be78cba9a0bd17228050
MD5 775af421a2e7cc4d2cdb81142168f9c8
SHA1 502514f61d9411039839d35f2888dce15ced2962
SHA512 d592d66b15551040c332bf6d359cf591940c36b0c4ed3e83171bdc228e3f66364ee06e7e92e706977d29299200eb4d36db83616edec3853f300aaf02dc2dade3
SSDEEP 12288:kx2+JCy0qUNFqoAmy0MumPyX1PEtFw8IK/X0JRmvrm:kx2H7JdaumKXTIOQj
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

GetClipBox bMakePathNameW D3DKMTQueryRemoteVidPnSourceFromGdiDisplayName EngPlgBlt

kernel32

VirtualProtect WaitForSingleObject CreateRemoteThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess TerminateProcess CreateFileW RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW

msvcrt

_waccess_s _ismbclower modf ??_Gbad_typeid@@UAEPAXI@Z _cwscanf

advapi32

BaseRegUnLoadKey GetSidLengthRequired InitiateSystemShutdownW EventWriteStartScenario CryptGetDefaultProviderW ProcessTrace RegSetValueA

user32

LockWindowStation SetFeatureReportResponse InheritWindowMonitor DeferWindowPos GetShellChangeNotifyWindow GetMonitorInfoW

Name

.text

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Right

Size

305KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

052f4b87994b5aee20f9d69ef631c9648f6b90524575be78cba9a0bd17228050.exe

gdi32

kernel32

msvcrt

advapi32

user32

generic