SecuriteInfo[.]com[.]Win64[.]PWSX-gen[.]29347[.]28297[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe
Size 1.8MB
Sample240523-y698jsfb65
SHA256 803af90de603592cfdca6c9b6a8ffc39130a54dee552f0758f7ebf07ab327fc5
MD5 ce3ad5b4ca386cfb4b47daf322441283
SHA1 85da5dabe5797323057aca3d1a2bb66a4d75ee81
SHA512 feb11585efaa97a51aec5722b002cf6edc686ce45eb211be874056d8b40940eb19d23d4ef761fc65f1b08e09599a7c881b9f3d6c58fead4fde1364df2b8bc9f7
SSDEEP 24576:HynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52FOXuq01dKqOFUC:SjN3CdJ81nEQhs30evuqsrOFUC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe

.exe 1.8MB

SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe

IMPHASH 79856d4b034c49dc3dd3e403b25b6bbf
SHA256 803af90de603592cfdca6c9b6a8ffc39130a54dee552f0758f7ebf07ab327fc5
MD5 ce3ad5b4ca386cfb4b47daf322441283
SHA1 85da5dabe5797323057aca3d1a2bb66a4d75ee81
SHA512 feb11585efaa97a51aec5722b002cf6edc686ce45eb211be874056d8b40940eb19d23d4ef761fc65f1b08e09599a7c881b9f3d6c58fead4fde1364df2b8bc9f7
SSDEEP 24576:HynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52FOXuq01dKqOFUC:SjN3CdJ81nEQhs30evuqsrOFUC
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

b2:e0:12:e4:af:b9:16:04:2d:b7:73:63:05:cb:1e:72:f7:72:a5:67:c1:14:1e:08:f3:db:90:4f:8f:c6:8e:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 23, 2024

Minor OS version

Major OS version

Entry point

429404

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegSetValueExA GetTokenInformation DuplicateTokenEx OpenThreadToken RevertToSelf ImpersonateLoggedOnUser CheckTokenMembership EventWrite EventRegister EventEnabled

bcrypt

BCryptGenRandom BCryptEncrypt BCryptDecrypt BCryptImportKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptDestroyKey

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader CloseThreadpoolIo GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentProcess GetCurrentThread Sleep InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter WaitForMultipleObjectsEx GetLastError QueryPerformanceFrequency SetLastError GetFullPathNameW GetLongPathNameW MultiByteToWideChar WideCharToMultiByte LocalAlloc GetConsoleOutputCP GetProcAddress RaiseFailFastException CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CopyFileExW CreateFileW DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW LoadLibraryExW ReadFile SetFileInformationByHandle SetThreadErrorMode GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile GetCurrentProcessorNumberEx CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW DuplicateHandle GetThreadPriority SetThreadPriority GetConsoleMode WriteConsoleW GetExitCodeProcess TerminateProcess OpenProcess K32EnumProcesses GetProcessId CreateProcessA GetConsoleWindow FreeConsole AllocConsole VirtualAllocEx ResumeThread CreateProcessW GetThreadContext SetThreadContext FlushProcessWriteBuffers GetCurrentThreadId WaitForSingleObjectEx VirtualQuery RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread SuspendThread FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetCurrentProcessId

ole32

CoUninitialize CoTaskMemAlloc CoGetApartmentType CoCreateGuid CoTaskMemFree CoWaitForMultipleHandles CoInitializeEx

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

pow modf ceil __setusermatherr

api-ms-win-crt-heap-l1-1-0

calloc malloc _callnewh _set_new_mode free

api-ms-win-crt-string-l1-1-0

wcsncmp strncpy_s _stricmp strcpy_s strcmp _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback _get_initial_wide_environment _cexit __p___wargv __p___argc _exit exit _initterm_e _initterm terminate _crt_atexit _initialize_wide_environment _configure_wide_argv _register_onexit_function _initialize_onexit_table _set_app_type _seh_filter_exe abort

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vfprintf __acrt_iob_func _set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

455KB

Virtual Size

454KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

740KB

Virtual Size

740KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

497KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe

PE Signature issue

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic