7ff8c26a36f5a4566990745dff1594f3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
7ff8c26a36f5a4566990745dff1594f3.exe
Size 1.8MB
Sample240524-lfbwvace41
SHA256 fc44a0e8161907e73f2e7f0ee5b264a8e2c78f5af3437c4cb25341661da8d813
MD5 7ff8c26a36f5a4566990745dff1594f3
SHA1 5d73bbd168fb9b1e43051340a415d95f28c40f4d
SHA512 d97be45d80e85722e74b44aeff834b2ccc219520c7d1632452c4a361b9dea59439f0f0ba27af6444132147c7bc30ccd5582bb0a0e246baf00f61e16195706b2d
SSDEEP 24576:jynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52eOXuq01dKqOF7:ujN3CdJ81nEQhs30eWuqsrOF7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

7ff8c26a36f5a4566990745dff1594f3.exe

.exe 1.8MB

7ff8c26a36f5a4566990745dff1594f3.exe

IMPHASH 79856d4b034c49dc3dd3e403b25b6bbf
SHA256 fc44a0e8161907e73f2e7f0ee5b264a8e2c78f5af3437c4cb25341661da8d813
MD5 7ff8c26a36f5a4566990745dff1594f3
SHA1 5d73bbd168fb9b1e43051340a415d95f28c40f4d
SHA512 d97be45d80e85722e74b44aeff834b2ccc219520c7d1632452c4a361b9dea59439f0f0ba27af6444132147c7bc30ccd5582bb0a0e246baf00f61e16195706b2d
SSDEEP 24576:jynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52eOXuq01dKqOF7:ujN3CdJ81nEQhs30eWuqsrOF7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

ce:5d:3f:8a:d8:89:1d:bd:4a:45:57:b9:a9:f5:15:c0:02:08:dc:95:fa:7e:03:84:2a:d2:97:bd:c3:54:b3:eb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 23, 2024

Minor OS version

Major OS version

Entry point

429404

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegSetValueExA GetTokenInformation DuplicateTokenEx OpenThreadToken RevertToSelf ImpersonateLoggedOnUser CheckTokenMembership EventWrite EventRegister EventEnabled

bcrypt

BCryptGenRandom BCryptEncrypt BCryptDecrypt BCryptImportKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptDestroyKey

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader CloseThreadpoolIo GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentProcess GetCurrentThread Sleep InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter WaitForMultipleObjectsEx GetLastError QueryPerformanceFrequency SetLastError GetFullPathNameW GetLongPathNameW MultiByteToWideChar WideCharToMultiByte LocalAlloc GetConsoleOutputCP GetProcAddress RaiseFailFastException CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CopyFileExW CreateFileW DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW LoadLibraryExW ReadFile SetFileInformationByHandle SetThreadErrorMode GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile GetCurrentProcessorNumberEx CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW DuplicateHandle GetThreadPriority SetThreadPriority GetConsoleMode WriteConsoleW GetExitCodeProcess TerminateProcess OpenProcess K32EnumProcesses GetProcessId CreateProcessA GetConsoleWindow FreeConsole AllocConsole VirtualAllocEx ResumeThread CreateProcessW GetThreadContext SetThreadContext FlushProcessWriteBuffers GetCurrentThreadId WaitForSingleObjectEx VirtualQuery RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread SuspendThread FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetCurrentProcessId

ole32

CoUninitialize CoTaskMemAlloc CoGetApartmentType CoCreateGuid CoTaskMemFree CoWaitForMultipleHandles CoInitializeEx

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

pow modf ceil __setusermatherr

api-ms-win-crt-heap-l1-1-0

calloc malloc _callnewh _set_new_mode free

api-ms-win-crt-string-l1-1-0

wcsncmp strncpy_s _stricmp strcpy_s strcmp _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback _get_initial_wide_environment _cexit __p___wargv __p___argc _exit exit _initterm_e _initterm terminate _crt_atexit _initialize_wide_environment _configure_wide_argv _register_onexit_function _initialize_onexit_table _set_app_type _seh_filter_exe abort

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vfprintf __acrt_iob_func _set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

455KB

Virtual Size

454KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

740KB

Virtual Size

740KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

497KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7ff8c26a36f5a4566990745dff1594f3.exe

PE Signature issue

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic