8b35f39a86a35d7b875c80efc6ab04d25327255468e8fa71c42ccc5062561bcd[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
8b35f39a86a35d7b875c80efc6ab04d25327255468e8fa71c42ccc5062561bcd.exe
Size 145KB
Sample240524-yphf7she52
SHA256 8b35f39a86a35d7b875c80efc6ab04d25327255468e8fa71c42ccc5062561bcd
MD5 6f9ea7ac8dedf20d3480fa54257daeaf
SHA1 6eb40fea11df2aa830c887805092537ad8063907
SHA512 00c5f8a3e9d00af550f2ab9fc4a5960c93dc6f4ab51667de482e497c2b019095eb7ddee225d7d44e8527b29508897c9c0cc90ffb15a24c617671f1b0be994da3
SSDEEP 3072:kyYIilXVCZV4xqbqP1AjTPsjuHY17UycOo9EdAPioPZrnghGLOrigrcGN2:7zoMVuqePSHsbKOo9EdAPXPZLGGarmG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b35f39a86a35d7b875c80efc6ab04d25327255468e8fa71c42ccc5062561bcd.exe

File Explorer

8b35f39a86a35d7b875c80efc6ab04d25327255468e8fa71c42ccc5062561bcd.exe

.exe 145KB

8b35f39a86a35d7b875c80efc6ab04d25327255468e8fa71c42ccc5062561bcd.exe

IMPHASH fb07d04bdc5b2c60e496d1ee84f41509
SHA256 8b35f39a86a35d7b875c80efc6ab04d25327255468e8fa71c42ccc5062561bcd
MD5 6f9ea7ac8dedf20d3480fa54257daeaf
SHA1 6eb40fea11df2aa830c887805092537ad8063907
SHA512 00c5f8a3e9d00af550f2ab9fc4a5960c93dc6f4ab51667de482e497c2b019095eb7ddee225d7d44e8527b29508897c9c0cc90ffb15a24c617671f1b0be994da3
SSDEEP 3072:kyYIilXVCZV4xqbqP1AjTPsjuHY17UycOo9EdAPioPZrnghGLOrigrcGN2:7zoMVuqePSHsbKOo9EdAPXPZLGGarmG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

75842

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

A:\WindowsProcessManager-master\WindowsProcessManager-master\Release\TaskMgr.pdb

kernel32

Process32NextW Process32FirstW CreateToolhelp32Snapshot VirtualAlloc GetCurrentProcessId GetCurrentThreadId GetTickCount CreateProcessW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoA InterlockedCompareExchange Sleep InterlockedExchange GetSystemTimeAsFileTime TerminateProcess OpenProcess QueryFullProcessImageNameW CloseHandle GetCurrentProcess GetLastError FormatMessageW QueryPerformanceCounter ExitProcess

user32

SendMessageW DefWindowProcW CreateWindowExW wsprintfW GetMessageW UpdateWindow SetTimer RegisterClassExW LoadCursorW LoadIconW TranslateMessage DispatchMessageW PostQuitMessage ShowWindow MessageBoxW SetWindowTextW GetWindowTextW

advapi32

OpenProcessToken AdjustTokenPrivileges LookupAccountSidW GetTokenInformation GetUserNameW LookupPrivilegeValueW

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

comctl32

InitCommonControlsEx

psapi

GetProcessMemoryInfo

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

msvcr90

_invoke_watson _controlfp_s _lock _except_handler4_common _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ __set_app_type __p__fmode __p__commode _adjust_fdiv wcschr ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ __setusermatherr ??3@YAXPAX@Z ??0exception@std@@QAE@XZ __CxxFrameHandler3 wprintf ??_V@YAXPAX@Z wcsncpy _wcsdup memset malloc _invalid_parameter_noinfo _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ??2@YAPAXI@Z _unlock __dllonexit _encode_pointer ??1exception@std@@UAE@XZ _onexit _decode_pointer _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale