0aeddd756cf2991b1dcb283318dc895e81b5a54cfa560fef6234936a8f2dbd55[.]exe

General

Target
0aeddd756cf2991b1dcb283318dc895e81b5a54cfa560fef6234936a8f2dbd55.exe
Size 809KB
Sample240529-bfvnvach22
SHA256 0aeddd756cf2991b1dcb283318dc895e81b5a54cfa560fef6234936a8f2dbd55
MD5 632ff32f4f76ac146e8961917ec20ee7
SHA1 3134b75f6a13e37e5ac5534797a6240f4a45e538
SHA512 fd064f9e5da6dd76ad2e6968bc09ad9fab13b8fb6d3561cbf48fbdd9a453f8796c5030a11fb5e2ba489472b1b55aec98c8b18b44c617d07b5c0235ba9468317d
SSDEEP 12288:XpXntUO8LynCbrF4Bv3mnNNLQOvZc9koUTiTi1BwMONp6qju09z/05F3:3UjLyC/cv3mnxvw7UEi1Bop6qC5F
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0aeddd756cf2991b1dcb283318dc895e81b5a54cfa560fef6234936a8f2dbd55.exe

File Explorer

0aeddd756cf2991b1dcb283318dc895e81b5a54cfa560fef6234936a8f2dbd55.exe

.exe 809KB

0aeddd756cf2991b1dcb283318dc895e81b5a54cfa560fef6234936a8f2dbd55.exe

IMPHASH 5a21299c9e523d932e96c629a301a84f
SHA256 0aeddd756cf2991b1dcb283318dc895e81b5a54cfa560fef6234936a8f2dbd55
MD5 632ff32f4f76ac146e8961917ec20ee7
SHA1 3134b75f6a13e37e5ac5534797a6240f4a45e538
SHA512 fd064f9e5da6dd76ad2e6968bc09ad9fab13b8fb6d3561cbf48fbdd9a453f8796c5030a11fb5e2ba489472b1b55aec98c8b18b44c617d07b5c0235ba9468317d
SSDEEP 12288:XpXntUO8LynCbrF4Bv3mnNNLQOvZc9koUTiTi1BwMONp6qju09z/05F3:3UjLyC/cv3mnxvw7UEi1Bop6qC5F
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16807

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\rofi\lemehaxocecum\rilo.pdb

kernel32

InterlockedIncrement SetConsoleTextAttribute ReadConsoleA GetCurrentProcess CreateDirectoryW GetFileAttributesExA GetTickCount GetCommConfig GetConsoleAliasesLengthA GetWindowsDirectoryA GlobalAlloc GetVolumeInformationA GetFirmwareEnvironmentVariableA TerminateThread GetLocaleInfoW GetSystemPowerStatus GetConsoleAliasExesLengthW GetVersionExW FindNextVolumeW GetConsoleAliasW GetModuleFileNameW CreateFileW FindResourceA GetLastError GetCurrentDirectoryW GetProcAddress PeekConsoleInputW RemoveDirectoryA LoadLibraryA WriteConsoleA FindFirstVolumeMountPointW GetNumberFormatW QueryDosDeviceW GlobalFindAtomW VirtualProtect _lopen GetCurrentProcessId ResetWriteWatch AreFileApisANSI OutputDebugStringW HeapReAlloc WriteConsoleW SetStdHandle LCMapStringW GetHandleInformation GetEnvironmentVariableW MultiByteToWideChar EncodePointer DecodePointer ReadFile ExitProcess GetModuleHandleExW WideCharToMultiByte GetCommandLineA RaiseException RtlUnwind IsProcessorFeaturePresent IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError GetCurrentThreadId EnterCriticalSection LeaveCriticalSection FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode DeleteCriticalSection HeapSize HeapFree IsDebuggerPresent SetFilePointerEx GetStdHandle GetFileType GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW HeapAlloc GetProcessHeap GetModuleFileNameA QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW CloseHandle

user32

CharUpperBuffW ChangeMenuA CharLowerBuffA DrawAnimatedRects

advapi32

ReadEventLogA

Sharing