148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe
Size 2.7MB
Sample240606-bf16maeb88
SHA256 148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f
MD5 95626a1bca4871e5d3fd14604d688c71
SHA1 e0e3eb52e2850d9643d1342871b8baf9d5f822e0
SHA512 c8e3a4a8bda0bf9c04636360090a05498f6b8c3e6702deca16e05f0ca2e7bf8775e23fe5c6c069f9dadfa30078686f7324649708fdf5117b9c5755c5a8dca589
SSDEEP 49152:pREWXUCXkRX9i5dNgz42P1jxWRf29KbYZl4bZQF:gWvCscWN29mYZabk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe

File Explorer

148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe

.exe 2.7MB

148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe

IMPHASH f4a9a18f49d76f0290ffa59c41c97f90
SHA256 148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f
MD5 95626a1bca4871e5d3fd14604d688c71
SHA1 e0e3eb52e2850d9643d1342871b8baf9d5f822e0
SHA512 c8e3a4a8bda0bf9c04636360090a05498f6b8c3e6702deca16e05f0ca2e7bf8775e23fe5c6c069f9dadfa30078686f7324649708fdf5117b9c5755c5a8dca589
SSDEEP 49152:pREWXUCXkRX9i5dNgz42P1jxWRf29KbYZl4bZQF:gWvCscWN29mYZabk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

431108

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExA RegSetValueExW OpenProcessToken GetTokenInformation DuplicateTokenEx OpenThreadToken RevertToSelf ImpersonateLoggedOnUser CheckTokenMembership EventWrite EventRegister EventEnabled AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom BCryptEncrypt BCryptImportKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptDecrypt

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader CloseThreadpoolIo MultiByteToWideChar GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentProcess GetCurrentThread Sleep DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx GetLastError QueryPerformanceFrequency SetLastError GetFullPathNameW GetLongPathNameW WideCharToMultiByte GetCPInfo LocalAlloc GetConsoleOutputCP GetProcAddress RaiseFailFastException CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CopyFileExW CreateDirectoryW CreateFileW DeleteFileW DeleteVolumeMountPointW CreateSymbolicLinkW DeviceIoControl ExpandEnvironmentStringsW FindNextFileW FindClose FindFirstFileExW FreeLibrary GetFileAttributesExW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetLogicalDrives GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW GetVolumeInformationW LoadLibraryExW MoveFileExW ReadFile RemoveDirectoryW ReplaceFileW SetFileAttributesW SetFileInformationByHandle SetThreadErrorMode GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile GetCurrentProcessorNumberEx CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW DuplicateHandle GetThreadPriority SetThreadPriority CreateProcessA GetConsoleWindow LoadLibraryA FreeConsole AllocConsole ResumeThread GetCurrentProcessId GetConsoleMode WriteConsoleW FlushProcessWriteBuffers GetCurrentThreadId WaitForSingleObjectEx VirtualQuery RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread CreateThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead

ole32

CoUninitialize CoTaskMemAlloc CoGetApartmentType CoCreateGuid CoTaskMemFree CoWaitForMultipleHandles CoInitializeEx

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

cos floor pow sin __setusermatherr ceil tan modf

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc calloc _callnewh

api-ms-win-crt-string-l1-1-0

wcsncmp strncpy_s _stricmp strcpy_s strcmp _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_get_initial_wide_environment _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv __p___argc _exit exit _initterm_e _initterm terminate _crt_atexit _initialize_wide_environment _register_onexit_function _initialize_onexit_table abort _configure_wide_argv _set_app_type _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vsscanf __stdio_common_vfprintf __p__commode _set_fmode __stdio_common_vsprintf_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

458KB

Virtual Size

457KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

948KB

Virtual Size

947KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

730KB

Virtual Size

729KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

485KB

Virtual Size

485KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

148dcf776ff05612d19143826d1fc89ece4ec0c7297d6b46237f6136fdfdf91f.exe

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic