fb96a7c3db4bd949e4c91e06655afa36f138666f4d6ea7b778c55bdf9df5a6e8

Sharing

Copy URL Twitter E-mail

General

Target
fb96a7c3db4bd949e4c91e06655afa36f138666f4d6ea7b778c55bdf9df5a6e8
Size 585KB
Sample240613-mnjgbsverf
SHA256 fb96a7c3db4bd949e4c91e06655afa36f138666f4d6ea7b778c55bdf9df5a6e8
MD5 6064f20356e89704f08165b6a5235d84
SHA1 c97a041323913409516ee1026128dd563bfbc69f
SHA512 b90fe415b26968f94dcf969d08133426d0ff91456ed42492a3757f995116c24ba50ff48ace3563fb501b4e7e58240dbeab492e0561ac350eef299b7f0338520c
SSDEEP 12288:wU/9bMnjCir6JZHmmYmX9LDjDbNj1rAVLfptAR6DfNRQa4gz99e995sslss3sns+:VZRZDjnNj1mLTA+1+5sslss3snsx1msO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb96a7c3db4bd949e4c91e06655afa36f138666f4d6ea7b778c55bdf9df5a6e8

File Explorer

fb96a7c3db4bd949e4c91e06655afa36f138666f4d6ea7b778c55bdf9df5a6e8

.exe 585KB

fb96a7c3db4bd949e4c91e06655afa36f138666f4d6ea7b778c55bdf9df5a6e8

IMPHASH 929aeb4e95bed1b730dfa35676ec64e8
SHA256 fb96a7c3db4bd949e4c91e06655afa36f138666f4d6ea7b778c55bdf9df5a6e8
MD5 6064f20356e89704f08165b6a5235d84
SHA1 c97a041323913409516ee1026128dd563bfbc69f
SHA512 b90fe415b26968f94dcf969d08133426d0ff91456ed42492a3757f995116c24ba50ff48ace3563fb501b4e7e58240dbeab492e0561ac350eef299b7f0338520c
SSDEEP 12288:wU/9bMnjCir6JZHmmYmX9LDjDbNj1rAVLfptAR6DfNRQa4gz99e995sslss3sns+:VZRZDjnNj1mLTA+1+5sslss3snsx1msO
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

244722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\KMRCM5.5\Bin\KMWATCH.pdb

kernel32

EnterCriticalSection GetPrivateProfileStringA GetLocalTime Process32FirstW ProcessIdToSessionId WritePrivateProfileStringA GetSystemInfo GetModuleFileNameA GetLastError WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA ExitProcess CreateMutexW GetCurrentProcessId GetModuleFileNameW TerminateProcess LeaveCriticalSection GetVersionExW Sleep OpenProcess InitializeCriticalSection GetTickCount LocalFileTimeToFileTime CloseHandle GetCurrentDirectoryW MultiByteToWideChar CreateFileW ReadFile GetFileAttributesW WideCharToMultiByte WriteFile SetFileTime CreateDirectoryW SystemTimeToFileTime Process32NextW SetEndOfFile GetFullPathNameW SetEnvironmentVariableA GetTimeZoneInformation WriteConsoleW LCMapStringW CompareStringW GetStringTypeW OutputDebugStringW SystemTimeToTzSpecificLocalTime GetDriveTypeW FindFirstFileExW FindClose FlushFileBuffers SetStdHandle ReadConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetConsoleMode GetConsoleCP RtlUnwind HeapSize RaiseException GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentProcess InitializeCriticalSectionAndSpinCount SetFilePointer SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetOEMCP GetACP IsValidCodePage AreFileApisANSI GetModuleHandleExW SetLastError SleepEx VerifyVersionInfoA VerSetConditionMask WaitForSingleObject FormatMessageA PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle FreeLibrary GetProcAddress LoadLibraryA ExpandEnvironmentStringsA HeapFree HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent EncodePointer DecodePointer GetCommandLineA HeapReAlloc GetSystemTimeAsFileTime CreateThread GetCurrentThreadId ExitThread LoadLibraryExW FileTimeToLocalFileTime GetFileInformationByHandle FileTimeToSystemTime SetFilePointerEx GetProcessHeap

user32

wsprintfW MessageBoxW

advapi32

CryptCreateHash CryptEncrypt CryptReleaseContext CryptImportKey CryptAcquireContextA RegisterServiceCtrlHandlerW SetServiceStatus QueryServiceStatus StartServiceW ChangeServiceConfig2W OpenServiceW StartServiceCtrlDispatcherW OpenSCManagerW CloseServiceHandle CreateServiceW OpenProcessToken CreateProcessAsUserA CryptDestroyHash CryptGetHashParam CryptHashData CryptDestroyKey

shell32

SHFileOperationA SHCreateDirectoryExA

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken WTSQuerySessionInformationA

ws2_32

getaddrinfo freeaddrinfo sendto socket closesocket getpeername getsockopt htons bind ntohs getsockname setsockopt WSAIoctl send recv select WSAGetLastError __WSAFDIsSet WSASetLastError WSAStartup WSACleanup gethostname ioctlsocket listen accept recvfrom connect

wldap32

ord30 ord200 ord211 ord35 ord26 ord33 ord301 ord27 ord41 ord46 ord50 ord79 ord60 ord22 ord32 ord143

shlwapi

PathFileExistsA StrStrIW PathFileExistsW PathAppendA PathAppendW

Sharing

General

Malware Config

Signatures

File Explorer

fb96a7c3db4bd949e4c91e06655afa36f138666f4d6ea7b778c55bdf9df5a6e8

kernel32

user32

advapi32

shell32

wtsapi32

ws2_32

wldap32

shlwapi

generic