df5fe65af1f6f93e6fa38aa46f53d3f6a17942cad637c450a61380d3024504db[.]exe

General

Target
df5fe65af1f6f93e6fa38aa46f53d3f6a17942cad637c450a61380d3024504db.exe
Size 453KB
Sample240614-chvmas1fjf
SHA256 df5fe65af1f6f93e6fa38aa46f53d3f6a17942cad637c450a61380d3024504db
MD5 60faa2d26d2e99709d68922b5260dc03
SHA1 f73f0cbb0744c9fa1e45ca905d268e427dd08812
SHA512 3d89e773a646e7c9742ca7fee2d3e74e252f2b3ca4a5b81c7826083b6e5edd9be073a9c9d560cf53360555dca3c9604ba1fc15b2be62727c4f820241a0636f42
SSDEEP 6144:KqPijyI7k17Iy3E4DELriqdcG0VFtsRkxBQ/XfaQI9k8UE/hOTJRLmbGWnHN3AHC:a2I7k17Iy3E71ax8PYk8BO1RLpyH1SC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df5fe65af1f6f93e6fa38aa46f53d3f6a17942cad637c450a61380d3024504db.exe

File Explorer

df5fe65af1f6f93e6fa38aa46f53d3f6a17942cad637c450a61380d3024504db.exe

.exe 453KB

df5fe65af1f6f93e6fa38aa46f53d3f6a17942cad637c450a61380d3024504db.exe

IMPHASH 4c082f70014cc4498b9e950a1038c75b
SHA256 df5fe65af1f6f93e6fa38aa46f53d3f6a17942cad637c450a61380d3024504db
MD5 60faa2d26d2e99709d68922b5260dc03
SHA1 f73f0cbb0744c9fa1e45ca905d268e427dd08812
SHA512 3d89e773a646e7c9742ca7fee2d3e74e252f2b3ca4a5b81c7826083b6e5edd9be073a9c9d560cf53360555dca3c9604ba1fc15b2be62727c4f820241a0636f42
SSDEEP 6144:KqPijyI7k17Iy3E4DELriqdcG0VFtsRkxBQ/XfaQI9k8UE/hOTJRLmbGWnHN3AHC:a2I7k17Iy3E71ax8PYk8BO1RLpyH1SC
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

55391

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

CreateCaret CallWindowProcA

shell32

ExtractIconExA

kernel32

GetCPInfo WriteConsoleW HeapSize CreateFileW GetProcessHeap CloseHandle WaitForSingleObject CreateThread VirtualAlloc RaiseException InitOnceBeginInitialize InitOnceComplete WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW WideCharToMultiByte GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW SetEndOfFile GetCurrentProcessId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess SetStdHandle RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread FreeLibraryAndExitThread GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW

Name

.text

Size

180KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

214KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bsS

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

df5fe65af1f6f93e6fa38aa46f53d3f6a17942cad637c450a61380d3024504db.exe

user32

shell32

kernel32

generic