xehook | ee3b16d7188ad9b08cb1cbe52708b134[.]bin

General

Target
ee3b16d7188ad9b08cb1cbe52708b134.bin
Size 62KB
Sample240616-c41enswdrd
SHA256 1e01835c4534de392d4bf8deeb5d36c90c583adcb244d38a7dc89135846d7ce9
MD5 72340ddc30438a2a588e05043cf1859f
SHA1 a49dbb9147ebec41d569ad303278d96015936a74
SHA512 efee3c2f6e2317b4be5b751aae2ace20af049b319ceb2bb4b524840099e5daab3f8d434265f29405c644064586802c23b9250e9609281c497bc4cd243a258129
SSDEEP 1536:wjmz8sVRoWe1RSwz96Q3qDzcNqQmifJ24f4M4l+6Ml:wjmYwyWe1Vz9WDoqQmyJPf4M4Yp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xehook

Malware Config

Signatures

Detect Xehook Payload 1 IoCs

resource	yara_rule
static1/unpack001/b134607a248dfe314215ffab39636416dab92d791314f667dbcf9e9c5932d26e.exe	family_xehook

Xehook family
xehook

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b134607a248dfe314215ffab39636416dab92d791314f667dbcf9e9c5932d26e.exe

File Explorer

ee3b16d7188ad9b08cb1cbe52708b134.bin

.zip 62KB
b134607a248dfe314215ffab39636416dab92d791314f667dbcf9e9c5932d26e.exe

.exe 149KB

ee3b16d7188ad9b08cb1cbe52708b134.bin

SHA256 1e01835c4534de392d4bf8deeb5d36c90c583adcb244d38a7dc89135846d7ce9
MD5 72340ddc30438a2a588e05043cf1859f
SHA1 a49dbb9147ebec41d569ad303278d96015936a74
SHA512 efee3c2f6e2317b4be5b751aae2ace20af049b319ceb2bb4b524840099e5daab3f8d434265f29405c644064586802c23b9250e9609281c497bc4cd243a258129
SSDEEP 1536:wjmz8sVRoWe1RSwz96Q3qDzcNqQmifJ24f4M4l+6Ml:wjmYwyWe1Vz9WDoqQmyJPf4M4Yp
MD5 SHA1 SHA512 SSDEEP

Password

infected

b134607a248dfe314215ffab39636416dab92d791314f667dbcf9e9c5932d26e.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b134607a248dfe314215ffab39636416dab92d791314f667dbcf9e9c5932d26e
MD5 ee3b16d7188ad9b08cb1cbe52708b134
SHA1 946ec3b88c7eb1442512cd1ba450b05132e48dc6
SHA512 2c1272dd493ff6361dcadfbbffc39aaa8c84a3a7b925597de0fa12381c045307943e7bb3827b5c22709c2be010c2d0e1036c79c5f933c58ee05acabb672ab542
SSDEEP 3072:vOWXtBuFND5H/QUszPu4bk5GB2fu3/X9e5FuZl1yotj3ZzQ2pw22sIq/L:vh9BuFND5H/QUszPrFBeuZl1yotj3Zzw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Xehook Payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

159208

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ee3b16d7188ad9b08cb1cbe52708b134.bin

b134607a248dfe314215ffab39636416dab92d791314f667dbcf9e9c5932d26e.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

ee3b16d7188ad9b08cb1cbe52708b134.bin

b134607a248dfe314215ffab39636416dab92d791314f667dbcf9e9c5932d26e.exe

mscoree

dotnet