46ed6a8df27da6eeb92298a77ec1162e6e67884e7f07020b23c06137768506ae[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
46ed6a8df27da6eeb92298a77ec1162e6e67884e7f07020b23c06137768506ae.exe
Size 3.1MB
Sample240621-blqbbavaje
SHA256 46ed6a8df27da6eeb92298a77ec1162e6e67884e7f07020b23c06137768506ae
MD5 3d808f3a657c3db4bdff5f4f60121711
SHA1 3b1c1d0df4201a56988e020201836f8f581351d3
SHA512 31df54b32c6cac3869b9c2dc06c3cf080f218354c6b3a74517e879bf2acd391f22bb013847b7c445dd801b8e4e2d308278f8acc9684c0ae8ceffdfa45bd8ccb5
SSDEEP 98304:r8wl6E5d5IcRsYtD0EDYUGKFdu9CwJsv6ti6i:r10E5nRsYtjGKFdu9CwJsv6tiR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46ed6a8df27da6eeb92298a77ec1162e6e67884e7f07020b23c06137768506ae.exe

File Explorer

46ed6a8df27da6eeb92298a77ec1162e6e67884e7f07020b23c06137768506ae.exe

.exe 3.1MB

46ed6a8df27da6eeb92298a77ec1162e6e67884e7f07020b23c06137768506ae.exe

IMPHASH d01e4ae1e392ef9e7b33cfb7d046977b
SHA256 46ed6a8df27da6eeb92298a77ec1162e6e67884e7f07020b23c06137768506ae
MD5 3d808f3a657c3db4bdff5f4f60121711
SHA1 3b1c1d0df4201a56988e020201836f8f581351d3
SHA512 31df54b32c6cac3869b9c2dc06c3cf080f218354c6b3a74517e879bf2acd391f22bb013847b7c445dd801b8e4e2d308278f8acc9684c0ae8ceffdfa45bd8ccb5
SSDEEP 98304:r8wl6E5d5IcRsYtD0EDYUGKFdu9CwJsv6ti6i:r10E5nRsYtjGKFdu9CwJsv6tiR
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1665872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

userenv

GetUserProfileDirectoryW

advapi32

GetNamedSecurityInfoW GetSidSubAuthorityCount GetSidSubAuthority RegSetValueExW RegQueryValueExW RegQueryInfoKeyW SystemFunction036 OpenProcessToken AddAccessAllowedAceEx AddAccessDeniedAceEx AllocateAndInitializeSid CopySid DuplicateToken FreeSid GetLengthSid GetTokenInformation InitializeAcl InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner LookupAccountSidW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey

authz

AuthzFreeResourceManager AuthzInitializeContextFromToken AuthzInitializeContextFromSid AuthzFreeContext AuthzInitializeResourceManager AuthzAccessCheck

kernel32

HeapSize WriteConsoleW OpenProcess GetProcessHeap GetConsoleWindow OutputDebugStringW GetCommandLineW GetCurrentProcessId LocalFree AllocConsole FreeConsole AttachConsole GetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetSystemTime GetLocalTime CloseHandle DuplicateHandle SetEvent WaitForSingleObject CreateEventW Sleep WaitForMultipleObjects GetCurrentProcess CreateThread GetCurrentThread GetCurrentThreadId SetThreadPriority GetThreadPriority TerminateThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo FormatMessageW TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter QueryPerformanceFrequency CreateFileW GetFileAttributesExW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileW GetFileAttributesW GetFileInformationByHandle GetFullPathNameW GetLogicalDrives GetLongPathNameW RemoveDirectoryW SetFileTime GetTempPathW GetVolumePathNamesForVolumeNameW SetErrorMode DeviceIoControl CopyFileW MoveFileW MoveFileExW TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetFileInformationByHandleEx GetModuleFileNameW GetDateFormatW GetTimeFormatW GetLocaleInfoW GetCurrencyFormatW GetUserDefaultLCID GetUserPreferredUILanguages GetModuleHandleW GetProcAddress FlushFileBuffers GetFileType ReadFile SetEndOfFile SetFilePointerEx WriteFile CreateFileMappingW MapViewOfFile UnmapViewOfFile ResetEvent WaitForSingleObjectEx GetTimeZoneInformation GetGeoInfoW GetUserGeoID GetExitCodeProcess K32GetModuleFileNameExW FindFirstFileExW FindNextFileW FreeLibrary GetModuleHandleExW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage SetEnvironmentVariableW HeapReAlloc GetFileSizeEx EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW HeapFree HeapAlloc GetStdHandle ExitProcess SetStdHandle SetFileAttributesW GetConsoleOutputCP ReadConsoleW GetConsoleMode FreeLibraryAndExitThread ExitThread GetCommandLineA LoadLibraryExW SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwind InitializeSListHead GetStartupInfoW IsDebuggerPresent InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer RaiseException ReleaseMutex CreateMutexW VirtualAlloc VirtualFree InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW GetSystemTimeAsFileTime

netapi32

NetShareEnum NetApiBufferFree

ole32

CoCreateInstance CoTaskMemFree CoIncrementMTAUsage CoInitializeEx CoUninitialize

shell32

CommandLineToArgvW SHGetKnownFolderPath

user32

ShowWindow CharNextExA TranslateMessage DispatchMessageW PeekMessageW PostMessageW SetWindowLongW GetWindowLongW KillTimer SetCoalescableTimer SetTimer MsgWaitForMultipleObjectsEx GetQueueStatus DestroyWindow CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeSetEvent timeKillEvent

ws2_32

WSAAsyncSelect

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString WindowsCreateStringReference WindowsGetStringRawBuffer

oleaut32

SysFreeString