3644f9a06d97f903a5ceebdd7f2f4500[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
3644f9a06d97f903a5ceebdd7f2f4500.exe
Size 222KB
Sample240628-hm25tswerh
SHA256 bfc572da40fc3dcbee2ff5590ad5f630becf69e18df37b44140bd4f214facf56
MD5 3644f9a06d97f903a5ceebdd7f2f4500
SHA1 53ed26fba664d03b0e2423d6da7235c983fe2a1e
SHA512 f0dced1046018e83a33acc0e06f43bdd300ae4defff974c033a1f16cfd78c366cfd11e480554c197d844442fcfd51494ea39abb7c9c22c686d1b3a6cf5c30d1a
SSDEEP 6144:zVW1Fk5kc9tepTde06Or1HVSuZyfbqLW:JWnYt0hHVSuTLW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3644f9a06d97f903a5ceebdd7f2f4500.exe

File Explorer

3644f9a06d97f903a5ceebdd7f2f4500.exe

.exe 222KB

3644f9a06d97f903a5ceebdd7f2f4500.exe

IMPHASH 052a8313ce9ec358a967696376c518b5
SHA256 bfc572da40fc3dcbee2ff5590ad5f630becf69e18df37b44140bd4f214facf56
MD5 3644f9a06d97f903a5ceebdd7f2f4500
SHA1 53ed26fba664d03b0e2423d6da7235c983fe2a1e
SHA512 f0dced1046018e83a33acc0e06f43bdd300ae4defff974c033a1f16cfd78c366cfd11e480554c197d844442fcfd51494ea39abb7c9c22c686d1b3a6cf5c30d1a
SSDEEP 6144:zVW1Fk5kc9tepTde06Or1HVSuZyfbqLW:JWnYt0hHVSuTLW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shlwapi

PathFindFileNameW

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExW RegCloseKey RegSetValueExW GetTokenInformation

user32

wsprintfW

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

VariantClear

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx NtWriteFile RtlPcToFileHeader RtlInitUnicodeString NtSetInformationFile NtClose NtOpenFile NtCreateSection RtlAdjustPrivilege NtSetInformationProcess RtlVirtualUnwind NtMapViewOfSection

wininet

InternetCloseHandle InternetReadFile InternetOpenUrlW HttpQueryInfoA InternetOpenW

shell32

SHGetFolderPathW

kernel32

SetEndOfFile InitializeCriticalSectionEx WriteConsoleW SetStdHandle ReadConsoleW EnumSystemLocalesEx IsValidLocaleName LCMapStringEx GetUserDefaultLocaleName GetLocaleInfoEx OutputDebugStringW HeapReAlloc LoadLibraryExW FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount64 GetSystemTimeAsFileTime QueryPerformanceCounter GetModuleHandleW FlsFree FlsSetValue FlsGetValue FlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetConsoleMode GetConsoleCP FlushFileBuffers SetFilePointerEx ReadFile GetStartupInfoW InitOnceExecuteOnce DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetFileType GetCurrentThreadId GetThreadContext SetThreadContext Wow64SetThreadContext WriteProcessMemory Wow64GetThreadContext GetCurrentProcess Process32First WaitForSingleObject CreateRemoteThread OpenProcess GetProcAddress VirtualAllocEx Process32Next GetModuleHandleA CreateToolhelp32Snapshot CloseHandle CreateDirectoryW CopyFileW GetModuleFileNameW GetLastError VirtualProtectEx GetFileSize SetFilePointer WriteFile DuplicateHandle CreateThread LoadLibraryA LoadLibraryW GetTempFileNameW CreateFileW GetTempPathW ResumeThread ExitProcess FindFirstFileW HeapAlloc GetProcessHeap Sleep TerminateProcess FindClose Process32FirstW Process32NextW CreateMutexA FindNextFileW LocalFree MapViewOfFile UnmapViewOfFile VirtualFree VirtualAlloc CreateFileMappingA ExpandEnvironmentStringsW EncodePointer DecodePointer HeapFree WideCharToMultiByte EnterCriticalSection LeaveCriticalSection GetCPInfo IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineW GetModuleHandleExW MultiByteToWideChar HeapSize GetStdHandle RaiseException IsValidCodePage GetACP GetOEMCP SetLastError