383dc98d03038d2374701a5bfa5d8c0a[.]exe

General

Target
383dc98d03038d2374701a5bfa5d8c0a.exe
Size 512KB
Sample240707-tsg8dsxele
SHA256 48a4712ae782ae16698b8a85c74dcb790e610c5a31c746319fb1d30e0e3c6096
MD5 383dc98d03038d2374701a5bfa5d8c0a
SHA1 e7fb6995ef4ea1b28f9527c96321452ac59686e1
SHA512 b846e728ec92a77af8b2a822c970646170951254dbd9ec5332191dc7d4b1fd15708e4850912049a772e4af1992fe2658ae3af49a377fb2172eb588fe8c6baff2
SSDEEP 12288:6oZruugE3QDpUibhyJMu5ZkffXdBssjWCxj+x:6oZCugEA9rS5Z8fXdjWN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
383dc98d03038d2374701a5bfa5d8c0a.exe

File Explorer

383dc98d03038d2374701a5bfa5d8c0a.exe

.exe 512KB

383dc98d03038d2374701a5bfa5d8c0a.exe

IMPHASH b1fdca67f9b8dae5c0fa30f8218d4955
SHA256 48a4712ae782ae16698b8a85c74dcb790e610c5a31c746319fb1d30e0e3c6096
MD5 383dc98d03038d2374701a5bfa5d8c0a
SHA1 e7fb6995ef4ea1b28f9527c96321452ac59686e1
SHA512 b846e728ec92a77af8b2a822c970646170951254dbd9ec5332191dc7d4b1fd15708e4850912049a772e4af1992fe2658ae3af49a377fb2172eb588fe8c6baff2
SSDEEP 12288:6oZruugE3QDpUibhyJMu5ZkffXdBssjWCxj+x:6oZCugEA9rS5Z8fXdjWN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

53102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

OffsetRect

kernel32

CreateFileW HeapSize SetStdHandle WaitForSingleObject Sleep CreateThread VirtualAlloc FreeConsole RaiseException InitOnceBeginInitialize InitOnceComplete CloseHandle WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead GetProcessHeap RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread FreeLibraryAndExitThread ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW

Name

.text

Size

168KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bSS

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

280KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

383dc98d03038d2374701a5bfa5d8c0a.exe

user32

kernel32

generic