3a05a3bf94a934a3b9521c4e8db70ba4a6564129fcaa79a02e79bc20890b6c94[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
3a05a3bf94a934a3b9521c4e8db70ba4a6564129fcaa79a02e79bc20890b6c94.exe
Size 220KB
Sample240709-blff4s1cqf
SHA256 3a05a3bf94a934a3b9521c4e8db70ba4a6564129fcaa79a02e79bc20890b6c94
MD5 0f9555c88d699987e6250d589e141aec
SHA1 7c202794f5ea6d743d42f2bb51cfb8d81be8fb13
SHA512 04a9f31ecc51430f7f2a54fc398b177c2eb717c296840d772ebcbe203cd5c4e33f695eb4e135463a3c0c9035dd637958519cf2b23d505c9ab9d6869c1017cabf
SSDEEP 3072:zrL6xIhDtd0Ed0Is3YST6MzEwxZc+bsrIt25TmUtqggm2PE9w:HL66dNd033iI/xpCq2RgP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a05a3bf94a934a3b9521c4e8db70ba4a6564129fcaa79a02e79bc20890b6c94.exe

File Explorer

3a05a3bf94a934a3b9521c4e8db70ba4a6564129fcaa79a02e79bc20890b6c94.exe

.exe 220KB

3a05a3bf94a934a3b9521c4e8db70ba4a6564129fcaa79a02e79bc20890b6c94.exe

IMPHASH bfc2475c778d826817de401d46762ab7
SHA256 3a05a3bf94a934a3b9521c4e8db70ba4a6564129fcaa79a02e79bc20890b6c94
MD5 0f9555c88d699987e6250d589e141aec
SHA1 7c202794f5ea6d743d42f2bb51cfb8d81be8fb13
SHA512 04a9f31ecc51430f7f2a54fc398b177c2eb717c296840d772ebcbe203cd5c4e33f695eb4e135463a3c0c9035dd637958519cf2b23d505c9ab9d6869c1017cabf
SSDEEP 3072:zrL6xIhDtd0Ed0Is3YST6MzEwxZc+bsrIt25TmUtqggm2PE9w:HL66dNd033iI/xpCq2RgP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5787

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateJobObjectW SleepEx GetCommProperties GetModuleHandleW GetConsoleAliasesA GlobalAlloc SetVolumeMountPointA lstrcpynW GetModuleFileNameW SetConsoleTitleA ReleaseActCtx SetLastError GetProcAddress BuildCommDCBW GetAtomNameA LoadLibraryA WriteConsoleA UnhandledExceptionFilter InterlockedExchangeAdd SetFileApisToANSI AddAtomA OpenJobObjectW FoldStringW EnumDateFormatsA lstrcatW FindFirstVolumeW LocalFree FlushFileBuffers CloseHandle GetLastError HeapFree MultiByteToWideChar HeapAlloc GetStartupInfoW TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount RtlUnwind LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle GetConsoleOutputCP WriteConsoleW HeapSize CreateFileA

user32

GetProcessDefaultLayout

winhttp

WinHttpAddRequestHeaders

Name

.text

Size

147KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dug

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tar

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.yod

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3a05a3bf94a934a3b9521c4e8db70ba4a6564129fcaa79a02e79bc20890b6c94.exe

kernel32

user32

winhttp

generic