Order SMG 201906 20190816orderGMD#0498366Deta[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Order SMG 201906 20190816orderGMD#0498366Deta.exe
Size 2.3MB
Sample240723-gdfd2azfjf
SHA256 a6dd827620007d29efb0f45a61ef6d7e1e6957d56103e8c61d6562cda8ef9c78
MD5 179e1628adcd4f90b64d8e8e7e63214a
SHA1 4636dac57ced7ebfdce05311cb48f16ea2059eae
SHA512 5eb7ac5fd8fd81c621457318b42b29e04e69c6f330fc8acc39ac65b39d0d4e6f698b16abd95fdf05da3ea04931b7c8f67ff07abcfb904bab023d5d581f14b23d
SSDEEP 49152:uB1BRf3rOSzOzrFNj8e1KbWF8K7Vk3SZTH4OWOEkw/R8VDYWg1Hpb67eQPVZD5bO:OaRrFCI2S7eg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Order SMG 201906 20190816orderGMD#0498366Deta.exe

File Explorer

Order SMG 201906 20190816orderGMD#0498366Deta.exe

.exe 2.3MB

Order SMG 201906 20190816orderGMD#0498366Deta.exe

IMPHASH 23682184df099986ebd41d63cd7803a7
SHA256 a6dd827620007d29efb0f45a61ef6d7e1e6957d56103e8c61d6562cda8ef9c78
MD5 179e1628adcd4f90b64d8e8e7e63214a
SHA1 4636dac57ced7ebfdce05311cb48f16ea2059eae
SHA512 5eb7ac5fd8fd81c621457318b42b29e04e69c6f330fc8acc39ac65b39d0d4e6f698b16abd95fdf05da3ea04931b7c8f67ff07abcfb904bab023d5d581f14b23d
SSDEEP 49152:uB1BRf3rOSzOzrFNj8e1KbWF8K7Vk3SZTH4OWOEkw/R8VDYWg1Hpb67eQPVZD5bO:OaRrFCI2S7eg
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

438496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges CreateWellKnownSid DeregisterEventSource DuplicateTokenEx GetSecurityDescriptorLength GetWindowsAccountDomainSid LookupPrivilegeValueW OpenProcessToken OpenThreadToken RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExA RegSetValueExW RegisterEventSourceW ReportEventW RevertToSelf SetThreadToken

bcrypt

BCryptDestroyKey BCryptEncrypt BCryptGenRandom BCryptOpenAlgorithmProvider BCryptSetProperty BCryptDecrypt BCryptCloseAlgorithmProvider BCryptImportKey

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader AllocConsole CancelThreadpoolIo CloseHandle CloseThreadpoolIo CompareStringEx CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventExW CreateFileW CreateProcessA CreateProcessW CreateSymbolicLinkW CreateThreadpoolIo DeleteCriticalSection DeleteFileW DeleteVolumeMountPointW DeviceIoControl DuplicateHandle EnterCriticalSection EnumCalendarInfoExEx EnumTimeFormatsEx ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNLSStringEx FindNextFileW FindStringOrdinal FlushFileBuffers FormatMessageW FreeConsole FreeLibrary GetCalendarInfoEx GetConsoleOutputCP GetConsoleWindow GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetDynamicTimeZoneInformation GetEnvironmentVariableW GetFileAttributesExW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocaleInfoEx GetLogicalDrives GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetOverlappedResult GetProcAddress GetStdHandle GetSystemDirectoryW GetSystemTime GetThreadContext GetThreadPriority GetTickCount64 GetTimeZoneInformation GetUserPreferredUILanguages GetVolumeInformationW InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent LCMapStringEx LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree LocaleNameToLCID MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadFile RemoveDirectoryW ReplaceFileW ResetEvent ResolveLocaleName SetEvent SetFileAttributesW SetFileInformationByHandle SetLastError SetThreadErrorMode SetThreadPriority Sleep SleepConditionVariableCS StartThreadpoolIo SystemTimeToFileTime TzSpecificLocalTimeToSystemTime VirtualAlloc VirtualFree WaitForMultipleObjectsEx WakeConditionVariable WideCharToMultiByte WriteFile FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread GetCurrentThreadId SuspendThread ResumeThread SetThreadContext QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime InitializeCriticalSectionEx DebugBreak WaitForSingleObject SleepEx GetCurrentProcessId GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry

ole32

CoTaskMemAlloc CoTaskMemFree CoUninitialize CoWaitForMultipleHandles CoInitializeEx CoCreateGuid CoGetApartmentType

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

__setusermatherr floor pow modf sin cos ceil tan

api-ms-win-crt-heap-l1-1-0

free calloc _set_new_mode malloc _callnewh

api-ms-win-crt-string-l1-1-0

strncpy_s strcpy_s _stricmp wcsncmp strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv __p___argc _exit exit _initterm_e terminate _crt_atexit _initterm _register_onexit_function _get_initial_wide_environment abort _initialize_onexit_table _initialize_wide_environment _configure_wide_argv _seh_filter_exe _set_app_type

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf __p__commode __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf_s _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

447KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

709KB

Virtual Size

709KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

565KB

Virtual Size

565KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

554KB

Virtual Size

553KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Order SMG 201906 20190816orderGMD#0498366Deta.exe

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic