d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe
Size 2.3MB
Sample240723-wtcemsvdqd
SHA256 d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230
MD5 2a65843b474feff5256bd673b4ff88ae
SHA1 0c80fb17f84d478941ab4d51fddcccaf274da31d
SHA512 7f8a5a684273a031b648129870d493c9a2d63838a8179b8ce32e2c94f956c1a1196ef404d346e6ca42016489fa949b985bc598111dde0249c64c12a668b77292
SSDEEP 49152:E2u/BMdg532rpsjCMqigjns2+a95PlpiH9MzMrcgt4hzNriBldyQJ/MqmG:DrpEZI0BnlJNh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe

File Explorer

d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe

.exe 2.3MB

d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe

IMPHASH bdd12e28ad568dc64eacd7cb42d8e2d5
SHA256 d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230
MD5 2a65843b474feff5256bd673b4ff88ae
SHA1 0c80fb17f84d478941ab4d51fddcccaf274da31d
SHA512 7f8a5a684273a031b648129870d493c9a2d63838a8179b8ce32e2c94f956c1a1196ef404d346e6ca42016489fa949b985bc598111dde0249c64c12a668b77292
SSDEEP 49152:E2u/BMdg532rpsjCMqigjns2+a95PlpiH9MzMrcgt4hzNriBldyQJ/MqmG:DrpEZI0BnlJNh
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

438188

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges CreateWellKnownSid DeregisterEventSource DuplicateTokenEx GetSecurityDescriptorLength GetWindowsAccountDomainSid LookupPrivilegeValueW OpenProcessToken OpenThreadToken RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExA RegSetValueExW RegisterEventSourceW ReportEventW RevertToSelf SetThreadToken

bcrypt

BCryptDestroyKey BCryptEncrypt BCryptGenRandom BCryptOpenAlgorithmProvider BCryptSetProperty BCryptDecrypt BCryptCloseAlgorithmProvider BCryptImportKey

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader AllocConsole CancelThreadpoolIo CloseHandle CloseThreadpoolIo CompareStringEx CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventExW CreateFileW CreateProcessA CreateSymbolicLinkW CreateThreadpoolIo DeleteCriticalSection DeleteFileW DeleteVolumeMountPointW DeviceIoControl DuplicateHandle EnterCriticalSection EnumCalendarInfoExEx EnumTimeFormatsEx ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNLSStringEx FindNextFileW FindStringOrdinal FlushFileBuffers FormatMessageW FreeConsole FreeLibrary GetCalendarInfoEx GetConsoleOutputCP GetConsoleWindow GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetDynamicTimeZoneInformation GetEnvironmentVariableW GetFileAttributesExW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocaleInfoEx GetLogicalDrives GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetOverlappedResult GetProcAddress GetStdHandle GetSystemDirectoryW GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation GetUserPreferredUILanguages GetVolumeInformationW InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent LCMapStringEx LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree LocaleNameToLCID MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadFile RemoveDirectoryW ReplaceFileW ResetEvent ResolveLocaleName ResumeThread SetEvent SetFileAttributesW SetFileInformationByHandle SetLastError SetThreadErrorMode SetThreadPriority Sleep SleepConditionVariableCS StartThreadpoolIo SystemTimeToFileTime TzSpecificLocalTimeToSystemTime VirtualAlloc VirtualFree WaitForMultipleObjectsEx WakeConditionVariable WideCharToMultiByte WriteFile FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime InitializeCriticalSectionEx DebugBreak WaitForSingleObject SleepEx GetCurrentProcessId GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry

ole32

CoTaskMemAlloc CoTaskMemFree CoUninitialize CoWaitForMultipleHandles CoInitializeEx CoCreateGuid CoGetApartmentType

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

__setusermatherr floor pow modf sin cos ceil tan

api-ms-win-crt-heap-l1-1-0

free calloc _set_new_mode malloc _callnewh

api-ms-win-crt-string-l1-1-0

strncpy_s strcpy_s _stricmp wcsncmp strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv __p___argc _exit exit _initterm_e terminate _crt_atexit _initterm _register_onexit_function _get_initial_wide_environment abort _initialize_onexit_table _initialize_wide_environment _configure_wide_argv _seh_filter_exe _set_app_type

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf __p__commode __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf_s _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

446KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

697KB

Virtual Size

696KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

541KB

Virtual Size

541KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

595KB

Virtual Size

595KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic