483E[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
483E.exe
Size 248KB
Sample240724-q534vasbma
SHA256 9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840
MD5 b77043673df8b86cdb3f3049fa4b5cdf
SHA1 998b7f59bf0acd24f920c5608422b59a1f610d80
SHA512 63ab9f4b5108571d094189a6536be0e218e9296c60285d5d2e21f8f799e70421ec44988e94d73b6e7cf2b8020d8e39cd8b3b49c3d599ec8eca4d65280b81a712
SSDEEP 3072:/rwPX0z03zXLpLwAafrPH87QBLAKHIrzJ1fiXMOS5i8nF53JBLGCH:u9XLvafr/87QBEKHazrfi/4ba
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
483E.exe

File Explorer

483E.exe

.exe 248KB

483E.exe

IMPHASH ce2f11a7a6f312137428370d8186914d
SHA256 9c6403ca45a75ab2d917b4014b0227534cc86638a059895ad5cc4889096dc840
MD5 b77043673df8b86cdb3f3049fa4b5cdf
SHA1 998b7f59bf0acd24f920c5608422b59a1f610d80
SHA512 63ab9f4b5108571d094189a6536be0e218e9296c60285d5d2e21f8f799e70421ec44988e94d73b6e7cf2b8020d8e39cd8b3b49c3d599ec8eca4d65280b81a712
SSDEEP 3072:/rwPX0z03zXLpLwAafrPH87QBLAKHIrzJ1fiXMOS5i8nF53JBLGCH:u9XLvafr/87QBEKHazrfi/4ba
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

303104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vagam\mohexenamac.pdb

kernel32

GetLocaleInfoA SetComputerNameW AddConsoleAliasW GetComputerNameW GetTickCount GetNumberFormatA GetUserDefaultLangID GlobalAlloc GlobalFindAtomA LoadLibraryW AssignProcessToJobObject GetConsoleAliasExesLengthW VerifyVersionInfoA SetSystemPowerState CompareStringW GetLogicalDriveStringsA GetLastError SetLastError FindResourceA VirtualAlloc SetFileApisToOEM LoadLibraryA WriteConsoleA InterlockedExchangeAdd MoveFileA RemoveDirectoryW QueryDosDeviceW EnumResourceTypesW CreateWaitableTimerW GetConsoleTitleW VirtualProtect GetFileAttributesExW DeleteFileW GetCurrentProcessId GetFileInformationByHandle GetVolumeInformationW GetProcAddress GetTempFileNameW FlushFileBuffers CloseHandle CreateFileA GetModuleHandleW Sleep ExitProcess GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleA RaiseException HeapAlloc HeapReAlloc HeapSize RtlUnwind SetStdHandle GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

CharUpperBuffW

advapi32

ReadEventLogA

ole32

CoMarshalHresult

winhttp

WinHttpCheckPlatform

msimg32

AlphaBlend