63D7B37217BAD05463192BD2F5E39A4AC23FF21C52CD27BF541780D29CF77C7F[.]exe

General

Target
63D7B37217BAD05463192BD2F5E39A4AC23FF21C52CD27BF541780D29CF77C7F.exe
Size 793KB
Sample240724-shwglavglg
SHA256 9ad258a814d69b7bfb48afaeda5a966308ffedb0cf7454a815c88c42629a745c
MD5 c4f847e7beee920fffd16f694b681d46
SHA1 b438c60457464b10c18f7ee652c6251c5ce5a619
SHA512 bcdde6ab9d79a527bb7b92a97e08de7109246b11afed390b3a96b5d3066947b690dfdc877a701b43756167ecec8c34b6ba14306368fd03649c4607442c48695e
SSDEEP 24576:MpTGDCilbkZd/W8+28gKNUVJFqlxhcW3W8:2TWlloZhWJJmolxqWV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63D7B37217BAD05463192BD2F5E39A4AC23FF21C52CD27BF541780D29CF77C7F.exe

File Explorer

63D7B37217BAD05463192BD2F5E39A4AC23FF21C52CD27BF541780D29CF77C7F.exe

.exe 793KB

63D7B37217BAD05463192BD2F5E39A4AC23FF21C52CD27BF541780D29CF77C7F.exe

IMPHASH ea4e9e661dd76e5830aa3e10f8bf0c4c
SHA256 9ad258a814d69b7bfb48afaeda5a966308ffedb0cf7454a815c88c42629a745c
MD5 c4f847e7beee920fffd16f694b681d46
SHA1 b438c60457464b10c18f7ee652c6251c5ce5a619
SHA512 bcdde6ab9d79a527bb7b92a97e08de7109246b11afed390b3a96b5d3066947b690dfdc877a701b43756167ecec8c34b6ba14306368fd03649c4607442c48695e
SSDEEP 24576:MpTGDCilbkZd/W8+28gKNUVJFqlxhcW3W8:2TWlloZhWJJmolxqWV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

1073152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\lusaga\cowel.pdb

kernel32

AllocConsole SetConsoleTextAttribute ReadConsoleA CreateDirectoryExA FreeEnvironmentStringsA GetConsoleTitleA CreateDirectoryExW LoadLibraryW LeaveCriticalSection WriteConsoleW ReplaceFileW GetMailslotInfo GetBinaryTypeW lstrlenW GetStdHandle GetCPInfoExW MoveFileExA GetProcAddress VirtualAlloc MoveFileW WriteProfileSectionA WriteConsoleA GetProcessWorkingSetSize SetCalendarInfoW GetModuleHandleA FindFirstChangeNotificationA QueueUserWorkItem VirtualProtect GetConsoleAliasesLengthW GetLastError SetFilePointer UnhandledExceptionFilter SetUnhandledExceptionFilter HeapReAlloc HeapAlloc GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess IsDebuggerPresent EnterCriticalSection SetHandleCount GetFileType DeleteCriticalSection GetModuleHandleW Sleep ExitProcess WriteFile GetModuleFileNameA HeapCreate VirtualFree HeapFree GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode MultiByteToWideChar ReadFile InitializeCriticalSectionAndSpinCount RtlUnwind LoadLibraryA SetStdHandle LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleOutputCP FlushFileBuffers HeapSize CreateFileA CloseHandle

user32

ScreenToClient

advapi32

ClearEventLogW

Sharing