114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
Size 1.2MB
Sample240727-bfannszbrh
SHA256 114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323
MD5 ef95411945330db1907508d38bc373ac
SHA1 7bb8d57cb26f3927bd741db598254efd72f249c4
SHA512 2ca5709cae5f19b9e95b80df91d00cdc81522f41c5be7070434df8edb25f80f4c1d1704f8db7824f6cae0bb81e4cd1c987d58749a56853a1a5da65542ab2bc8c
SSDEEP 24576:snz6dSHy7DXstIVWn4etKUBYWPezgW8Ns:8zf5N4qKUGWP9W8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

File Explorer

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

.exe 1.2MB

114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe

IMPHASH fcc1e1d34891ecf13d7f9f0c91e336ef
SHA256 114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323
MD5 ef95411945330db1907508d38bc373ac
SHA1 7bb8d57cb26f3927bd741db598254efd72f249c4
SHA512 2ca5709cae5f19b9e95b80df91d00cdc81522f41c5be7070434df8edb25f80f4c1d1704f8db7824f6cae0bb81e4cd1c987d58749a56853a1a5da65542ab2bc8c
SSDEEP 24576:snz6dSHy7DXstIVWn4etKUBYWPezgW8Ns:8zf5N4qKUGWP9W8
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

730344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleHandleA GetProcAddress LoadLibraryA GetStdHandle SetStdHandle CreateFileA FindFirstFileExW FindNextChangeNotification FlushFileBuffers GetFileAttributesExW GetFileInformationByHandle GetFileSize GetFileType GetFileTime LockFile LockFileEx SetEndOfFile SetFilePointer SetFilePointerEx SetFileValidData UnlockFile UnlockFileEx AreFileApisANSI EncodePointer DecodePointer EncodeSystemPointer DecodeSystemPointer SetHandleInformation SetLastError DisconnectNamedPipe PeekNamedPipe GetNamedPipeInfo GetNamedPipeHandleStateW HeapCreate CreateIoCompletionPort PostQueuedCompletionStatus InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent ReleaseSemaphore ReleaseMutex WaitForSingleObject CreateMutexA CreateEventA CancelWaitableTimer WaitForMultipleObjects GetProcessTimes GetCurrentProcessId GetCurrentThreadId GetThreadPriorityBoost GetThreadPriority GetProcessVersion SetPriorityClass GetPriorityClass GetProcessId GetThreadContext FlushInstructionCache GetThreadTimes OpenProcess GetProcessHandleCount GetProcessPriorityBoost SetProcessPriorityBoost GetThreadIOPendingFlag GetVersion GetVersionExA GetNativeSystemInfo SetSystemTimeAdjustment CreateFileMappingW FlushViewOfFile SetProcessWorkingSetSize GetWriteWatch ResetWriteWatch CreateMemoryResourceNotification IsProcessInJob AssignProcessToJobObject SetInformationJobObject DisableThreadLibraryCalls FreeResource GetModuleFileNameA GetModuleFileNameW LockResource GlobalUnlock GlobalCompact GlobalUnfix GlobalUnWire LocalUnlock LocalShrink LocalCompact GetProcessAffinityMask GetProcessIoCounters ConvertFiberToThread CreateFiberEx CreateFiber ConvertThreadToFiber PulseEvent GlobalDeleteAtom InitAtomTable DeleteAtom SetHandleCount SetMessageWaitingIndicator ClearCommBreak ClearCommError EscapeCommFunction GetCommMask GetCommModemStatus GetCommTimeouts TransmitCommChar PrepareTape EraseTape CreateTapePartition GetTapeStatus MulDiv GetMailslotInfo SetMailslotInfo AddAtomA GetNamedPipeHandleStateA VerifyVersionInfoA MapUserPhysicalPagesScatter WriteConsoleW CloseHandle CreateFileW GetConsoleMode GetConsoleOutputCP HeapReAlloc HeapSize GetProcessHeap LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindClose HeapFree HeapAlloc GetModuleHandleExW TerminateProcess ExitProcess GetCurrentProcess WriteFile RtlPcToFileHeader RaiseException LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetLastError RtlUnwindEx GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter

user32

GetLayeredWindowAttributes GetDlgCtrlID GetAsyncKeyState TrackPopupMenuEx MenuItemFromPoint BeginPaint GetClassWord GetCursorInfo CallWindowProcA

winspool.drv

ScheduleJob FindClosePrinterChangeNotification ReadPrinter AbortPrinter FindFirstPrinterChangeNotification

shell32

ord716 DragQueryFileA DragQueryPoint DragFinish FindExecutableA ShellAboutA ExtractIconExA SHFileOperationA SHEmptyRecycleBinA Shell_NotifyIconA SHGetDiskFreeSpaceExA SHSetLocalizedName ord727 ord153 ord152 ord24 ord16 ord17 ord21 ord189 SHBrowseForFolderA SHChangeNotify ord191 ord4 ord645 ord47 ord3 SHGetSettings SHBindToParent ShellExecuteExA

ole32

CoCancelCall CoTestCancel CoEnableCallCancellation CoDisableCallCancellation IIDFromString StringFromGUID2 CoGetTreatAsClass CoGetCancelObject CoSwitchCallContext CoRevertToSelf CoCopyProxy CoFileTimeNow OleDoAutoConvert OleRegGetMiscStatus OleGetIconOfClass IsAccelerator MkParseDisplayName CoGetObject CoIsOle1Class CoAllowSetForegroundWindow CoGetInstanceFromFile CoRevokeInitializeSpy CLSIDFromProgIDEx CoImpersonateClient CoQueryClientBlanket CoGetCallerTID CoGetCurrentLogicalThreadId CoGetContextToken CoGetObjectContext CoRevokeClassObject CoGetMarshalSizeMax CoUnmarshalInterface CoGetStandardMarshal CoGetStdMarshalEx CoIsHandlerConnected CoMarshalInterThreadInterfaceInStream CoQueryProxyBlanket CoSetProxyBlanket CoSetCancelObject CoTaskMemRealloc

gdiplus

GdiplusStartup

userenv

GetUserProfileDirectoryA