mentalwinillness[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mentalwinillness.exe
Size 1.2MB
Sample240729-ngncdazhkh
SHA256 059301a83ea02dcec59e677fa9776b425b1e40c56f17dbf28cc40992ddc2c15b
MD5 ca8784419fa1a77682f54332b1f90919
SHA1 7739087625a16192eadcf1b584f129fbb6f901d6
SHA512 27c80898390de578764a7990ae27be77529ae957249b5d002ad064137cbc209b38c56f9d7677a5528607d3659467262bef1b329b6b7d5990e7839cb035176944
SSDEEP 24576:NsTc/FQKqFWTmOcV7jhrQmtRx8O6JnD6Dft28TMpDtkh7tWWhqUnAbQ8ZUZbO6Z7:+TcunP8ZgKV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mentalwinillness.exe

File Explorer

mentalwinillness.exe

.exe 1.2MB

mentalwinillness.exe

IMPHASH abe10b3bd4aaf092f191d35e1467cf69
SHA256 059301a83ea02dcec59e677fa9776b425b1e40c56f17dbf28cc40992ddc2c15b
MD5 ca8784419fa1a77682f54332b1f90919
SHA1 7739087625a16192eadcf1b584f129fbb6f901d6
SHA512 27c80898390de578764a7990ae27be77529ae957249b5d002ad064137cbc209b38c56f9d7677a5528607d3659467262bef1b329b6b7d5990e7839cb035176944
SSDEEP 24576:NsTc/FQKqFWTmOcV7jhrQmtRx8O6JnD6Dft28TMpDtkh7tWWhqUnAbQ8ZUZbO6Z7:+TcunP8ZgKV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

487977

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\kafer\source\repos\mentalwinillness\x64\Debug\mentalwinillness.pdb

kernel32

FreeConsole CreateFileW ReadConsoleW ReadFile TerminateThread GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx HeapQueryInformation CreateThread GetConsoleMode Sleep GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RaiseException MultiByteToWideChar WideCharToMultiByte GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress GetCurrentProcess TerminateProcess RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RtlPcToFileHeader GetModuleHandleExW GetStdHandle WriteFile ExitProcess GetCommandLineA GetCommandLineW HeapSize HeapValidate GetSystemInfo GetCurrentThread CloseHandle WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW HeapReAlloc RtlUnwind

user32

ReleaseDC EnumWindows GetSystemMetrics IsWindowVisible SetWindowPos GetDC MessageBoxW

gdi32

BitBlt Ellipse

Name

.textbss

Size

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

979KB

Virtual Size

978KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

211KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

466B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mentalwinillness.exe

kernel32

user32

gdi32

generic