35d2329978c4f0ef281f7fb51022a960N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
35d2329978c4f0ef281f7fb51022a960N.exe
Size 320KB
Sample240731-alcjsa1cna
SHA256 dd02277915ac5c15707202a07cdeb81789c3689c9598e1ae8b1d3ec4739db919
MD5 35d2329978c4f0ef281f7fb51022a960
SHA1 fe4cf7cbf09218c7e896a504b6a0376793f5f814
SHA512 ecb09d1e4e04fc876e230c8b49181a802ed2b8fd0f43f7656e2b957670529f5dc33533f075b273bcf37fbf3785552dcbd77f7edb7b65b20ac80e80cbf5975ff0
SSDEEP 6144:OjOTgr3dk5kUbX/G7uTAk1KrZ+aRaHgo2TW:gOiYVD/SbZ+7Hgo2a
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35d2329978c4f0ef281f7fb51022a960N.exe

File Explorer

35d2329978c4f0ef281f7fb51022a960N.exe

.exe 320KB

35d2329978c4f0ef281f7fb51022a960N.exe

IMPHASH d699de932eaf36fa0f236ef101dcee7e
SHA256 dd02277915ac5c15707202a07cdeb81789c3689c9598e1ae8b1d3ec4739db919
MD5 35d2329978c4f0ef281f7fb51022a960
SHA1 fe4cf7cbf09218c7e896a504b6a0376793f5f814
SHA512 ecb09d1e4e04fc876e230c8b49181a802ed2b8fd0f43f7656e2b957670529f5dc33533f075b273bcf37fbf3785552dcbd77f7edb7b65b20ac80e80cbf5975ff0
SSDEEP 6144:OjOTgr3dk5kUbX/G7uTAk1KrZ+aRaHgo2TW:gOiYVD/SbZ+7Hgo2a
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

NtClose NtWriteFile NtMapViewOfSection NtSetInformationFile RtlInitUnicodeString NtSetInformationProcess RtlAdjustPrivilege NtCreateSection NtOpenFile

user32

wsprintfA

oleaut32

VariantClear

shlwapi

PathFindFileNameW

advapi32

GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken GetTokenInformation

wininet

InternetOpenUrlW InternetReadFile InternetCloseHandle HttpQueryInfoA InternetOpenW

shell32

SHGetFolderPathA SHGetFolderPathW

kernel32

LoadLibraryExW HeapReAlloc EnumSystemLocalesEx IsValidLocaleName LCMapStringEx GetUserDefaultLocaleName FreeEnvironmentStringsW GetEnvironmentStringsW OutputDebugStringW QueryPerformanceCounter GetModuleHandleW FlsFree FlsSetValue FlsGetValue FlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetConsoleMode GetConsoleCP FlushFileBuffers ReadConsoleW SetStdHandle WriteConsoleW GetTickCount64 CreateProcessW SetFilePointerEx GetStartupInfoW InitOnceExecuteOnce GetFileType HeapSize GetStdHandle GetModuleHandleExW GetCurrentThreadId GetThreadContext GetTempFileNameW GetFileSize SetThreadContext SetFilePointer GetCurrentProcess WaitForSingleObject WriteFile OpenProcess GetSystemDirectoryW LoadLibraryW GetModuleFileNameW CreateFileW GetTempPathW GetLastError GetProcAddress VirtualAllocEx LoadLibraryA GetModuleHandleA Wow64SetThreadContext CloseHandle WriteProcessMemory ResumeThread Wow64GetThreadContext CreateThread HeapAlloc GetProcessHeap Sleep Process32First CreateRemoteThread Process32Next CreateToolhelp32Snapshot VirtualProtectEx ExitProcess FindFirstFileW MapViewOfFile UnmapViewOfFile SetEndOfFile CompareFileTime VirtualFree GetWindowsDirectoryA GetProcessTimes GetVolumeInformationA CopyFileW TerminateProcess ReadFile lstrcatA CreateDirectoryA VirtualAlloc CopyFileA SetFileAttributesA FindClose Process32FirstW CreateFileMappingA IsWow64Process GetModuleFileNameA Process32NextW CreateMutexA IsDebuggerPresent FindNextFileW DeleteFileW SetFileAttributesW ExpandEnvironmentStringsW MultiByteToWideChar WideCharToMultiByte LocalFree GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetLocaleInfoEx HeapFree GetCPInfo IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCommandLineW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount IsValidCodePage GetACP GetOEMCP SetLastError