2a9ca96a774697399b7b112be1a2ec3c[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2a9ca96a774697399b7b112be1a2ec3c.exe
Size 322KB
Sample240801-jvevyavbla
SHA256 773b7430b45b6c8d03ff3ca60ba642c62626cc570daf86cd5dcd40cd0678eaf1
MD5 2a9ca96a774697399b7b112be1a2ec3c
SHA1 da98d372a0c138805d947a436a9b41781e61fd20
SHA512 820164990929710ae93309f39309e9614fb198d3b7335b8fde4c52d84640abd9c73b8e69601c6714fec9471dff1653387204401e6841cb42965266d49d6aff38
SSDEEP 6144:V5B8DY9c80tk5koaMrtonT8nzkwHgDKFag4cHgo2TW:7B8DY9yYhaODRgDK9Hgo2a
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a9ca96a774697399b7b112be1a2ec3c.exe

File Explorer

2a9ca96a774697399b7b112be1a2ec3c.exe

.exe 322KB

2a9ca96a774697399b7b112be1a2ec3c.exe

IMPHASH 5aceba6b8f80a97c0ff1e3c072a69b00
SHA256 773b7430b45b6c8d03ff3ca60ba642c62626cc570daf86cd5dcd40cd0678eaf1
MD5 2a9ca96a774697399b7b112be1a2ec3c
SHA1 da98d372a0c138805d947a436a9b41781e61fd20
SHA512 820164990929710ae93309f39309e9614fb198d3b7335b8fde4c52d84640abd9c73b8e69601c6714fec9471dff1653387204401e6841cb42965266d49d6aff38
SSDEEP 6144:V5B8DY9c80tk5koaMrtonT8nzkwHgDKFag4cHgo2TW:7B8DY9yYhaODRgDK9Hgo2a
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

81288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

NtClose NtWriteFile NtMapViewOfSection NtSetInformationFile RtlInitUnicodeString NtSetInformationProcess RtlAdjustPrivilege NtCreateSection NtOpenFile

user32

wsprintfA

oleaut32

VariantClear

shlwapi

PathFindFileNameW

advapi32

RegCloseKey RegOpenKeyExW RegOpenKeyExA RegSetValueExA GetTokenInformation GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegSetValueExW

wininet

InternetOpenUrlW InternetReadFile InternetCloseHandle HttpQueryInfoA InternetOpenW

shell32

SHGetFolderPathA SHGetFolderPathW

kernel32

IsValidLocaleName LCMapStringEx GetUserDefaultLocaleName FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount64 QueryPerformanceCounter EnumSystemLocalesEx FlsFree FlsSetValue FlsGetValue FlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc LoadLibraryExW OutputDebugStringW ReadConsoleW SetStdHandle WriteConsoleW GetModuleHandleW UnmapViewOfFile SetFilePointerEx GetStartupInfoW InitOnceExecuteOnce GetFileType HeapSize GetStdHandle GetModuleHandleExW GetCurrentThreadId GetThreadContext GetTempFileNameW GetFileSize SetThreadContext SetFilePointer GetCurrentProcess WaitForSingleObject WriteFile OpenProcess GetSystemDirectoryW LoadLibraryW GetModuleFileNameW CreateFileW GetTempPathW GetLastError GetProcAddress VirtualAllocEx LoadLibraryA GetModuleHandleA Wow64SetThreadContext CloseHandle WriteProcessMemory ResumeThread Wow64GetThreadContext CreateThread HeapAlloc GetProcessHeap Sleep Process32First CreateRemoteThread Process32Next CreateToolhelp32Snapshot VirtualProtectEx ExitProcess FindFirstFileW MapViewOfFile SetEndOfFile CreateProcessW CompareFileTime VirtualFree GetWindowsDirectoryA GetProcessTimes GetVolumeInformationA CopyFileW TerminateProcess ReadFile lstrcatA CreateDirectoryA VirtualAlloc CopyFileA SetFileAttributesA FindClose Process32FirstW CreateFileMappingA IsWow64Process GetModuleFileNameA Process32NextW CreateMutexA IsDebuggerPresent FindNextFileW DeleteFileW SetFileAttributesW ExpandEnvironmentStringsW MultiByteToWideChar WideCharToMultiByte LocalFree GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetLocaleInfoEx HeapFree GetCPInfo IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCommandLineW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount IsValidCodePage GetACP GetOEMCP SetLastError