53cb9f627f76b9cc4321e0e8161524f0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
53cb9f627f76b9cc4321e0e8161524f0N.exe
Size 468KB
Sample240802-ez2s2swbln
SHA256 d59d7070f9fc1110e5182846f547da8e303d08c067c891767f670ebb7dd17e70
MD5 53cb9f627f76b9cc4321e0e8161524f0
SHA1 8aaab0ba8ac5c41e10b90648043c214f5e781244
SHA512 4b32d290fabd2a3a59973849a286753b6c3699195a18aedcbacc4a6762bb9e815cf3d268d16bc64f90b8f6488e07d2e2f8bed713093920e0507d7c16365a5d04
SSDEEP 12288:lne4knIZ0tXWUvz7P8ReOMqF+RgAv7z1:lne4knmUvP8YOgyAv7z1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
53cb9f627f76b9cc4321e0e8161524f0N.exe

File Explorer

53cb9f627f76b9cc4321e0e8161524f0N.exe

.exe 468KB

53cb9f627f76b9cc4321e0e8161524f0N.exe

IMPHASH d978d78f24d00067ae727581cca0b391
SHA256 d59d7070f9fc1110e5182846f547da8e303d08c067c891767f670ebb7dd17e70
MD5 53cb9f627f76b9cc4321e0e8161524f0
SHA1 8aaab0ba8ac5c41e10b90648043c214f5e781244
SHA512 4b32d290fabd2a3a59973849a286753b6c3699195a18aedcbacc4a6762bb9e815cf3d268d16bc64f90b8f6488e07d2e2f8bed713093920e0507d7c16365a5d04
SSDEEP 12288:lne4knIZ0tXWUvz7P8ReOMqF+RgAv7z1:lne4knmUvP8YOgyAv7z1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msiexec.pdb

advapi32

RegOpenKeyExW RegCreateKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken OpenThreadToken FreeSid GetLengthSid AllocateAndInitializeSid DeregisterEventSource ReportEventW RegisterEventSourceW MakeSelfRelativeSD GetSecurityDescriptorLength SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl InitializeSecurityDescriptor GetAce AddAccessAllowedAce InitializeAcl RegCloseKey RegSetValueExW RegDeleteKeyW RegQueryValueExW RegDeleteValueW RegEnumKeyW CloseServiceHandle CreateServiceW OpenSCManagerW SetThreadToken DeleteService QueryServiceStatus ControlService OpenServiceW RegEnumKeyExW SetServiceStatus RegisterServiceCtrlHandlerW EqualSid GetSecurityDescriptorOwner RegGetKeySecurity MakeAbsoluteSD GetTokenInformation RevertToSelf StartServiceCtrlDispatcherW

kernel32

lstrlenW lstrcmpiW CloseHandle InterlockedExchange GetCurrentProcess GetLastError GetCurrentThread Sleep GetVersionExW GetEnvironmentVariableW InitializeCriticalSection DeleteCriticalSection GetProcAddress LoadLibraryW MultiByteToWideChar WideCharToMultiByte SetLastError GlobalAlloc GlobalFree FreeLibrary UnhandledExceptionFilter GetVersion GetModuleHandleW WaitForSingleObject CreateProcessW GetModuleFileNameW InterlockedDecrement InterlockedIncrement lstrcmpW FormatMessageW GetSystemDefaultLangID LoadLibraryExW SetCurrentDirectoryW OutputDebugStringW WriteFile GetLocaleInfoW GetACP LeaveCriticalSection EnterCriticalSection OpenProcess CreateEventW OpenEventW CompareStringW GetFileType GetStdHandle GetCommandLineW ExitProcess SetEvent SetConsoleCtrlHandler CreateThread GetSystemDirectoryW GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetModuleHandleA TerminateProcess SetUnhandledExceptionFilter GetStartupInfoA InterlockedCompareExchange

user32

MsgWaitForMultipleObjects IsCharAlphaNumericW GetMessageW PeekMessageW DispatchMessageW TranslateMessage PostQuitMessage PostThreadMessageW

msvcrt

_acmdln _initterm _amsg_exit __setusermatherr __p__commode __p__fmode __set_app_type _unlock __dllonexit _lock _onexit ?terminate@@YAXXZ _controlfp exit _ismbblead _XcptFilter _exit _cexit __getmainargs _vsnprintf _vsnwprintf _wcsicmp memcpy memset wcsrchr

ntdll

RtlNtStatusToDosError RtlUnwind NtQueryInformationProcess

ole32

CoInitialize CoRevokeClassObject CoRegisterClassObject StgOpenStorage CoUninitialize

msi

ord141 ord70 ord190 ord280 ord197 ord228 ord136 ord169 ord78 ord148 ord8 ord88 ord199 ord131 ord184 ord175 ord240 ord222 ord196