6012722bb5136e7dfcc33763ccd5ec5c2024a1904f928c5c75b8160b13b6ecc9[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
6012722bb5136e7dfcc33763ccd5ec5c2024a1904f928c5c75b8160b13b6ecc9.exe
Size 3.7MB
Sample240817-bplsasyeqd
SHA256 6012722bb5136e7dfcc33763ccd5ec5c2024a1904f928c5c75b8160b13b6ecc9
MD5 8873846b9663e1fb72778a220667c010
SHA1 1a10dc17e957cb85d9ccdde65f262077d438b68d
SHA512 85fdab0152ea521e9d366358c1d19a0e65673ca1121736d8cbc5013d69b5dbb465de7afe10e6bfc1a24bfd6f50c5549aecbb94ec0a2c93a98ab6585e39d035f8
SSDEEP 49152:IrasJSuxF9rdUbJ2wMt7QjKuBQucLjaVd1JScFItNYUy3U9ATAP9nPLM8wFVEkb7:WxD6vJw3YUSHAPa9fn4c1d/prj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6012722bb5136e7dfcc33763ccd5ec5c2024a1904f928c5c75b8160b13b6ecc9.exe

File Explorer

6012722bb5136e7dfcc33763ccd5ec5c2024a1904f928c5c75b8160b13b6ecc9.exe

.exe 3.7MB

6012722bb5136e7dfcc33763ccd5ec5c2024a1904f928c5c75b8160b13b6ecc9.exe

IMPHASH 64d33852dc9d07c22f129376f0f48025
SHA256 6012722bb5136e7dfcc33763ccd5ec5c2024a1904f928c5c75b8160b13b6ecc9
MD5 8873846b9663e1fb72778a220667c010
SHA1 1a10dc17e957cb85d9ccdde65f262077d438b68d
SHA512 85fdab0152ea521e9d366358c1d19a0e65673ca1121736d8cbc5013d69b5dbb465de7afe10e6bfc1a24bfd6f50c5549aecbb94ec0a2c93a98ab6585e39d035f8
SSDEEP 49152:IrasJSuxF9rdUbJ2wMt7QjKuBQucLjaVd1JScFItNYUy3U9ATAP9nPLM8wFVEkb7:WxD6vJw3YUSHAPa9fn4c1d/prj
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

439912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

)^z$+}%|ztI}{<y-<RB>jB7FNuJDKFn6ar=+!!Wo/+TX)1+\16gS!!HmF2aJTW"/,#Wq^u6^_xUMC=t'r7N[/ORV&Y

advapi32

RegCreateKeyExW RegDeleteKeyExW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RevertToSelf OpenThreadToken SetThreadToken DuplicateTokenEx GetSecurityDescriptorLength CreateWellKnownSid GetWindowsAccountDomainSid

bcrypt

BCryptGenerateSymmetricKey BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer GetConsoleWindow FreeConsole AllocConsole SetLastError GetLastError LocalFree CloseHandle GetThreadContext ExitProcess FormatMessageW K32EnumProcessModulesEx IsWow64Process GetExitCodeProcess OpenProcess K32EnumProcesses K32GetModuleInformation K32GetModuleBaseNameW K32GetModuleFileNameExW GetProcessId DuplicateHandle GetCurrentProcess CloseThreadpoolIo GetCurrentProcessId MultiByteToWideChar GetStdHandle RaiseFailFastException TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentThread Sleep DeleteCriticalSection EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx QueryPerformanceFrequency GetFullPathNameW GetLongPathNameW WideCharToMultiByte LocalAlloc GetConsoleOutputCP GetProcAddress LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CopyFileExW CreateDirectoryW CreateFileW CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo DeleteFileW DeleteVolumeMountPointW CreateSymbolicLinkW DeviceIoControl ExpandEnvironmentStringsW FindNextFileW FindClose FindFirstFileExW FreeLibrary GetFileAttributesExW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetLogicalDrives GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW GetVolumeInformationW LoadLibraryExW MoveFileExW ReadFile RemoveDirectoryW ReplaceFileW SetFileAttributesW SetFileInformationByHandle SetThreadErrorMode GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile GetCurrentProcessorNumberEx SetEvent ResetEvent CreateEventExW GetEnvironmentVariableW FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread CreateThread GetCurrentThreadId SuspendThread ResumeThread SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery InitializeCriticalSectionEx GetSystemTimeAsFileTime DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead

ole32

CoWaitForMultipleHandles CoTaskMemFree CoCreateGuid CoGetApartmentType CoUninitialize CoTaskMemAlloc CoInitializeEx

user32

LoadStringW

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc malloc _callnewh free

api-ms-win-crt-math-l1-1-0

modf __setusermatherr tan ceil sin pow floor cos

api-ms-win-crt-string-l1-1-0

strcpy_s strcmp wcsncmp _stricmp strncpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

terminate _initterm_e _crt_atexit _register_onexit_function _initialize_onexit_table abort _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv __p___argc _exit exit _initialize_wide_environment _seh_filter_exe _set_app_type _initterm _configure_wide_argv _get_initial_wide_environment

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __acrt_iob_func __stdio_common_vsscanf _set_fmode __stdio_common_vsprintf_s __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

448KB

Virtual Size

447KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

859KB

Virtual Size

859KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

742KB

Virtual Size

742KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6012722bb5136e7dfcc33763ccd5ec5c2024a1904f928c5c75b8160b13b6ecc9.exe

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic