bd9c7fc40fa376b53d23750021bc645ade1e4215a1265b1fc50665b01562b12f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
bd9c7fc40fa376b53d23750021bc645ade1e4215a1265b1fc50665b01562b12f.exe
Size 2.2MB
Sample240818-bvtp4axgmc
SHA256 bd9c7fc40fa376b53d23750021bc645ade1e4215a1265b1fc50665b01562b12f
MD5 28da65bb6b3dd33f53235b6ff67d6d89
SHA1 f3ff50dcb640b58ab824b2de80c9c5721ed0fe9f
SHA512 a887a6e72f6556d350da084e0b71fe5b822cb7f057469bcc2b11c581cc182688a8f783fc5de600f16c6d7682ecde4659fb662162d76979303eb3e8432ed50e94
SSDEEP 49152:DrasJSuxF9rdUbJ2wMt7QjKuBQucLPSVd1JScFptNYUy3/R1Xy9:DxD6vpw+YUS/R1i9
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

bd9c7fc40fa376b53d23750021bc645ade1e4215a1265b1fc50665b01562b12f.exe

.exe 2.2MB

bd9c7fc40fa376b53d23750021bc645ade1e4215a1265b1fc50665b01562b12f.exe

IMPHASH 64d33852dc9d07c22f129376f0f48025
SHA256 bd9c7fc40fa376b53d23750021bc645ade1e4215a1265b1fc50665b01562b12f
MD5 28da65bb6b3dd33f53235b6ff67d6d89
SHA1 f3ff50dcb640b58ab824b2de80c9c5721ed0fe9f
SHA512 a887a6e72f6556d350da084e0b71fe5b822cb7f057469bcc2b11c581cc182688a8f783fc5de600f16c6d7682ecde4659fb662162d76979303eb3e8432ed50e94
SSDEEP 49152:DrasJSuxF9rdUbJ2wMt7QjKuBQucLPSVd1JScFptNYUy3/R1Xy9:DxD6vpw+YUS/R1i9
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

66:c2:6a:be:3e:2a:30:fb:bd:fc:84:5e:3d:de:cd:79:bc:ae:45:2d:7e:18:82:a8:e4:7f:8b:61:12:71:fd:9a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 14, 2024

Minor OS version

Major OS version

Entry point

439912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e^GInj3BId'b8OD>`JkcQL\5:%W XK|~~e;!ZVYhrWAvujXQ6(H`;K4@[email protected],6o}uH\ QY-^qV`z,$1"1

advapi32

RegCreateKeyExW RegDeleteKeyExW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RevertToSelf OpenThreadToken SetThreadToken DuplicateTokenEx GetSecurityDescriptorLength CreateWellKnownSid GetWindowsAccountDomainSid

bcrypt

BCryptGenerateSymmetricKey BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer GetConsoleWindow FreeConsole AllocConsole SetLastError GetLastError LocalFree CloseHandle GetThreadContext ExitProcess FormatMessageW K32EnumProcessModulesEx IsWow64Process GetExitCodeProcess OpenProcess K32EnumProcesses K32GetModuleInformation K32GetModuleBaseNameW K32GetModuleFileNameExW GetProcessId DuplicateHandle GetCurrentProcess CloseThreadpoolIo GetCurrentProcessId MultiByteToWideChar GetStdHandle RaiseFailFastException TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentThread Sleep DeleteCriticalSection EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx QueryPerformanceFrequency GetFullPathNameW GetLongPathNameW WideCharToMultiByte LocalAlloc GetConsoleOutputCP GetProcAddress LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CopyFileExW CreateDirectoryW CreateFileW CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo DeleteFileW DeleteVolumeMountPointW CreateSymbolicLinkW DeviceIoControl ExpandEnvironmentStringsW FindNextFileW FindClose FindFirstFileExW FreeLibrary GetFileAttributesExW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetLogicalDrives GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW GetVolumeInformationW LoadLibraryExW MoveFileExW ReadFile RemoveDirectoryW ReplaceFileW SetFileAttributesW SetFileInformationByHandle SetThreadErrorMode GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile GetCurrentProcessorNumberEx SetEvent ResetEvent CreateEventExW GetEnvironmentVariableW FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread CreateThread GetCurrentThreadId SuspendThread ResumeThread SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery InitializeCriticalSectionEx GetSystemTimeAsFileTime DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead

ole32

CoWaitForMultipleHandles CoTaskMemFree CoCreateGuid CoGetApartmentType CoUninitialize CoTaskMemAlloc CoInitializeEx

user32

LoadStringW

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc malloc _callnewh free

api-ms-win-crt-math-l1-1-0

modf __setusermatherr tan ceil sin pow floor cos

api-ms-win-crt-string-l1-1-0

strcpy_s strcmp wcsncmp _stricmp strncpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

terminate _initterm_e _crt_atexit _register_onexit_function _initialize_onexit_table abort _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv __p___argc _exit exit _initialize_wide_environment _seh_filter_exe _set_app_type _initterm _configure_wide_argv _get_initial_wide_environment

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __acrt_iob_func __stdio_common_vsscanf _set_fmode __stdio_common_vsprintf_s __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

448KB

Virtual Size

447KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

859KB

Virtual Size

859KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

742KB

Virtual Size

742KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bd9c7fc40fa376b53d23750021bc645ade1e4215a1265b1fc50665b01562b12f.exe

PE Signature issue

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic