b539242e2246946facbe58110467b5b0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
b539242e2246946facbe58110467b5b0N.exe
Size 652KB
Sample240819-dnptns1djd
SHA256 402795502e19f57c8b9d260e970f2b24639f03113674da2554e2066fa92f1d29
MD5 b539242e2246946facbe58110467b5b0
SHA1 83ee1a00f961061a176a41659b803edfae1272d4
SHA512 f1a94b8c34ef0d765b7da356eb6aad26802689f9e4aae67b368a617b719511c1cd0339c35d24a8e378d063319e35515ab383fcc2db8ec3abe0fbb543e9c08350
SSDEEP 12288:kCOCBoQwaqzPTY53of4XgbXZqHfdQCaIY//RnhOWrZVoexdqCLH31Ii3Dn:kXCjqPYPwbXZq6C7Y/5kWrZVoe/1LH3v
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b539242e2246946facbe58110467b5b0N.exe

File Explorer

b539242e2246946facbe58110467b5b0N.exe

.exe 652KB

b539242e2246946facbe58110467b5b0N.exe

IMPHASH d5fa2d054e222e86f0d3d8efcffe5047
SHA256 402795502e19f57c8b9d260e970f2b24639f03113674da2554e2066fa92f1d29
MD5 b539242e2246946facbe58110467b5b0
SHA1 83ee1a00f961061a176a41659b803edfae1272d4
SHA512 f1a94b8c34ef0d765b7da356eb6aad26802689f9e4aae67b368a617b719511c1cd0339c35d24a8e378d063319e35515ab383fcc2db8ec3abe0fbb543e9c08350
SSDEEP 12288:kCOCBoQwaqzPTY53of4XgbXZqHfdQCaIY//RnhOWrZVoexdqCLH31Ii3Dn:kXCjqPYPwbXZq6C7Y/5kWrZVoe/1LH3v
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SecureBootEncodeUEFI.pdb

api-ms-win-crt-string-l1-1-0

wcsnlen memset strcspn

api-ms-win-crt-locale-l1-1-0

_unlock_locales _lock_locales

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _initterm_e _initterm _c_exit

api-ms-win-crt-private-l1-1-0

_o__callnewh _o__calloc_base _o__cexit _o__configthreadlocale _o__configure_wide_argv _o__crt_atexit _o__errno _o__exit _o__get_initial_wide_environment _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__purecall _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_new_mode memmove _o__wcsdup _o_abort _o_calloc _o_exit _o_free _o_frexp _o_localeconv _o_malloc _o_qsort _o_setlocale _o_terminate __uncaught_exception __C_specific_handler _CxxThrowException _o___stdio_common_vswprintf _o___stdio_common_vsprintf_s _o___stdio_common_vsnprintf_s memcmp memcpy _o___std_exception_destroy _o___std_exception_copy _o___pctype_func _o___p__commode _o___p___wargv _o___p___argc _o____mb_cur_max_func _o____lc_locale_name_func _o____lc_codepage_func __CxxFrameHandler3 _o__set_fmode

ntdll

RtlCaptureContext NtQuerySystemEnvironmentValueEx RtlInitUnicodeString RtlVirtualUnwind RtlLookupFunctionEntry

kernel32

LocalFree InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection GetStringTypeW WideCharToMultiByte GetLastError InitOnceExecuteOnce MultiByteToWideChar IsDebuggerPresent DebugBreak GetModuleHandleW GetProcessHeap GetProcAddress HeapAlloc OutputDebugStringW FormatMessageW GetCurrentThreadId GetModuleHandleExW HeapFree GetModuleFileNameA GetCurrentThread CloseHandle LocalAlloc

advapi32

OpenThreadToken SetThreadToken OpenProcessToken EventWriteTransfer EventRegister EventSetInformation EventUnregister AdjustTokenPrivileges LookupPrivilegeValueW DuplicateTokenEx

bcrypt

BCryptHashData BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptCreateHash BCryptOpenAlgorithmProvider BCryptFinishHash

Name

.text

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

b539242e2246946facbe58110467b5b0N.exe

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

ntdll

kernel32

advapi32

bcrypt

generic