8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe
Size 8.9MB
Sample240821-ff9j8avamp
SHA256 8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2
MD5 6e1f77d96601fc0e931fd355faaa373f
SHA1 a85772631a0c6d86c134c27e69fb19a433aa1729
SHA512 defe1efd09e3ae0251382d9df051817fbcbbe9b6a6d4091537e05da7cf145b8b00fe2736f895a5a6b2fff0fb0c3e84882e90a62e096af5db6d22932de6398c11
SSDEEP 98304:pL6VwkcepYIOX3bQ3zhKRuJKI07NV2EwBLU71H/D8w/alW8zA+j83:EcepY3EDhKRuJZYYE1H/0zRS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe

File Explorer

8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe

.exe 8.9MB

8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2.exe

IMPHASH 074ae4243baae5e3714ed5ba2bd48516
SHA256 8e3c8a67122bed24ce4a67ce7df0af3bf3b856dad467edd059c5afdbf46a6cf2
MD5 6e1f77d96601fc0e931fd355faaa373f
SHA1 a85772631a0c6d86c134c27e69fb19a433aa1729
SHA512 defe1efd09e3ae0251382d9df051817fbcbbe9b6a6d4091537e05da7cf145b8b00fe2736f895a5a6b2fff0fb0c3e84882e90a62e096af5db6d22932de6398c11
SSDEEP 98304:pL6VwkcepYIOX3bQ3zhKRuJKI07NV2EwBLU71H/D8w/alW8zA+j83:EcepY3EDhKRuJZYYE1H/0zRS
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

427897

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Eva01\source\repos\stage1\Release\stage1.pdb

ws2_32

ioctlsocket send WSACloseEvent gethostname getsockopt getpeername sendto recvfrom freeaddrinfo getaddrinfo recv listen htonl getsockname connect bind accept select __WSAFDIsSet socket htons WSAIoctl setsockopt WSACleanup WSAStartup ntohs WSAGetLastError WSASetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent

wldap32

ord30 ord217 ord46 ord301 ord200 ord143 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211

crypt32

CertFreeCertificateChain CertCloseStore CertOpenStore CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore

normaliz

IdnToUnicode IdnToAscii

advapi32

CryptCreateHash OpenProcessToken CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData GetTokenInformation CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegCloseKey RegOpenKeyExW

shell32

ShellExecuteW

iphlpapi

GetAdaptersInfo

wininet

InternetOpenUrlW InternetOpenW InternetCloseHandle

bcrypt

BCryptGenRandom

kernel32

GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineW GetCommandLineA WriteFile SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW CreateFileW FlushFileBuffers ExitThread CreateThread GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue HeapFree HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW DeleteFileW HeapReAlloc SetStdHandle SetEndOfFile GetCurrentDirectoryW GetFullPathNameW TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize FreeLibraryAndExitThread LeaveCriticalSection RaiseException RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetCurrentProcess GetModuleFileNameW GetEnvironmentVariableW WaitForSingleObject GetFileAttributesW CreateToolhelp32Snapshot Sleep GetLastError Process32NextW Process32FirstW CloseHandle GetProcAddress CreateProcessW GetModuleHandleW GetExitCodeProcess GetTickCount64 GetComputerNameW IsDebuggerPresent CreateDirectoryW SizeofResource SetConsoleTextAttribute GetStdHandle LockResource LoadResource FindResourceW SetConsoleOutputCP ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter GetTickCount EnterCriticalSection WriteConsoleW InitializeCriticalSectionEx DeleteCriticalSection SetEvent CreateEventA MultiByteToWideChar QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary GetModuleHandleA LoadLibraryA WideCharToMultiByte SetLastError FormatMessageW MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetCurrentProcessId GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SleepEx VerSetConditionMask VerifyVersionInfoW CreateFileA GetFileSizeEx TryAcquireSRWLockExclusive GetStringTypeW GetCurrentThreadId GetExitCodeThread GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter