0aeb3c056c2e2ffd333c38bbaec37fb0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
0aeb3c056c2e2ffd333c38bbaec37fb0N.exe
Size 676KB
Sample240825-jas7tsthjp
SHA256 63b51cd45c79916c5a0627d13812476bf912aa23ab179efd482502969bc4f0cb
MD5 0aeb3c056c2e2ffd333c38bbaec37fb0
SHA1 9e4cd9e7c132fc26ed80e3a7e7e8cce338d4a7b0
SHA512 648427489ca02ff4b67d4ee06dc86d257068e9cc78e94fe5f22dea272c267f9ba59f6d4a36bf26a68213f1f6aede0de2eb8f7fac089028fa737c86cd2e1bd198
SSDEEP 12288:HlYJeXm5nkEUuELFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcp:HlYJeXm5jUuEL8NDFKYmKOF0zr31JwA6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0aeb3c056c2e2ffd333c38bbaec37fb0N.exe

File Explorer

0aeb3c056c2e2ffd333c38bbaec37fb0N.exe

.exe 676KB

0aeb3c056c2e2ffd333c38bbaec37fb0N.exe

IMPHASH 0a7a2e70ff1c1295203cb6c0b3d76235
SHA256 63b51cd45c79916c5a0627d13812476bf912aa23ab179efd482502969bc4f0cb
MD5 0aeb3c056c2e2ffd333c38bbaec37fb0
SHA1 9e4cd9e7c132fc26ed80e3a7e7e8cce338d4a7b0
SHA512 648427489ca02ff4b67d4ee06dc86d257068e9cc78e94fe5f22dea272c267f9ba59f6d4a36bf26a68213f1f6aede0de2eb8f7fac089028fa737c86cd2e1bd198
SSDEEP 12288:HlYJeXm5nkEUuELFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcp:HlYJeXm5jUuEL8NDFKYmKOF0zr31JwA6
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ALG.pdb

msvcrt

??1type_info@@UEAA@XZ exit _lock _unlock __set_app_type _exit __dllonexit __wgetmainargs _amsg_exit _XcptFilter _onexit ?terminate@@YAXXZ _cexit _commode _fmode _initterm memmove __CxxFrameHandler4 _wcmdln isdigit __CxxFrameHandler3 _CxxThrowException _callnewh ??0exception@@QEAA@AEBQEBDH@Z ??0exception@@QEAA@XZ memmove_s memcpy_s _wcsicmp ?what@exception@@UEBAPEBDXZ realloc wcscat_s malloc free ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBQEBD@Z __C_specific_handler __setusermatherr memcmp memcpy memset

api-ms-win-core-synch-l1-1-0

EnterCriticalSection SetEvent LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateEventW WaitForSingleObject

api-ms-win-core-libraryloader-l1-2-0

LoadResource LoadLibraryExW GetModuleHandleW FreeLibrary GetModuleFileNameW FindResourceExW SizeofResource GetProcAddress

api-ms-win-core-string-l2-1-0

CharPrevW CharNextW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter GetLastError UnhandledExceptionFilter RaiseException

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegNotifyChangeKeyValue RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegCloseKey RegQueryInfoKeyW RegEnumValueW

api-ms-win-core-memory-l1-1-0

VirtualProtect VirtualAlloc VirtualQuery

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetSystemTimeAsFileTime GetTickCount

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapDestroy HeapFree HeapAlloc HeapSetInformation

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId TerminateProcess GetCurrentProcessId CreateThread GetCurrentProcess GetStartupInfoW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer CreateTimerQueue DeleteTimerQueueEx DeleteTimerQueueTimer

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW lstrcpynW

cryptbase

SystemFunction036

mswsock

AcceptEx GetAcceptExSockaddrs

api-ms-win-core-file-l1-1-0

WriteFile ReadFile

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-kernel32-legacy-l1-1-0

BindIoCompletionCallback

Name

.text

Size

60KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

280B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

0aeb3c056c2e2ffd333c38bbaec37fb0N.exe

msvcrt

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

cryptbase

mswsock

api-ms-win-core-file-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

generic