97530718d7c5c829a3f7e6b7e0c98290N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
97530718d7c5c829a3f7e6b7e0c98290N.exe
Size 31KB
Sample240905-2v4s6stcrf
SHA256 7c45b7a762d609eb89c5bb6bb147952728b170a0ade1e2a1d748d9c560a6dc8b
MD5 97530718d7c5c829a3f7e6b7e0c98290
SHA1 611014fe48f4a8785d969d769c266629088bd17a
SHA512 6a39d88a483ccf14ab5798856c6552be59a213a50f23d62053f63a65b7b3ce23483d0cacc7488c4848fb262595c32193dd35b478df077c891f927efa5d608d69
SSDEEP 384:oJRCjYtWDDkfPJuHEqh3EGaTeQuwqku0PUe17oWFMbXY1MZH:o2ctwDkaJ3EG/nfkEe5VFMn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97530718d7c5c829a3f7e6b7e0c98290N.exe

File Explorer

97530718d7c5c829a3f7e6b7e0c98290N.exe

.dll 31KB

97530718d7c5c829a3f7e6b7e0c98290N.exe

IMPHASH 3aa9019a1ec1088c9929ef7fd8e19837
SHA256 7c45b7a762d609eb89c5bb6bb147952728b170a0ade1e2a1d748d9c560a6dc8b
MD5 97530718d7c5c829a3f7e6b7e0c98290
SHA1 611014fe48f4a8785d969d769c266629088bd17a
SHA512 6a39d88a483ccf14ab5798856c6552be59a213a50f23d62053f63a65b7b3ce23483d0cacc7488c4848fb262595c32193dd35b478df077c891f927efa5d608d69
SSDEEP 384:oJRCjYtWDDkfPJuHEqh3EGaTeQuwqku0PUe17oWFMbXY1MZH:o2ctwDkaJ3EG/nfkEe5VFMn
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

DeleteCriticalSection EnterCriticalSection GetLastError InitializeCriticalSection LeaveCriticalSection Sleep TlsGetValue VirtualProtect VirtualQuery

msvcrt

__iob_func _amsg_exit _assert _initterm _lock _unlock abort calloc free fwrite malloc memcmp memcpy realloc strlen strncmp vfprintf _strdup

libwinpthread-1

pthread_getspecific pthread_key_create pthread_key_delete pthread_setspecific

libdb-6.1

db_create db_env_create db_strerror

libswipl

PL_atom_chars PL_blob_data PL_close_foreign_frame PL_copy_term_ref PL_cut_query PL_domain_error PL_erase_external PL_existence_error PL_foreign_context_address PL_foreign_control PL_free PL_get_atom PL_get_atom_ex PL_get_blob PL_get_bool_ex PL_get_chars PL_get_file_name PL_get_list PL_get_long_ex PL_get_name_arity_sz PL_get_nchars PL_get_nil_ex PL_get_size_ex PL_license PL_new_atom PL_new_functor_sz PL_new_term_ref PL_next_solution PL_open_foreign_frame PL_open_query PL_permission_error PL_predicate PL_raise_exception PL_record_external PL_recorded_external PL_register_foreign PL_resource_error PL_rewind_foreign_frame PL_thread_self PL_type_error PL_unify PL_unify_atom PL_unify_atom_chars PL_unify_blob PL_unify_bool PL_unify_chars PL_unify_integer PL_unify_list PL_unify_nil PL_unify_term Sdprintf Sfprintf _PL_get_arg_sz _PL_retry_address

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

788B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

97530718d7c5c829a3f7e6b7e0c98290N.exe

kernel32

msvcrt

libwinpthread-1

libdb-6.1

libswipl

generic