7b3022437b637c44f42741a92c7f7ed251845fd02dda642c0a47fde179bd984e[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
7b3022437b637c44f42741a92c7f7ed251845fd02dda642c0a47fde179bd984e.exe
Size 16.6MB
Sample240908-l5mpmssdkh
SHA256 7b3022437b637c44f42741a92c7f7ed251845fd02dda642c0a47fde179bd984e
MD5 a77d3a4446ae106ccc6c251611231cbc
SHA1 54a8fe5c70ed0007fdd346a9a75977fd9f8ad24a
SHA512 c1123ac7ff577a216640cd55316b4b4bd2b50fa655a1502367c18b9464a153519d9a81f233f789800c18da84749ae226bfc650633f56cb30a081c13fd34a2544
SSDEEP 196608:rEihxi26dYgMpdCPgQYmD0JZzIZd2pLcK9KeYQVJmd8:rEKEdYgMpdC9D0JJIZdK9KeYQVJJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b3022437b637c44f42741a92c7f7ed251845fd02dda642c0a47fde179bd984e.exe

File Explorer

7b3022437b637c44f42741a92c7f7ed251845fd02dda642c0a47fde179bd984e.exe

.exe 16.6MB

7b3022437b637c44f42741a92c7f7ed251845fd02dda642c0a47fde179bd984e.exe

IMPHASH 03477875c156d77dad3dbce944c9139a
SHA256 7b3022437b637c44f42741a92c7f7ed251845fd02dda642c0a47fde179bd984e
MD5 a77d3a4446ae106ccc6c251611231cbc
SHA1 54a8fe5c70ed0007fdd346a9a75977fd9f8ad24a
SHA512 c1123ac7ff577a216640cd55316b4b4bd2b50fa655a1502367c18b9464a153519d9a81f233f789800c18da84749ae226bfc650633f56cb30a081c13fd34a2544
SSDEEP 196608:rEihxi26dYgMpdCPgQYmD0JZzIZd2pLcK9KeYQVJmd8:rEKEdYgMpdC9D0JJIZdK9KeYQVJJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

NtCreateFile NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtWriteFile RtlCaptureContext RtlGetVersion RtlNtStatusToDosError

advapi32

ConvertSidToStringSidW ConvertStringSidToSidW CopySid GetLengthSid GetTokenInformation IsValidSid LookupAccountSidW LsaClose OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

iphlpapi

FreeMibTable GetAdaptersAddresses GetIfEntry2 GetIfTable2

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventA CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreateMutexA CreateNamedPipeW CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle ExitProcess FindClose FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimes GetTempPathW GetTickCount64 GetVolumeInformationW GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW GlobalFree GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList K32GetPerformanceInfo LoadLibraryA LoadLibraryExA LocalFree MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadFileEx ReadProcessMemory RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnmapViewOfFile UpdateProcThreadAttribute VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFileEx CreateSemaphoreW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection ReleaseSemaphore VirtualProtect VirtualQuery

netapi32

NetApiBufferFree NetGroupEnum NetGroupGetInfo NetUserEnum NetUserGetInfo NetUserGetLocalGroups

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize PropVariantClear PropVariantCopy

oleaut32

GetErrorInfo SetErrorInfo SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantClear VariantCopy

pdh

PdhAddEnglishCounterA PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhCollectQueryDataEx PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

propsys

PropVariantCompareEx PropVariantToBSTR PropVariantToBoolean PropVariantToDouble PropVariantToInt16 PropVariantToInt32 PropVariantToInt64 PropVariantToUInt16 PropVariantToUInt32 PropVariantToUInt64 PropVariantToVariant VariantToBoolean VariantToDouble VariantToInt16 VariantToInt32 VariantToInt64 VariantToPropVariant VariantToUInt16 VariantToUInt32 VariantToUInt64

psapi

GetModuleFileNameExW

secur32

LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData

shell32

CommandLineToArgvW

user32

ShowWindow UnregisterPowerSettingNotification

userenv

GetUserProfileDirectoryW

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown

msvcrt

__getmainargs __initenv __lconv_init __p__acmdln __p__commode __p__fmode __set_app_type __setusermatherr _amsg_exit _cexit _errno _commode _fmode _fpreset _initterm _iob _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset pow realloc signal strlen strncmp vfprintf wcslen

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

684B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

854KB

Virtual Size

853KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

660B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

60B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

253KB

Virtual Size

252KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

613KB

Virtual Size

613KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

988KB

Virtual Size

988KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/71

Size

424KB

Virtual Size

423KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/83

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/96

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/107

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/118

Size

512B

Virtual Size

126B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/134

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7b3022437b637c44f42741a92c7f7ed251845fd02dda642c0a47fde179bd984e.exe

ntdll

advapi32

bcrypt

iphlpapi

kernel32

netapi32

ole32

oleaut32

pdh

powrprof

propsys

psapi

secur32

shell32

user32

userenv

ws2_32

msvcrt

generic