3dcad5a8e080c674141c41686629e4e7a598bb6856a9b[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
3dcad5a8e080c674141c41686629e4e7a598bb6856a9b.exe
Size 3.6MB
Sample240910-xvxmms1fnd
SHA256 3dcad5a8e080c674141c41686629e4e7a598bb6856a9ba97584ef83ff0a37f02
MD5 ed1f4a8bf32029bbbd60045ead0443d7
SHA1 98c6b0e95988330486ddba066c608c489361bfbd
SHA512 634abfa9e9a86aebdf14ce420f7bcc0b4bee0d4d9c1fb88928b99b5393e6d095fe7da60b754b2b5a5f0a7bbd41f89517e34cebfe25b42114cd1894256758d7c9
SSDEEP 98304:5BXkwrCppefiarGvxw0N+Rg0mR/Mnk4uq:5BXapgzGxwA+znPuq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3dcad5a8e080c674141c41686629e4e7a598bb6856a9b.exe

File Explorer

3dcad5a8e080c674141c41686629e4e7a598bb6856a9b.exe

.exe 3.6MB

3dcad5a8e080c674141c41686629e4e7a598bb6856a9b.exe

IMPHASH 29e05b1fea10173c5bcc5ba6150988ec
SHA256 3dcad5a8e080c674141c41686629e4e7a598bb6856a9ba97584ef83ff0a37f02
MD5 ed1f4a8bf32029bbbd60045ead0443d7
SHA1 98c6b0e95988330486ddba066c608c489361bfbd
SHA512 634abfa9e9a86aebdf14ce420f7bcc0b4bee0d4d9c1fb88928b99b5393e6d095fe7da60b754b2b5a5f0a7bbd41f89517e34cebfe25b42114cd1894256758d7c9
SSDEEP 98304:5BXkwrCppefiarGvxw0N+Rg0mR/Mnk4uq:5BXapgzGxwA+znPuq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3583488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit GetErrorInfo SysFreeString

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

user32

CharNextW LoadStringW CreateWindowExW UpdateWindow TranslateMessage SystemParametersInfoW ShowWindow RegisterClassW PeekMessageW MsgWaitForMultipleObjects MessageBoxW LoadStringW GetSystemMetrics GetMessageW EndPaint DispatchMessageW DefWindowProcW CharUpperBuffW CharUpperW CharLowerBuffW BeginPaint

kernel32

Sleep VirtualFree VirtualAlloc lstrlenW VirtualQuery QueryPerformanceCounter GetTickCount GetSystemInfo GetVersion CompareStringW IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwind RaiseException ExitProcess ExitThread SwitchToThread GetCurrentThreadId CreateThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile GetStdHandle CloseHandle GetProcAddress RaiseException LoadLibraryA GetLastError TlsSetValue TlsGetValue LocalFree LocalAlloc GetModuleHandleW FreeLibrary WriteFile WideCharToMultiByte WaitForSingleObject VirtualQueryEx VirtualQuery VirtualProtect VirtualFree VirtualAlloc VerSetConditionMask VerifyVersionInfoW UnmapViewOfFile SwitchToThread SuspendThread Sleep SetThreadPriority SetLastError SetFileTime SetFilePointer SetEvent SetEndOfFile ResumeThread ResetEvent ReleaseSemaphore ReadFile RaiseException QueryDosDeviceW IsDebuggerPresent MapViewOfFile LocalFree LoadLibraryA LoadLibraryW LeaveCriticalSection IsValidLocale InitializeCriticalSection HeapSize HeapFree HeapDestroy HeapCreate HeapAlloc GetVolumeInformationW GetVersionExW GetTimeZoneInformation GetTickCount64 GetTickCount GetThreadPriority GetThreadLocale GetSystemInfo GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLogicalDrives GetLogicalDriveStringsW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileSize GetFileAttributesExW GetFileAttributesW GetExitCodeThread GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcess GetCPInfoExW GetCPInfo GetACP FreeLibrary FormatMessageW FlushInstructionCache FindNextFileW FindFirstFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime ExitProcess EnumSystemLocalesW EnumCalendarInfoW EnterCriticalSection DeleteCriticalSection CreateSemaphoreA CreateProcessW CreatePipe CreateFileMappingW CreateFileW CreateEventA CreateEventW CreateDirectoryW CompareStringW CloseHandle Sleep

gdi32

SetBkColor Rectangle

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

netapi32

NetApiBufferFree NetWkstaGetInfo

ole32

CoCreateInstance CoUninitialize CoInitialize

msvcrt

memset memmove memcpy _beginthreadex

winmm

waveOutGetVolume

Name

.text

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

23KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

632B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

150B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

32B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3dcad5a8e080c674141c41686629e4e7a598bb6856a9b.exe

oleaut32

advapi32

user32

kernel32

gdi32

version

netapi32

ole32

msvcrt

winmm

generic