SecuriteInfo[.]com[.]Win32[.]MsfEncodeD[.]24091[.]3118[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Win32.MsfEncodeD.24091.3118.exe
Size 34KB
Sample240925-bec3eaycrh
SHA256 a4b990527a7439738349dc225d6bbdb8aada977b9c52add94bc94ae897311b18
MD5 3f69a87cb4bde9c863f39301eb1f29c8
SHA1 3c9de5d2605eb4419fe38c1728e97b6e7a9057ef
SHA512 d9fa11922158349c540adbd9a9e44062e42f7a5e9372ed89194554d536be186e239e254a2dac1fa40e8caace13c815e5f7a0d35fbd7007f251e5a8462408774d
SSDEEP 384:sckalfdKxiis5iHo40IKYb93V5XiVOcvbvx0fAmwD6:xlkxiihHo4fb93b4TvbOpq6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Win32.MsfEncodeD.24091.3118.exe

File Explorer

SecuriteInfo.com.Win32.MsfEncodeD.24091.3118.exe

.exe 34KB

SecuriteInfo.com.Win32.MsfEncodeD.24091.3118.exe

IMPHASH 4486fdfb6a098ccc306d7d4b7b7a3ded
SHA256 a4b990527a7439738349dc225d6bbdb8aada977b9c52add94bc94ae897311b18
MD5 3f69a87cb4bde9c863f39301eb1f29c8
SHA1 3c9de5d2605eb4419fe38c1728e97b6e7a9057ef
SHA512 d9fa11922158349c540adbd9a9e44062e42f7a5e9372ed89194554d536be186e239e254a2dac1fa40e8caace13c815e5f7a0d35fbd7007f251e5a8462408774d
SSDEEP 384:sckalfdKxiis5iHo40IKYb93V5XiVOcvbvx0fAmwD6:xlkxiihHo4fb93b4TvbOpq6
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\admin\Desktop\Project\queuAPC\x64\Release\queuAPC.pdb

kernel32

WriteProcessMemory Thread32Next Thread32First OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW QueueUserAPC VirtualAllocEx OpenThread RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlCaptureContext

msvcp140

?good@ios_base@std@@QEBA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception memcpy _CxxThrowException __C_specific_handler __std_terminate __std_exception_copy __std_exception_destroy memmove memset

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _c_exit _cexit _register_thread_local_exe_atexit_callback _register_onexit_function _configure_narrow_argv _initialize_onexit_table _invalid_parameter_noinfo_noreturn _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _set_app_type _seh_filter_exe __p___argv __p___argc

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale