80fb5e9a67594c9a946937c69dc89d1af62c61c1aa4683fbed0b73cacb256afcN[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
80fb5e9a67594c9a946937c69dc89d1af62c61c1aa4683fbed0b73cacb256afcN.exe
Size 643KB
Sample240926-adnbbaycqe
SHA256 80fb5e9a67594c9a946937c69dc89d1af62c61c1aa4683fbed0b73cacb256afc
MD5 131079bd43b423ff802ab25ab4f80830
SHA1 ee3ec110e5e639a09d0c04f2a028f1e953e069ee
SHA512 4175b88bd4adf9b68540f8a8aaf0bb15bd764e1eecd6b9499365cf66e291d03b861dde7e914b082b8bc323566f7bf001bc2e0d79e6242db4697e315595466db2
SSDEEP 12288:Yj32cnr9Xsoq8UtOhVUA4hmI901TY2H8hZcQqaEYx2rX5:Q2cnr9XRZhKAQ9AY2H8heQPEYI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
80fb5e9a67594c9a946937c69dc89d1af62c61c1aa4683fbed0b73cacb256afcN.exe

File Explorer

80fb5e9a67594c9a946937c69dc89d1af62c61c1aa4683fbed0b73cacb256afcN.exe

.exe 643KB

80fb5e9a67594c9a946937c69dc89d1af62c61c1aa4683fbed0b73cacb256afcN.exe

IMPHASH 63b6d640ef299e8f8898cea09b8aa342
SHA256 80fb5e9a67594c9a946937c69dc89d1af62c61c1aa4683fbed0b73cacb256afc
MD5 131079bd43b423ff802ab25ab4f80830
SHA1 ee3ec110e5e639a09d0c04f2a028f1e953e069ee
SHA512 4175b88bd4adf9b68540f8a8aaf0bb15bd764e1eecd6b9499365cf66e291d03b861dde7e914b082b8bc323566f7bf001bc2e0d79e6242db4697e315595466db2
SSDEEP 12288:Yj32cnr9Xsoq8UtOhVUA4hmI901TY2H8hZcQqaEYx2rX5:Q2cnr9XRZhKAQ9AY2H8heQPEYI
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

cmd.pdb

msvcrt

??1type_info@@UAE@XZ memmove _local_unwind4 _setjmp3 memcmp memmove_s _purecall _wpopen _controlfp ?terminate@@YAXXZ __CxxFrameHandler3 _except_handler4_common _onexit __dllonexit _unlock _lock _initterm __setusermatherr __p__fmode _cexit longjmp ??3@YAXPAX@Z _wcsnicmp __set_app_type __getmainargs wcstol _get_osfhandle _amsg_exit _getch __p__commode _XcptFilter calloc free _wcslwr qsort _dup2 _dup _close _open_osfhandle _ultoa swscanf _ultoa_s _pipe wcsncmp _setmode towupper exit iswxdigit time srand _wtol memcpy_s fflush wcsstr iswalpha wcstoul feof wcsspn _tell _errno ??_V@YAXPAX@Z printf rand fprintf wcsrchr realloc towlower _exit setlocale _wcsupr iswdigit _wcsicmp iswspace wcschr fgets _pclose _vsnwprintf ferror __iob_func malloc _callnewh ??0exception@@QAE@ABQBD@Z ??0exception@@QAE@ABQBDH@Z ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ?what@exception@@UBEPBDXZ _CxxThrowException memcpy memset

ntdll

NtOpenProcessToken NtQueryInformationToken NtClose NtOpenThreadToken NtFsControlFile RtlDosPathNameToNtPathName_U RtlFindLeastSignificantBit RtlFreeHeap RtlReleaseRelativeName NtOpenFile RtlDosPathNameToRelativeNtPathName_U_WithStatus NtSetInformationFile NtQueryVolumeInformationFile NtSetInformationProcess NtQueryInformationProcess RtlNtStatusToDosError NtCancelSynchronousIoFile RtlCreateUnicodeStringFromAsciiz RtlFreeUnicodeString

api-ms-win-core-kernel32-legacy-l1-1-0

GetConsoleWindow CopyFileW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetProcAddress GetModuleFileNameW LoadLibraryExW GetModuleHandleExW GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

ReleaseMutex CreateSemaphoreExW ReleaseSRWLockExclusive InitializeCriticalSection TryAcquireSRWLockExclusive DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection ReleaseSemaphore AcquireSRWLockExclusive WaitForSingleObjectEx EnterCriticalSection OpenSemaphoreW AcquireSRWLockShared ReleaseSRWLockShared CreateMutexExW WaitForSingleObject

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapReAlloc HeapFree HeapSize HeapAlloc HeapSetInformation

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter SetErrorMode GetLastError SetLastError

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer SetThreadpoolTimer CreateThreadpoolTimer WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

TerminateProcess CreateProcessW CreateProcessAsUserW GetStartupInfoW OpenThread UpdateProcThreadAttribute InitializeProcThreadAttributeList GetExitCodeProcess GetCurrentProcessId GetCurrentThreadId DeleteProcThreadAttributeList ResumeThread GetCurrentProcess

api-ms-win-core-localization-l1-2-0

SetThreadLocale GetUserDefaultLCID GetACP GetCPInfo GetLocaleInfoW GetThreadLocale FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak OutputDebugStringW IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-memory-l1-1-0

VirtualAlloc VirtualFree VirtualQuery ReadProcessMemory

api-ms-win-core-console-l1-1-0

ReadConsoleW WriteConsoleW GetConsoleMode SetConsoleMode SetConsoleCtrlHandler GetConsoleOutputCP

api-ms-win-core-file-l1-1-0

FindFirstFileW FindNextFileW FlushFileBuffers SetFileAttributesW GetFileAttributesExW GetFullPathNameW FindClose GetDriveTypeW CreateFileW FileTimeToLocalFileTime WriteFile SetFilePointer GetFileAttributesW ReadFile SetEndOfFile SetFileTime GetVolumePathNameW GetFileSize CreateDirectoryW GetFileType FindFirstFileExW GetDiskFreeSpaceExW GetVolumeInformationW CompareFileTime RemoveDirectoryW SetFilePointerEx DeleteFileW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle ExpandEnvironmentStringsW SearchPathW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentDirectoryW SetEnvironmentStringsW GetCommandLineW GetEnvironmentStringsW SetCurrentDirectoryW FreeEnvironmentStringsW

api-ms-win-core-console-l2-1-0

FillConsoleOutputCharacterW SetConsoleCursorPosition SetConsoleTextAttribute FillConsoleOutputAttribute GetConsoleScreenBufferInfo FlushConsoleInputBuffer ScrollConsoleScreenBufferW

api-ms-win-security-base-l1-1-0

GetFileSecurityW RevertToSelf GetSecurityDescriptorOwner

api-ms-win-core-sysinfo-l1-1-0

SetLocalTime GetLocalTime GetSystemTime GetTickCount GetSystemTimeAsFileTime GetVersion GetWindowsDirectoryW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime SystemTimeToFileTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-systemtopology-l1-1-0

GetNumaNodeProcessorMaskEx GetNumaHighestNodeNumber

api-ms-win-core-console-l2-2-0

GetConsoleTitleW SetConsoleTitleW

api-ms-win-core-processenvironment-l1-2-0

NeedCurrentDirectoryForExePathW

api-ms-win-core-registry-l1-1-0

RegSetValueExW RegCreateKeyExW RegDeleteValueW RegDeleteKeyExW RegEnumKeyExW RegQueryValueExW RegCloseKey RegOpenKeyExW

api-ms-win-core-file-l2-1-0

MoveFileExW CreateSymbolicLinkW MoveFileWithProgressW CreateHardLinkW GetFileInformationByHandleEx

api-ms-win-core-heap-l2-1-0

GlobalFree LocalFree GlobalAlloc

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-winrt-l1-1-0

RoUninitialize RoInitialize

api-ms-win-core-processtopology-l1-1-0

GetThreadGroupAffinity

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW lstrcmpW

api-ms-win-core-processtopology-obsolete-l1-1-0

SetProcessAffinityMask

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

189KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

408KB

Virtual Size

1000KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

80fb5e9a67594c9a946937c69dc89d1af62c61c1aa4683fbed0b73cacb256afcN.exe

msvcrt

ntdll

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processtopology-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic