9ef0b7351873989dde1b4bf5e244c617b92bb904152ac1d55a4a1fd93b732d05[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
9ef0b7351873989dde1b4bf5e244c617b92bb904152ac1d55a4a1fd93b732d05.exe
Size 6.3MB
Sample241004-cdgvmsybkn
SHA256 9ef0b7351873989dde1b4bf5e244c617b92bb904152ac1d55a4a1fd93b732d05
MD5 1e396d6c94cb42792e209b8e2e1948f6
SHA1 59c1dc22d6636b58796d2ad5ef84a4471b372f09
SHA512 34edf247c08a0472aec2ca00f464487a32733dee35f1fa85f024dda3ce17104ab35c6b5e414f69399bfc2fe6a8d0f5262c771b55f01a7a8057b59c8580f22a4c
SSDEEP 98304:fW6YrekvPN3f4lCEHfM3q6eH6Yec7p0qCV2/QfBEqSc69:O6YrekRf4RfM3qGYfk2/bq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ef0b7351873989dde1b4bf5e244c617b92bb904152ac1d55a4a1fd93b732d05.exe

File Explorer

9ef0b7351873989dde1b4bf5e244c617b92bb904152ac1d55a4a1fd93b732d05.exe

.exe 6.3MB

9ef0b7351873989dde1b4bf5e244c617b92bb904152ac1d55a4a1fd93b732d05.exe

IMPHASH da9dc3140f81bd80f7118480dbb8308c
SHA256 9ef0b7351873989dde1b4bf5e244c617b92bb904152ac1d55a4a1fd93b732d05
MD5 1e396d6c94cb42792e209b8e2e1948f6
SHA1 59c1dc22d6636b58796d2ad5ef84a4471b372f09
SHA512 34edf247c08a0472aec2ca00f464487a32733dee35f1fa85f024dda3ce17104ab35c6b5e414f69399bfc2fe6a8d0f5262c771b55f01a7a8057b59c8580f22a4c
SSDEEP 98304:fW6YrekvPN3f4lCEHfM3q6eH6Yec7p0qCV2/QfBEqSc69:O6YrekRf4RfM3qGYfk2/bq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2227312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\GitLab-Runner\builds\qr55KSHn\1\endpoint\windows\WindowsSecurity\Allegro\Binary\Release\9.0.35\17\Win32\WRSA.pdb

kernel32

LocalFileTimeToFileTime GetCurrentThreadId GetLocalTime GetDiskFreeSpaceExW GetSystemTimeAsFileTime RemoveDirectoryW GetDriveTypeW CreateDirectoryW CreateFileW GetFileAttributesW SetUnhandledExceptionFilter GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ExpandEnvironmentStringsW ProcessIdToSessionId VirtualFree GetModuleHandleA OpenProcess GetLocaleInfoW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW WriteFile CheckRemoteDebuggerPresent FileTimeToSystemTime GetVolumeInformationW SetErrorMode GetComputerNameW GlobalFree GetExitCodeProcess DeleteFileW DecodePointer HeapSize WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW GetPrivateProfileStringW GetUserDefaultUILanguage CopyFileW GetTimeFormatW GetDateFormatW SystemTimeToFileTime FileTimeToLocalFileTime TerminateThread WaitForMultipleObjects GetCommandLineA TerminateProcess GetCurrentProcessId GetCurrentProcess OpenEventW CreateEventW ReleaseMutex DuplicateHandle GetCommandLineW GetProcAddress FreeLibrary ExitProcess SetEvent GlobalAlloc GetTickCount64 WaitForSingleObject CloseHandle Sleep HeapFree HeapReAlloc HeapAlloc GetProcessHeap MultiByteToWideChar WideCharToMultiByte GetCurrentThread GlobalLock GlobalUnlock DeviceIoControl LocalAlloc LocalFree GetSystemTime VerSetConditionMask VerifyVersionInfoW GetFileSizeEx SetHandleInformation UnmapViewOfFile SetFileAttributesW CreateFileMappingA MoveFileExW MapViewOfFile GetTickCount MoveFileW MulDiv CreateMutexW LoadLibraryW GetCurrentDirectoryW SetCurrentDirectoryW GetProcessTimes GetSystemDirectoryA LoadLibraryA ResetEvent SetFilePointer SetEndOfFile CreateSemaphoreW GetSystemInfo CreateFileMappingW AssignProcessToJobObject ResumeThread GetFileSize SetThreadPriority FindResourceA CreateThread QueryDosDeviceW CreateEventA TryAcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockShared SwitchToThread OutputDebugStringA WaitForSingleObjectEx CompareFileTime TryEnterCriticalSection GetSystemPowerStatus LoadLibraryExW VirtualProtectEx ReadFile WTSGetActiveConsoleSessionId ReleaseSemaphore CreateSemaphoreA GetFileAttributesA CreateFileA DeleteFileA CreateDirectoryA GetShortPathNameW ReadProcessMemory VirtualQueryEx GetProcessIoCounters CancelIoEx GetOverlappedResult GetFileAttributesExW QueryFullProcessImageNameW Thread32Next Thread32First CreateToolhelp32Snapshot OpenThread AreFileApisANSI FindFirstFileW CompareStringW SetLastError GetFullPathNameW FindNextFileW GetLongPathNameW GetStdHandle GetCPInfo GetProcessAffinityMask SetFileTime GetModuleFileNameW FoldStringW CreateHardLinkW FindClose GetVersionExW GetSystemDirectoryW GetConsoleMode TzSpecificLocalTimeToSystemTime IsDBCSLeadByte SetThreadExecutionState SystemTimeToTzSpecificLocalTime GetFileType FlushFileBuffers GetOEMCP PeekNamedPipe GetACP IsValidCodePage GetFileInformationByHandle VerLanguageNameW UnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW InitializeSRWLock InitializeCriticalSectionEx GetExitCodeThread QueryPerformanceFrequency RtlUnwind RaiseException EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW ReadConsoleW GetConsoleOutputCP SetFilePointerEx SetStdHandle LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetStringTypeW CreateProcessW

user32

TranslateMessage EndPaint BeginPaint PostQuitMessage FillRect DrawTextW CreateWindowExW CallWindowProcW DrawIcon DrawFrameControl FindWindowA SetRect SetCursor LoadCursorW SetLayeredWindowAttributes MoveWindow AttachThreadInput ClientToScreen DrawTextA OffsetRect GetClassNameA SetWindowTextW InflateRect GetMonitorInfoW GetShellWindow MonitorFromRect EqualRect FindWindowExW SystemParametersInfoW FindWindowExA UnhookWindowsHookEx WaitForInputIdle CallNextHookEx MapWindowPoints GetFocus GetMessagePos SendInput GetGUIThreadInfo SetWindowsHookExW MapVirtualKeyExW CreateDesktopW CharToOemBuffW OemToCharA CharToOemA OemToCharBuffA CharLowerW CharUpperW GetMessageW PostThreadMessageW LockWorkStation DispatchMessageW GetWindowLongW wsprintfW EnumWindows GetDC IsWindowVisible EnumDisplayDevicesW GetGuiResources ReleaseDC GetWindowDC PtInRect MessageBoxW MessageBeep GetAncestor GetForegroundWindow keybd_event GetAsyncKeyState GetKeyboardLayout GetWindowTextW SwitchToThisWindow IsWindow DestroyIcon LoadImageA LoadImageW SetTimer GetClientRect SetWindowRgn SetWindowPos GetWindowRect DestroyWindow DefWindowProcW CheckMenuItem EnableWindow IsIconic InvalidateRect GetWindowThreadProcessId FindWindowW GetDesktopWindow SetForegroundWindow TrackPopupMenu AppendMenuW EnableMenuItem DestroyMenu CreatePopupMenu PostMessageW GetSystemMetrics UpdateWindow EmptyClipboard SetClipboardData CloseClipboard OpenClipboard KillTimer ShowWindow SetFocus SendMessageW SetWindowTextA ScreenToClient GetCursorPos GetWindowTextA GetMessageExtraInfo SetMessageExtraInfo UnhookWinEvent SetWinEventHook SetWindowLongW

gdi32

ExcludeClipRect GetDeviceCaps CreateDIBSection DeleteDC BitBlt SetTextColor SelectObject CreateCompatibleDC DeleteObject CreateRoundRectRgn SetBkMode GetStockObject CreateCompatibleBitmap GetPixel CreateSolidBrush CreatePen SetWorldTransform SetDCPenColor RoundRect SetStretchBltMode SetDCBrushColor Rectangle StretchBlt SetGraphicsMode PatBlt SetPixel IntersectClipRect ExtTextOutW SetBkColor SelectClipRgn MoveToEx LineTo CreateFontA GetObjectW SetBrushOrgEx CombineRgn CreateRectRgn

advapi32

SetEntriesInAclW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle RegGetValueW RegOpenKeyExW GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW RegSetValueExW RegCreateKeyExW RegCloseKey GetUserNameW TraceMessage DuplicateTokenEx GetLengthSid SetThreadToken OpenProcessToken ConvertStringSidToSidW SetTokenInformation GetTokenInformation SetSecurityInfo InitializeAcl CheckTokenMembership FreeSid CreateWellKnownSid AllocateAndInitializeSid RegNotifyChangeKeyValue OpenSCManagerA CreateProcessAsUserW GetFileSecurityW SetNamedSecurityInfoW BuildExplicitAccessWithNameW GetAce GetAclInformation GetSecurityDescriptorDacl ConvertSidToStringSidW IsValidSid RegOpenKeyW RegEnumKeyExW SetFileSecurityW AdjustTokenPrivileges LookupPrivilegeValueW

gdiplus

GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipDrawImageRect GdipDisposeImage GdipCreateFromHDC GdipDeleteGraphics GdipGetImageWidth GdipLoadImageFromStream

ws2_32

getaddrinfo WSAAddressToStringA freeaddrinfo closesocket gethostbyname inet_addr send socket htons connect

ole32

CreateStreamOnHGlobal