fa949a7589dc71ea006eb10ad025618a[.]exe

General

Target
fa949a7589dc71ea006eb10ad025618a.exe
Size 443KB
Sample241007-16ta5swblq
SHA256 fff79a1e96ffcac77b3eb7bc01706bfece7499ab8972b28a732dfa2aa09994ee
MD5 fa949a7589dc71ea006eb10ad025618a
SHA1 3525508cc8b83cdec2bde0bf0cbdc7cdab62c383
SHA512 40734414f0d40431625d1c79f7fc043458de0f73b59764239041f6a7ac959a6e11869f45a334fec45f37267bf9c2ff2ca4acc23db9c5eac0e70e9413307db136
SSDEEP 6144:dBc5/Qqguk5r/EaOKIhfzrIqku/a5J0gToyxw7coy6BbO42Tn:MBQqgoampv1/GJ0gThx8NO4O
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa949a7589dc71ea006eb10ad025618a.exe

File Explorer

fa949a7589dc71ea006eb10ad025618a.exe

.exe 443KB

fa949a7589dc71ea006eb10ad025618a.exe

IMPHASH e40ec87d26b2fdb6278430b22f5c1df6
SHA256 fff79a1e96ffcac77b3eb7bc01706bfece7499ab8972b28a732dfa2aa09994ee
MD5 fa949a7589dc71ea006eb10ad025618a
SHA1 3525508cc8b83cdec2bde0bf0cbdc7cdab62c383
SHA512 40734414f0d40431625d1c79f7fc043458de0f73b59764239041f6a7ac959a6e11869f45a334fec45f37267bf9c2ff2ca4acc23db9c5eac0e70e9413307db136
SSDEEP 6144:dBc5/Qqguk5r/EaOKIhfzrIqku/a5J0gToyxw7coy6BbO42Tn:MBQqgoampv1/GJ0gThx8NO4O
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalCompact CommConfigDialogA InterlockedIncrement InterlockedDecrement SetEnvironmentVariableW QueryDosDeviceA InterlockedCompareExchange SetVolumeMountPointW GetComputerNameW GetTimeFormatA GetTickCount CreateNamedPipeW LocalFlags GetNumberFormatA SetFileTime ClearCommBreak TlsSetValue GetEnvironmentStrings SetFileShortNameW LoadLibraryW CopyFileW _hread GetCalendarInfoA GetVersionExW GetFileAttributesA CreateProcessA GetModuleFileNameW CreateActCtxA GetConsoleAliasExesA GetShortPathNameA CreateJobObjectA LCMapStringA VerifyVersionInfoW GetStdHandle GetLogicalDriveStringsA GetLastError GetCurrentDirectoryW GetProcAddress EnumSystemCodePagesW SetComputerNameA SetFileAttributesA LoadLibraryA LocalAlloc CreateHardLinkW GetNumberFormatW CreateEventW OpenEventA FoldStringW GlobalWire EnumDateFormatsW GetShortPathNameW GetDiskFreeSpaceExA ReadConsoleInputW GetCurrentProcessId DebugBreak GetTempPathA GetLocaleInfoA SetFilePointer GetEnvironmentVariableA EnumCalendarInfoA WriteConsoleW CloseHandle EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapReAlloc GetModuleHandleW ExitProcess GetCommandLineW HeapSetInformation GetStartupInfoW RaiseException RtlUnwind HeapAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsFree SetLastError GetCurrentThreadId WriteFile FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime HeapSize GetACP GetOEMCP IsValidCodePage GetStringTypeW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers CreateFileW

gdi32

CreateDCW GetCharWidth32A GetCharWidthI

winhttp

WinHttpOpen

Name

.text

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

237KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.siy

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fitecos

Size

512B

Virtual Size

214B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.darulet

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fa949a7589dc71ea006eb10ad025618a.exe

kernel32

gdi32

winhttp

generic