d0d4805488e7e745515fff2165d3cc05[.]exe

General

Target
d0d4805488e7e745515fff2165d3cc05.exe
Size 437KB
Sample241007-p6cslszere
SHA256 e684bed5b84f09dd85a88a7847fb4aaed9845f9b8098f0dda486a095a3115d4c
MD5 d0d4805488e7e745515fff2165d3cc05
SHA1 0cebec529de0430c9e897f740700b27c043a8552
SHA512 5a7debe1760fbef5fca9d0a1326f4bcf4336540ffa7956232f0ad380605cd99637af769bca7d0f91bb1c26ffc094968d6471a4427412041ecba7f9fb5b93719c
SSDEEP 6144:zwtN955b+GARrBUNLMmAjgRkRXsmZabQTdVjtga4opTT:zuNL5aGyUBMmAjnFZpptLT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d0d4805488e7e745515fff2165d3cc05.exe

File Explorer

d0d4805488e7e745515fff2165d3cc05.exe

.exe 437KB

d0d4805488e7e745515fff2165d3cc05.exe

IMPHASH 6e15f2578101cc821c000ba42c1b85a8
SHA256 e684bed5b84f09dd85a88a7847fb4aaed9845f9b8098f0dda486a095a3115d4c
MD5 d0d4805488e7e745515fff2165d3cc05
SHA1 0cebec529de0430c9e897f740700b27c043a8552
SHA512 5a7debe1760fbef5fca9d0a1326f4bcf4336540ffa7956232f0ad380605cd99637af769bca7d0f91bb1c26ffc094968d6471a4427412041ecba7f9fb5b93719c
SSDEEP 6144:zwtN955b+GARrBUNLMmAjgRkRXsmZabQTdVjtga4opTT:zuNL5aGyUBMmAjnFZpptLT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalCompact InterlockedIncrement InterlockedDecrement SetEnvironmentVariableW CreateJobObjectW QueryDosDeviceA InterlockedCompareExchange SetVolumeMountPointW GetComputerNameW GetTimeFormatA GetTickCount CreateNamedPipeW LocalFlags GetNumberFormatA SetFileTime ClearCommBreak TlsSetValue GetEnvironmentStrings SetFileShortNameW LoadLibraryW CopyFileW _hread GetCalendarInfoA SetVolumeMountPointA GetVersionExW GetFileAttributesA GetModuleFileNameW CreateActCtxA GetEnvironmentVariableA GetShortPathNameA LCMapStringA GetConsoleAliasExesA GetStdHandle GetLogicalDriveStringsA GetLastError GetCurrentDirectoryW GetProcAddress EnumSystemCodePagesW SetComputerNameA SetFileAttributesA LoadLibraryA InterlockedExchangeAdd LocalAlloc CreateHardLinkW GetNumberFormatW CreateEventW OpenEventA FoldStringW GlobalWire EnumDateFormatsW GetShortPathNameW SetCalendarInfoA SetProcessShutdownParameters GetDiskFreeSpaceExA ReadConsoleInputW GetCurrentProcessId DebugBreak GetTempPathA CommConfigDialogW GetLocaleInfoA SetFilePointer VerifyVersionInfoW EnumCalendarInfoA EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapReAlloc GetModuleHandleW ExitProcess GetCommandLineW HeapSetInformation GetStartupInfoW RaiseException RtlUnwind HeapAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsFree SetLastError GetCurrentThreadId WriteFile FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetSystemTimeAsFileTime HeapSize GetACP GetOEMCP IsValidCodePage GetStringTypeW

gdi32

CreateDCW GetCharWidth32A GetCharWidthI

winhttp

WinHttpOpen

Name

.text

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

238KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gol

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xowujad

Size

512B

Virtual Size

214B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xonag

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d0d4805488e7e745515fff2165d3cc05.exe

kernel32

gdi32

winhttp

generic