a4bb6e4d88c94f0389873b241e6eee8e[.]exe

General

Target
a4bb6e4d88c94f0389873b241e6eee8e.exe
Size 443KB
Sample241007-v3qsys1alm
SHA256 9086348efcc7f6bb5fd00b9919c6fecaa04a9c58aeabaaaac80a1913e9a1e3b4
MD5 a4bb6e4d88c94f0389873b241e6eee8e
SHA1 f44584d6fde4b9bb925a7355d02299220904ccb1
SHA512 13383cdca12687b88940980a6140d734db4674bbab24c3f328bc2adb4079b81becc40400151ec36f21e960dc270a04378b3d8832c902fd0fe93b849c22ecd3a5
SSDEEP 12288:+kpagGiK0F+wkHt9nMY/4zYZKLO5MoDLs:+A73F+HJQzOKLMs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4bb6e4d88c94f0389873b241e6eee8e.exe

File Explorer

a4bb6e4d88c94f0389873b241e6eee8e.exe

.exe 443KB

a4bb6e4d88c94f0389873b241e6eee8e.exe

IMPHASH e40ec87d26b2fdb6278430b22f5c1df6
SHA256 9086348efcc7f6bb5fd00b9919c6fecaa04a9c58aeabaaaac80a1913e9a1e3b4
MD5 a4bb6e4d88c94f0389873b241e6eee8e
SHA1 f44584d6fde4b9bb925a7355d02299220904ccb1
SHA512 13383cdca12687b88940980a6140d734db4674bbab24c3f328bc2adb4079b81becc40400151ec36f21e960dc270a04378b3d8832c902fd0fe93b849c22ecd3a5
SSDEEP 12288:+kpagGiK0F+wkHt9nMY/4zYZKLO5MoDLs:+A73F+HJQzOKLMs
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalCompact CommConfigDialogA InterlockedIncrement InterlockedDecrement SetEnvironmentVariableW QueryDosDeviceA InterlockedCompareExchange SetVolumeMountPointW GetComputerNameW GetTimeFormatA GetTickCount CreateNamedPipeW LocalFlags GetNumberFormatA SetFileTime ClearCommBreak TlsSetValue GetEnvironmentStrings SetFileShortNameW LoadLibraryW CopyFileW _hread GetCalendarInfoA GetVersionExW GetFileAttributesA CreateProcessA GetModuleFileNameW CreateActCtxA GetConsoleAliasExesA GetShortPathNameA CreateJobObjectA LCMapStringA VerifyVersionInfoW GetStdHandle GetLogicalDriveStringsA GetLastError GetCurrentDirectoryW GetProcAddress EnumSystemCodePagesW SetComputerNameA SetFileAttributesA LoadLibraryA LocalAlloc CreateHardLinkW GetNumberFormatW CreateEventW OpenEventA FoldStringW GlobalWire EnumDateFormatsW GetShortPathNameW GetDiskFreeSpaceExA ReadConsoleInputW GetCurrentProcessId DebugBreak GetTempPathA GetLocaleInfoA SetFilePointer GetEnvironmentVariableA EnumCalendarInfoA WriteConsoleW CloseHandle EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapReAlloc GetModuleHandleW ExitProcess GetCommandLineW HeapSetInformation GetStartupInfoW RaiseException RtlUnwind HeapAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsFree SetLastError GetCurrentThreadId WriteFile FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime HeapSize GetACP GetOEMCP IsValidCodePage GetStringTypeW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers CreateFileW

gdi32

CreateDCW GetCharWidth32A GetCharWidthI

winhttp

WinHttpOpen

Name

.text

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

237KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bak

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.nuna

Size

512B

Virtual Size

214B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.roxis

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

125KB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a4bb6e4d88c94f0389873b241e6eee8e.exe

kernel32

gdi32

winhttp

generic