4d6c8b3430ecbea0db0922efbfd5aba88a64266de5a04e5a9ee6f0fe669298d3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
4d6c8b3430ecbea0db0922efbfd5aba88a64266de5a04e5a9ee6f0fe669298d3.exe
Size 1.6MB
Sample241008-rfgd8atflh
SHA256 4d6c8b3430ecbea0db0922efbfd5aba88a64266de5a04e5a9ee6f0fe669298d3
MD5 1d84d7ab5334c2968051c4382734d228
SHA1 f53f24592f673a23f3665641f0640e2290f10600
SHA512 6d4298518d7cbd866bf6f856c5cf31dea6caa0f239106a062fb5892a8e71c8e7a1d3751f10d5756a3e3c803425792422c79b2fd70670b40c1de0a163ee6cf8d6
SSDEEP 49152:tAodtaG9kS2U84B+FLan9k5TRM9zleVjAXRuyvexZA:P/B1tX+v
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d6c8b3430ecbea0db0922efbfd5aba88a64266de5a04e5a9ee6f0fe669298d3.exe

File Explorer

4d6c8b3430ecbea0db0922efbfd5aba88a64266de5a04e5a9ee6f0fe669298d3.exe

.exe 1.6MB

4d6c8b3430ecbea0db0922efbfd5aba88a64266de5a04e5a9ee6f0fe669298d3.exe

IMPHASH 22a65106d3d84ea74d966fa0424a5a0c
SHA256 4d6c8b3430ecbea0db0922efbfd5aba88a64266de5a04e5a9ee6f0fe669298d3
MD5 1d84d7ab5334c2968051c4382734d228
SHA1 f53f24592f673a23f3665641f0640e2290f10600
SHA512 6d4298518d7cbd866bf6f856c5cf31dea6caa0f239106a062fb5892a8e71c8e7a1d3751f10d5756a3e3c803425792422c79b2fd70670b40c1de0a163ee6cf8d6
SSDEEP 49152:tAodtaG9kS2U84B+FLan9k5TRM9zleVjAXRuyvexZA:P/B1tX+v
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

437292

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

>RM\JaF)x-KHM KK7 Rk<qn:F3i+OIJ,&\f,'S]DT&KC$7?@jM%g/5EZF1h9?fu!k+1$sZwOQF/um"|Tl+n+;Q5xhnJol

advapi32

RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegEnumValueW

bcrypt

BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptGenRandom

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer GetConsoleWindow FreeConsole AllocConsole SetLastError GetLastError LocalFree CloseHandle ExitProcess GetTickCount64 FormatMessageW K32EnumProcessModulesEx IsWow64Process GetExitCodeProcess OpenProcess K32EnumProcesses K32GetModuleInformation K32GetModuleBaseNameW K32GetModuleFileNameExW GetProcessId DuplicateHandle GetCurrentProcess CloseThreadpoolIo GetCurrentProcessId MultiByteToWideChar GetStdHandle RaiseFailFastException GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName FindStringOrdinal GetCurrentThread Sleep DeleteCriticalSection EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx QueryPerformanceFrequency GetFullPathNameW GetLongPathNameW WideCharToMultiByte LocalAlloc GetConsoleOutputCP GetProcAddress LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CreateFileW CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetModuleFileNameW GetOverlappedResult LoadLibraryExW ReadFile SetFileInformationByHandle SetThreadErrorMode GetThreadPriority SetThreadPriority WriteFile GetCurrentProcessorNumberEx SetEvent CreateEventExW GetEnvironmentVariableW FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread CreateThread GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx VirtualQuery GetSystemTimeAsFileTime ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead

ole32

CoGetApartmentType CoTaskMemAlloc CoUninitialize CoInitializeEx CoTaskMemFree CoWaitForMultipleHandles

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh calloc _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-string-l1-1-0

strcmp _stricmp strcpy_s strncpy_s wcsncmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

__p___wargv _cexit exit terminate _crt_atexit _register_onexit_function _initialize_onexit_table __p___argc _exit abort _initterm_e _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type _initterm _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vfprintf __p__commode _set_fmode __stdio_common_vsscanf __acrt_iob_func

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

444KB

Virtual Size

444KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

479KB

Virtual Size

478KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

411KB

Virtual Size

411KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

272KB

Virtual Size

271KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4d6c8b3430ecbea0db0922efbfd5aba88a64266de5a04e5a9ee6f0fe669298d3.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic