497859eed941e073a43e8291908e6494[.]exe

General

Target
497859eed941e073a43e8291908e6494.exe
Size 290KB
Sample241013-sdwa2axbrk
SHA256 8484619768f32fb9368cc46bc15a16cf99c98e95a2a605068adf5dd71090e0c7
MD5 497859eed941e073a43e8291908e6494
SHA1 8136e8e148deeb6c9d18f8300f47e7b3a43b4290
SHA512 5e5af6d5d1802aad3160e8a139134c5cc39d6d3b10ae0acbe686a1fef9944d36cba20081781abfead68f3b6e37de4182178fa293c16b6994473a6d869c9d7a06
SSDEEP 3072:ohQBX24upVVQN58sfUAJ5IpCyxF9DavUjZXFUCIqzpZAqa8i:oqFseN58u8/4OXFVIqzpZAqaR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
497859eed941e073a43e8291908e6494.exe

File Explorer

497859eed941e073a43e8291908e6494.exe

.exe 290KB

497859eed941e073a43e8291908e6494.exe

IMPHASH 67def8961050d10da5ff74312b7f0aec
SHA256 8484619768f32fb9368cc46bc15a16cf99c98e95a2a605068adf5dd71090e0c7
MD5 497859eed941e073a43e8291908e6494
SHA1 8136e8e148deeb6c9d18f8300f47e7b3a43b4290
SHA512 5e5af6d5d1802aad3160e8a139134c5cc39d6d3b10ae0acbe686a1fef9944d36cba20081781abfead68f3b6e37de4182178fa293c16b6994473a6d869c9d7a06
SSDEEP 3072:ohQBX24upVVQN58sfUAJ5IpCyxF9DavUjZXFUCIqzpZAqa8i:oqFseN58u8/4OXFVIqzpZAqaR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6372

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenJobObjectA ReadConsoleA InterlockedDecrement GlobalSize SetDefaultCommConfigW QueryDosDeviceA InterlockedCompareExchange GetComputerNameW SetEvent GetNumaAvailableMemoryNode FreeEnvironmentStringsA GetModuleHandleW GetConsoleAliasesLengthA SetCommState GetConsoleWindow ReadConsoleOutputW GetVersionExW GetStringTypeExW HeapDestroy GetFileAttributesA GetTimeFormatW DeleteVolumeMountPointA GetFileAttributesW GetBinaryTypeA DisconnectNamedPipe LCMapStringA GetLastError GetProcAddress MoveFileW SetStdHandle GetNumaHighestNodeNumber LoadLibraryA LocalAlloc WritePrivateProfileStringA GetModuleFileNameA BuildCommDCBA FatalAppExitA GetShortPathNameW SetCalendarInfoA FindAtomW SearchPathW GetConsoleAliasExesLengthA SetConsoleMode PulseEvent HeapAlloc MultiByteToWideChar Sleep ExitProcess GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate WriteFile GetStdHandle GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InitializeCriticalSectionAndSpinCount GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

gdi32

GetBoundsRect

advapi32

ClearEventLogW

Name

.text

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

39.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kibojis

Size

14KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xeto

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

497859eed941e073a43e8291908e6494.exe

kernel32

gdi32

advapi32

generic