14b7b45f0d7157b45b21ef9c697168f3[.]exe

General

Target
14b7b45f0d7157b45b21ef9c697168f3.exe
Size 239KB
Sample241014-rvqanszcmd
SHA256 5d2e0f8cc9eb2b09f11c0e90303eafd9bf4593426cdc0bc649e074a1ad913247
MD5 14b7b45f0d7157b45b21ef9c697168f3
SHA1 4421135a6d899a7046f47ca0e54c93db967140f3
SHA512 ab26ea87435d02797950bad1776b16a6eb64c5fad0a6d217dc2f36df75175b96b1e3278d957608ec67f195a69d07ebf656f1d13ad458121bec8729436303094b
SSDEEP 3072:mQgHmeyZzmrIgfXbKuRltiP5JqJzxB9qUn0PuGPPEMCGbXa+/T:YHm/ErIgjbqqpxB9qUn2uGPPtn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14b7b45f0d7157b45b21ef9c697168f3.exe

File Explorer

14b7b45f0d7157b45b21ef9c697168f3.exe

.exe 239KB

14b7b45f0d7157b45b21ef9c697168f3.exe

IMPHASH 9ccb2525dd90a985cad2111bfde8ce86
SHA256 5d2e0f8cc9eb2b09f11c0e90303eafd9bf4593426cdc0bc649e074a1ad913247
MD5 14b7b45f0d7157b45b21ef9c697168f3
SHA1 4421135a6d899a7046f47ca0e54c93db967140f3
SHA512 ab26ea87435d02797950bad1776b16a6eb64c5fad0a6d217dc2f36df75175b96b1e3278d957608ec67f195a69d07ebf656f1d13ad458121bec8729436303094b
SSDEEP 3072:mQgHmeyZzmrIgfXbKuRltiP5JqJzxB9qUn0PuGPPEMCGbXa+/T:YHm/ErIgjbqqpxB9qUn2uGPPtn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement GlobalSize SetDefaultCommConfigW QueryDosDeviceA GetComputerNameW GetNumaAvailableMemoryNode FreeEnvironmentStringsA GetModuleHandleW GetConsoleAliasesLengthA SetCommState GetConsoleWindow ReadConsoleOutputW GetStringTypeExW HeapDestroy GetFileAttributesW GetModuleFileNameW GetConsoleFontSize WritePrivateProfileStringW DisconnectNamedPipe ReadConsoleA GetLastError GetProcAddress SetStdHandle BuildCommDCBW LoadLibraryA InterlockedExchangeAdd LocalAlloc SetCalendarInfoW MoveFileA OpenJobObjectW FreeEnvironmentStringsW FatalAppExitA DeleteCriticalSection GetShortPathNameW GetVersionExA FindAtomW OpenFileMappingA GetNumaProcessorNode DeleteVolumeMountPointA LCMapStringA SearchPathW HeapAlloc MultiByteToWideChar Sleep ExitProcess GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LeaveCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW CloseHandle CreateFileA

gdi32

GetBoundsRect

advapi32

CloseEventLog

Name

.text

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

39.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.figi

Size

14KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gimohoz

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

14b7b45f0d7157b45b21ef9c697168f3.exe

kernel32

gdi32

advapi32

generic