40c8a5369b14d0967fff9cd5ad43f758[.]exe

General

Target
40c8a5369b14d0967fff9cd5ad43f758.exe
Size 241KB
Sample241014-ya8d3ssema
SHA256 75710e4a218440b1e9e330f231cfca45d5f7c41eacf9a7bd45bfd06042b79eac
MD5 40c8a5369b14d0967fff9cd5ad43f758
SHA1 607dfb9f8f4c2f2168eaf7288af3c5058c2f6c70
SHA512 089b1b01848077113c869283519590c52052adae6032c1a0d83679cc18812a195118f1483f43e93041abe3fa8fca49d0e4b87bc29419feb66de6be1be600162a
SSDEEP 3072:BMvqlvkg73D2hiv0TetiP53qJzxB9qus7PuGPPEMCGbXal/T:qvqlv77T1QbqpxB9quKuGPPtn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40c8a5369b14d0967fff9cd5ad43f758.exe

File Explorer

40c8a5369b14d0967fff9cd5ad43f758.exe

.exe 241KB

40c8a5369b14d0967fff9cd5ad43f758.exe

IMPHASH 9ccb2525dd90a985cad2111bfde8ce86
SHA256 75710e4a218440b1e9e330f231cfca45d5f7c41eacf9a7bd45bfd06042b79eac
MD5 40c8a5369b14d0967fff9cd5ad43f758
SHA1 607dfb9f8f4c2f2168eaf7288af3c5058c2f6c70
SHA512 089b1b01848077113c869283519590c52052adae6032c1a0d83679cc18812a195118f1483f43e93041abe3fa8fca49d0e4b87bc29419feb66de6be1be600162a
SSDEEP 3072:BMvqlvkg73D2hiv0TetiP53qJzxB9qus7PuGPPEMCGbXal/T:qvqlv77T1QbqpxB9quKuGPPtn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement GlobalSize SetDefaultCommConfigW QueryDosDeviceA GetComputerNameW GetNumaAvailableMemoryNode FreeEnvironmentStringsA GetModuleHandleW GetConsoleAliasesLengthA SetCommState GetConsoleWindow ReadConsoleOutputW GetStringTypeExW HeapDestroy GetFileAttributesW GetModuleFileNameW GetConsoleFontSize WritePrivateProfileStringW DisconnectNamedPipe ReadConsoleA GetLastError GetProcAddress SetStdHandle BuildCommDCBW LoadLibraryA InterlockedExchangeAdd LocalAlloc SetCalendarInfoW MoveFileA OpenJobObjectW FreeEnvironmentStringsW FatalAppExitA DeleteCriticalSection GetShortPathNameW GetVersionExA FindAtomW OpenFileMappingA GetNumaProcessorNode DeleteVolumeMountPointA LCMapStringA SearchPathW HeapAlloc MultiByteToWideChar Sleep ExitProcess GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LeaveCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW CloseHandle CreateFileA

gdi32

GetBoundsRect

advapi32

CloseEventLog

Name

.text

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

39.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tizo

Size

14KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sisaw

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

40c8a5369b14d0967fff9cd5ad43f758.exe

kernel32

gdi32

advapi32

generic