95dc085b0fea4a8d80df11ba1409a2df89ca97d980ba3dcf8e90d31e9d3fd533[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
95dc085b0fea4a8d80df11ba1409a2df89ca97d980ba3dcf8e90d31e9d3fd533.exe
Size 655KB
Sample241021-kbvbyswgnf
SHA256 95dc085b0fea4a8d80df11ba1409a2df89ca97d980ba3dcf8e90d31e9d3fd533
MD5 80ab98c10c23b7281a2bf1489fc98c0d
SHA1 1876e829b675e86e950f2e701ab9b2c4a56b4817
SHA512 efbd50cf0ba6354e4152b5156d9a99a374bbcb22b3a872ea609cd8938a91286d0d31e1270f4c730869ac870c8af2cdf5be7aa3d7a92cb0aed9257797da9dd886
SSDEEP 12288:MDthpRVihEcZZa1ANKMrIU9+/EcgKhLNeV7oTAv9IOe:MZ2hEcZY1ANKIIUU5RAV7Bl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95dc085b0fea4a8d80df11ba1409a2df89ca97d980ba3dcf8e90d31e9d3fd533.exe

File Explorer

95dc085b0fea4a8d80df11ba1409a2df89ca97d980ba3dcf8e90d31e9d3fd533.exe

.dll 655KB

95dc085b0fea4a8d80df11ba1409a2df89ca97d980ba3dcf8e90d31e9d3fd533.exe

IMPHASH c2942567fb2d15268ea07360ae967ced
SHA256 95dc085b0fea4a8d80df11ba1409a2df89ca97d980ba3dcf8e90d31e9d3fd533
MD5 80ab98c10c23b7281a2bf1489fc98c0d
SHA1 1876e829b675e86e950f2e701ab9b2c4a56b4817
SHA512 efbd50cf0ba6354e4152b5156d9a99a374bbcb22b3a872ea609cd8938a91286d0d31e1270f4c730869ac870c8af2cdf5be7aa3d7a92cb0aed9257797da9dd886
SSDEEP 12288:MDthpRVihEcZZa1ANKMrIU9+/EcgKhLNeV7oTAv9IOe:MZ2hEcZY1ANKIIUU5RAV7Bl
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

233876

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

comctl32

InitCommonControlsEx

comdlg32

ChooseColorW

shlwapi

PathCanonicalizeW PathIsDirectoryW PathRemoveFileSpecA PathCombineW PathRemoveFileSpecW PathFindExtensionW PathRemoveExtensionW PathIsRootW PathAppendW PathFindFileNameW PathFileExistsW

shell32

ShellExecuteW

gdi32

CreateCompatibleBitmap CreateCompatibleDC SetPixel StretchBlt DeleteDC Rectangle GetDeviceCaps SetBkMode LineTo CreatePen MoveToEx CreateFontIndirectW SetBkColor GetObjectW SetTextColor GetStockObject SelectObject CreateSolidBrush DeleteObject

msimg32

AlphaBlend

kernel32

SetFilePointerEx SetStdHandle FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode HeapSize SetEndOfFile GetProcessHeap GetModuleHandleW LoadLibraryExA GetModuleHandleA OpenProcess GetProcAddress GetCurrentProcessId FreeLibrary CreateDirectoryW WritePrivateProfileStringW GetPrivateProfileIntW GetPrivateProfileStringW ReadFile GetTempPathW LocalAlloc CreateFileW SetFileAttributesW Sleep CreateFileA DeleteFileW CloseHandle CreateThread GlobalLock GetFileSize CopyFileW WideCharToMultiByte GetTickCount GlobalUnlock MulDiv MultiByteToWideChar GetModuleFileNameW GetFileAttributesW LoadLibraryW SizeofResource FormatMessageW ReadConsoleW GlobalAlloc GlobalFree LoadResource FindResourceW LocalFree GetModuleHandleExW WaitForSingleObject GetCurrentThreadId CreateEventW SetEvent ResetEvent FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapReAlloc GetFileType GetStdHandle HeapAlloc HeapFree ExitProcess LoadLibraryExW InterlockedFlushSList RaiseException RtlPcToFileHeader RtlUnwindEx TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo DecodePointer EncodePointer GetStringTypeW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LockResource WriteConsoleW GetLastError

user32

SetWindowsHookExW LoadCursorW UnhookWindowsHookEx DispatchMessageW RegisterClassExW UnregisterClassW CallNextHookEx PostMessageW AdjustWindowRectEx DefWindowProcW GetMessageW GetSysColorBrush GetCapture SetCapture SetScrollPos ReleaseCapture CharLowerW IsCharAlphaNumericW GetMenuState GetDC GetSystemMetrics DestroyCursor OpenClipboard DestroyIcon CloseClipboard GetClipboardData DrawMenuBar FlashWindowEx EnableMenuItem LoadImageW SendInput MessageBoxW SetTimer SetWindowTextW MessageBoxA SetForegroundWindow GetDlgItemInt SetDlgItemInt EnableWindow CreateDialogParamW FrameRect SendDlgItemMessageW GetWindowRect GetFocus DestroyWindow InflateRect IsWindowVisible SetWindowPos FillRect SendMessageW ShowWindow RedrawWindow DrawFocusRect MoveWindow GetWindowDC ReleaseDC EndDialog SetDlgItemTextW GetDlgItem DialogBoxParamW CallWindowProcW SetWindowLongPtrW GetWindowLongPtrW CreateCursor GetSysColor SetCursor GetClientRect DrawTextW UpdateWindow InvalidateRect BeginPaint EndPaint GetWindowTextW ClientToScreen CreateDialogIndirectParamW PostQuitMessage GetParent EnumChildWindows GetClassNameW GetMenuItemInfoA SetScrollInfo ShowScrollBar CreateWindowExW SetFocus GetScrollPos KillTimer

advapi32

SetServiceStatus RegisterServiceCtrlHandlerW

Name

.text

Size

364KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

95dc085b0fea4a8d80df11ba1409a2df89ca97d980ba3dcf8e90d31e9d3fd533.exe

comctl32

comdlg32

shlwapi

shell32

gdi32

msimg32

kernel32

user32

advapi32

generic