ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef[.]exe

General

Target
ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe
Size 1.4MB
Sample241023-g8hsmswalb
SHA256 ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef
MD5 82eecea4083e39c33733428c2d845b15
SHA1 02cfb61e8cb6242890cf58e25c26136d4ce46709
SHA512 4528e6033ea1cf4a0de232d3ec74bffead24d17dd2d4a2ceac4f73f2e2b94babd53e14bc9eca5661c41f4692b730d9096f5255936c19de7b2671bf8f226899df
SSDEEP 24576:Yr3uXCxRUKRErpNT3ixen3EyJvRvEx+aFwGSMn/FQiG654Sr:Yreyx7ErOe3XvRvRayM/FU+4s
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe

File Explorer

ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe

.exe 1.4MB

ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe

IMPHASH be8c12fdcf1a063957352e3396e671e5
SHA256 ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef
MD5 82eecea4083e39c33733428c2d845b15
SHA1 02cfb61e8cb6242890cf58e25c26136d4ce46709
SHA512 4528e6033ea1cf4a0de232d3ec74bffead24d17dd2d4a2ceac4f73f2e2b94babd53e14bc9eca5661c41f4692b730d9096f5255936c19de7b2671bf8f226899df
SSDEEP 24576:Yr3uXCxRUKRErpNT3ixen3EyJvRvEx+aFwGSMn/FQiG654Sr:Yreyx7ErOe3XvRvRayM/FU+4s
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

35196

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Sleep WideCharToMultiByte Process32NextW Process32FirstW GetExitCodeProcess WriteConsoleW CreateFileW HeapSize SetStdHandle GetProcessHeap EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW DeleteFileW GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind

ntdll

RtlInitUnicodeString LdrLoadDll NtOpenProcess NtQueryInformationProcess

Sharing