9da16029ca146747c75c0233fa5c2d81554edc547883a3936271369b564faeba

General

Target
9da16029ca146747c75c0233fa5c2d81554edc547883a3936271369b564faeba
Size 446KB
Sample241111-kcrmfsvrft
SHA256 9da16029ca146747c75c0233fa5c2d81554edc547883a3936271369b564faeba
MD5 c5239c95537127d5357ea8952376bc38
SHA1 6c11582f1e8ef0e6bdc0274e70f882849284b009
SHA512 463e0dae31a933267934a67afaa24b79258112b4856e7fd517afd4090fc80f1aa9d5f2070db9a68f4c55660d9a27d228dcef5fbf9dc3bb1e63cb53ae2ff37602
SSDEEP 12288:S8ejRy6JaJelQM6uGOKMaWxHJpizjWs4M:XqYes3MxxHJpR7M
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9da16029ca146747c75c0233fa5c2d81554edc547883a3936271369b564faeba

File Explorer

9da16029ca146747c75c0233fa5c2d81554edc547883a3936271369b564faeba

.exe 446KB

9da16029ca146747c75c0233fa5c2d81554edc547883a3936271369b564faeba

IMPHASH 311650a1714368ee828d4a890d9baf3c
SHA256 9da16029ca146747c75c0233fa5c2d81554edc547883a3936271369b564faeba
MD5 c5239c95537127d5357ea8952376bc38
SHA1 6c11582f1e8ef0e6bdc0274e70f882849284b009
SHA512 463e0dae31a933267934a67afaa24b79258112b4856e7fd517afd4090fc80f1aa9d5f2070db9a68f4c55660d9a27d228dcef5fbf9dc3bb1e63cb53ae2ff37602
SSDEEP 12288:S8ejRy6JaJelQM6uGOKMaWxHJpizjWs4M:XqYes3MxxHJpR7M
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

226736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\gotenuyed4.pdb

kernel32

FindFirstVolumeA WaitForSingleObject GetNamedPipeHandleStateA CreateNamedPipeW CallNamedPipeA TerminateThread FatalExit GetVersionExA GetConsoleAliasesLengthA SetConsoleCP VerifyVersionInfoA VerLanguageNameA FindFirstFileExA FreeEnvironmentStringsW GetProcessPriorityBoost SetVolumeMountPointA GetLongPathNameW CopyFileW TlsSetValue VerifyVersionInfoW GetConsoleCursorInfo TzSpecificLocalTimeToSystemTime GetProcessShutdownParameters ReleaseSemaphore BuildCommDCBAndTimeoutsA GetProcAddress GetModuleHandleA GlobalAlloc SleepEx TlsGetValue MoveFileW GetCommandLineW InterlockedExchange DeleteFileA CreateActCtxW SetFileAttributesA GetPrivateProfileIntW HeapValidate GetProcessHeaps CreateNamedPipeA WriteConsoleOutputW GetStartupInfoA GetDiskFreeSpaceExW GetCPInfoExW GetWindowsDirectoryW GetSystemWow64DirectoryA SetLastError GetProfileStringW GetCalendarInfoA GetTickCount GetSystemTime DebugBreak FindFirstFileA WriteFileGather ReadFile GetNumberOfConsoleMouseButtons GetSystemWow64DirectoryW TerminateProcess lstrcatW CreateActCtxA InterlockedPopEntrySList SetCriticalSectionSpinCount DefineDosDeviceA WriteConsoleW InterlockedDecrement HeapWalk SetErrorMode PeekConsoleInputW GetNumberFormatW GetQueuedCompletionStatus FreeEnvironmentStringsA SetLocalTime FindResourceExW CreateSemaphoreW GetThreadLocale SetFileShortNameA lstrcpyW ReplaceFileW LockFile MoveFileExW GetConsoleCP GetVolumePathNameW SetConsoleScreenBufferSize FreeConsole GetConsoleAliasExesLengthW WriteConsoleInputW LocalShrink SetCommState SetSystemTimeAdjustment EnumSystemLocalesW GetNumaHighestNodeNumber SetEndOfFile ChangeTimerQueueTimer GetWriteWatch RaiseException OpenSemaphoreW GetLargestConsoleWindowSize ClearCommError ReleaseActCtx GetLastError GetComputerNameW OpenMutexA GetStringTypeA VirtualUnlock SetWaitableTimer CreateTimerQueueTimer GetProcessTimes IsBadWritePtr FatalAppExitA lstrcpynW SetNamedPipeHandleState FillConsoleOutputCharacterW GetCompressedFileSizeW FindNextVolumeMountPointW GetFullPathNameA WriteProfileStringA LockFileEx LeaveCriticalSection SetCurrentDirectoryA GlobalAddAtomW ReadFileEx EncodePointer DecodePointer HeapSetInformation GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW IsBadReadPtr IsProcessorFeaturePresent TlsAlloc GetCurrentThreadId TlsFree GetModuleHandleW InterlockedIncrement ExitProcess WriteFile GetStdHandle EnterCriticalSection SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW HeapCreate SetFilePointer WideCharToMultiByte GetConsoleMode OutputDebugStringA OutputDebugStringW LoadLibraryW MultiByteToWideChar GetACP GetOEMCP GetCPInfo IsValidCodePage HeapAlloc GetModuleFileNameA HeapReAlloc HeapSize HeapQueryInformation HeapFree RtlUnwind SetStdHandle GetStringTypeW LCMapStringW FlushFileBuffers CreateFileW CloseHandle

user32

OemToCharA GetAltTabInfoA

Sharing

General

Malware Config

Signatures

File Explorer

9da16029ca146747c75c0233fa5c2d81554edc547883a3936271369b564faeba

kernel32

user32

generic