5874159ac61ab0349f29c8336c6d31d27c4df181318942ace320f4a6c6d24abe[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
5874159ac61ab0349f29c8336c6d31d27c4df181318942ace320f4a6c6d24abe.exe
Size 412KB
Sample241112-mb16ls1apf
SHA256 5874159ac61ab0349f29c8336c6d31d27c4df181318942ace320f4a6c6d24abe
MD5 2ca25d8c48231f5dc1b93c200984c499
SHA1 bfdef5b2854f247ab34667a59f53569da675091c
SHA512 74796b8c114d6b9c389c7a6ebcf33b3fe70e86cacb1387e7524ef3d5f4eab5d6addaac147bf5f8587f7fca8ad0bc2fc81b06eebfdee70127817d0b4ef7009415
SSDEEP 12288:544eTv4x7KjMD8Jn+J270YXiYoaRq6W+oKAH:544eTv4x7KjMD85kYoaRs+Z
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5874159ac61ab0349f29c8336c6d31d27c4df181318942ace320f4a6c6d24abe.exe

File Explorer

5874159ac61ab0349f29c8336c6d31d27c4df181318942ace320f4a6c6d24abe.exe

.exe 412KB

5874159ac61ab0349f29c8336c6d31d27c4df181318942ace320f4a6c6d24abe.exe

IMPHASH f4b5d7b6054968e091e4510109e5ce64
SHA256 5874159ac61ab0349f29c8336c6d31d27c4df181318942ace320f4a6c6d24abe
MD5 2ca25d8c48231f5dc1b93c200984c499
SHA1 bfdef5b2854f247ab34667a59f53569da675091c
SHA512 74796b8c114d6b9c389c7a6ebcf33b3fe70e86cacb1387e7524ef3d5f4eab5d6addaac147bf5f8587f7fca8ad0bc2fc81b06eebfdee70127817d0b4ef7009415
SSDEEP 12288:544eTv4x7KjMD8Jn+J270YXiYoaRq6W+oKAH:544eTv4x7KjMD85kYoaRs+Z
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

148828

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLastError CloseHandle MoveFileW FindFirstFileExW FindNextFileW lstrlenA FindClose Sleep lstrcmpW GetVolumeInformationW GetLocalTime GetCommandLineW GetModuleFileNameW GetTempPathW ExitProcess WriteConsoleW HeapSize CreateFileW ReadConsoleW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW WideCharToMultiByte FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile HeapAlloc HeapFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile HeapReAlloc IsValidCodePage GetACP SetEndOfFile

user32

wsprintfA wsprintfW

shell32

ShellExecuteW CommandLineToArgvW

shlwapi

StrStrIW

ws2_32

htons WSAGetLastError

Name

.text

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5874159ac61ab0349f29c8336c6d31d27c4df181318942ace320f4a6c6d24abe.exe

kernel32

user32

shell32

shlwapi

ws2_32

generic