49e5f42166c761a549e7633dd5353954548c5c44a71457e2d8652264237c3cfdN[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
49e5f42166c761a549e7633dd5353954548c5c44a71457e2d8652264237c3cfdN.exe
Size 1.4MB
Sample241113-3eepsavkcp
SHA256 49e5f42166c761a549e7633dd5353954548c5c44a71457e2d8652264237c3cfd
MD5 3352bcb6f70129b0ff8afe5f8d0826e0
SHA1 59f06944ad50b2f9beba999a3c96f20f72c38aed
SHA512 7fe93e77be848b0332ee57c661911b45789d6b09087226e1d70f18aa360c870e2227e170d5c94ec5ae7250ca319ec31f1d509cc283388bba5ad84a58320e8a4f
SSDEEP 24576:CH3jH7beweUO2FUK6q09eefQMdsFC85Xga7Fu2b2GCQIS8YVMsi37:CXjH7beweJCUKIfBdsFCqga7Pb2FQIS7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49e5f42166c761a549e7633dd5353954548c5c44a71457e2d8652264237c3cfdN.exe

File Explorer

49e5f42166c761a549e7633dd5353954548c5c44a71457e2d8652264237c3cfdN.exe

.exe 1.4MB

49e5f42166c761a549e7633dd5353954548c5c44a71457e2d8652264237c3cfdN.exe

IMPHASH 6b8aacf742ed39ac7720a56e586fc3d9
SHA256 49e5f42166c761a549e7633dd5353954548c5c44a71457e2d8652264237c3cfd
MD5 3352bcb6f70129b0ff8afe5f8d0826e0
SHA1 59f06944ad50b2f9beba999a3c96f20f72c38aed
SHA512 7fe93e77be848b0332ee57c661911b45789d6b09087226e1d70f18aa360c870e2227e170d5c94ec5ae7250ca319ec31f1d509cc283388bba5ad84a58320e8a4f
SSDEEP 24576:CH3jH7beweUO2FUK6q09eefQMdsFC85Xga7Fu2b2GCQIS8YVMsi37:CXjH7beweJCUKIfBdsFCqga7Pb2FQIS7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualQuery __C_specific_handler AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventA CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreateMutexA CreateNamedPipeW CreateProcessW CreateSymbolicLinkW CreateThread CreateTimerQueue CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeleteTimerQueue DeviceIoControl DuplicateHandle ExitProcess FindClose FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetComputerNameExW GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathW GetTickCount64 GetVolumeInformationW GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW GlobalFree GlobalMemoryStatusEx HeapAlloc HeapCreate HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList K32GetPerformanceInfo LoadLibraryA LoadLibraryExA LocalFree MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadFileEx ReadProcessMemory RegisterWaitForSingleObject RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualProtect VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset realloc signal strlen strncmp vfprintf wcslen

ntdll

NtGetContextThread NtOpenThread NtSetContextThread NtClose NtCreateFile NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

advapi32

ConvertSidToStringSidW ConvertStringSidToSidW CopySid GetLengthSid GetTokenInformation IsValidSid LookupAccountSidW LsaClose OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

iphlpapi

FreeMibTable GetAdaptersAddresses GetIfEntry2 GetIfTable2

netapi32

NetApiBufferFree NetGroupEnum NetGroupGetInfo NetUserEnum NetUserGetInfo NetUserGetLocalGroups

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize PropVariantClear PropVariantCopy

oleaut32

GetErrorInfo SetErrorInfo SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantClear VariantCopy

pdh

PdhAddEnglishCounterA PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhCollectQueryDataEx PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

propsys

PropVariantCompareEx PropVariantToBSTR PropVariantToBoolean PropVariantToDouble PropVariantToInt16 PropVariantToInt32 PropVariantToInt64 PropVariantToUInt16 PropVariantToUInt32 PropVariantToUInt64 PropVariantToVariant VariantToBoolean VariantToDouble VariantToInt16 VariantToInt32 VariantToInt64 VariantToPropVariant VariantToUInt16 VariantToUInt32 VariantToUInt64

psapi

GetModuleFileNameExW

secur32

LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData

shell32

CommandLineToArgvW

user32

UnregisterPowerSettingNotification

userenv

GetUserProfileDirectoryW

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

Name

.text

Size

984KB

Virtual Size

984KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

284KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

49e5f42166c761a549e7633dd5353954548c5c44a71457e2d8652264237c3cfdN.exe

kernel32

msvcrt

ntdll

advapi32

bcrypt

iphlpapi

netapi32

ole32

oleaut32

pdh

powrprof

propsys

psapi

secur32

shell32

user32

userenv

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

generic