aa5ed52014f48ee405a6c6fa896be6d13b4f054b1e7979bc633d33fcd5812657[.]exe

General

Target
aa5ed52014f48ee405a6c6fa896be6d13b4f054b1e7979bc633d33fcd5812657.exe
Size 366KB
Sample241113-vl491swbqf
SHA256 aa5ed52014f48ee405a6c6fa896be6d13b4f054b1e7979bc633d33fcd5812657
MD5 3bb74bfb033e682aa4b36bfb997a4542
SHA1 87f877000e512fd1d37f5cc60c55c376ad7cb102
SHA512 d1c480d46dc31dee5801192353bdbeb947ac183b2b82033860412ae261d416fd2813f7a55aee49b515f0d9f81d2d657ba5291c2b6ae284de5656f1885688a41a
SSDEEP 6144:l4pN9j6K8vLXGnjNUv+g6O/BO3W38Dw+N9IBIfNvc:l6j69WjNKOmqsafNk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa5ed52014f48ee405a6c6fa896be6d13b4f054b1e7979bc633d33fcd5812657.exe

File Explorer

aa5ed52014f48ee405a6c6fa896be6d13b4f054b1e7979bc633d33fcd5812657.exe

.exe 366KB

aa5ed52014f48ee405a6c6fa896be6d13b4f054b1e7979bc633d33fcd5812657.exe

IMPHASH 3b1217408d4bba412a22718d3068dd73
SHA256 aa5ed52014f48ee405a6c6fa896be6d13b4f054b1e7979bc633d33fcd5812657
MD5 3bb74bfb033e682aa4b36bfb997a4542
SHA1 87f877000e512fd1d37f5cc60c55c376ad7cb102
SHA512 d1c480d46dc31dee5801192353bdbeb947ac183b2b82033860412ae261d416fd2813f7a55aee49b515f0d9f81d2d657ba5291c2b6ae284de5656f1885688a41a
SSDEEP 6144:l4pN9j6K8vLXGnjNUv+g6O/BO3W38Dw+N9IBIfNvc:l6j69WjNKOmqsafNk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

18989

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bulo\xaf\nagosecopo.pdb

kernel32

QueryDosDeviceA WaitForSingleObject AddConsoleAliasW GetComputerNameW BackupSeek _lclose GetModuleHandleW EnumCalendarInfoExW GetConsoleAliasesA GetConsoleTitleA ReadConsoleW GetWindowsDirectoryA GetConsoleAliasExesW EnumTimeFormatsW SetProcessPriorityBoost FindResourceExA GetCalendarInfoA GetSystemWindowsDirectoryA FindNextVolumeW WriteConsoleW GetModuleFileNameW GetConsoleFontSize lstrlenW IsBadStringPtrA GlobalUnlock GetCPInfoExW GetLastError SetLastError GetProcAddress VirtualAlloc GetConsoleAliasA BeginUpdateResourceW WriteProfileSectionA RemoveDirectoryA SetComputerNameA _hwrite SetThreadPriorityBoost LoadLibraryA InterlockedExchangeAdd LocalAlloc WritePrivateProfileStringA GetNumberFormatW AddAtomW GetDiskFreeSpaceA EnumResourceTypesW GetOEMCP GetDefaultCommConfigA SetConsoleCursorInfo GetConsoleTitleW VirtualProtect GetShortPathNameW FindAtomW FileTimeToLocalFileTime DeleteTimerQueueTimer SuspendThread GetModuleHandleA EnumResourceNamesW ReadConsoleA lstrlenA FindResourceA HeapSize MultiByteToWideChar GetCommandLineA GetStartupInfoA HeapAlloc HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId Sleep ExitProcess SetUnhandledExceptionFilter WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent LeaveCriticalSection EnterCriticalSection HeapReAlloc LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA InitializeCriticalSectionAndSpinCount

user32

GetWindowLongW GetSysColorBrush SetCaretPos CharLowerBuffW

gdi32

GetCharWidthW CreateHalftonePalette GetCharABCWidthsW

advapi32

CloseEventLog

Sharing