44f40b79a12c1665987fe0d6158731d79e7ec9662dd7b30b9e0c63a2c56667ec[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
44f40b79a12c1665987fe0d6158731d79e7ec9662dd7b30b9e0c63a2c56667ec.exe
Size 936KB
Sample241114-ctkw8stblc
SHA256 44f40b79a12c1665987fe0d6158731d79e7ec9662dd7b30b9e0c63a2c56667ec
MD5 d996db1d2481bb287b2adb466beba234
SHA1 6d84750e42c242ab2461c673ac8b2ca2d766ca41
SHA512 da537e6e0a62510e17748dd23e17d3c18af22eb133e56c52f7f82ca553e99b8a057b519b462cf19a2ea95e72e4fb700e2d5222feb976af47bdd7fce3c8539f14
SSDEEP 24576:cWZTxUOmOdajOpFBvvgLn+xHjO9ZJUfYrrW:cwvgb+xHjO9Zlr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44f40b79a12c1665987fe0d6158731d79e7ec9662dd7b30b9e0c63a2c56667ec.exe

File Explorer

44f40b79a12c1665987fe0d6158731d79e7ec9662dd7b30b9e0c63a2c56667ec.exe

.exe 936KB

44f40b79a12c1665987fe0d6158731d79e7ec9662dd7b30b9e0c63a2c56667ec.exe

IMPHASH 54047facc5e73f904435ab194951fc26
SHA256 44f40b79a12c1665987fe0d6158731d79e7ec9662dd7b30b9e0c63a2c56667ec
MD5 d996db1d2481bb287b2adb466beba234
SHA1 6d84750e42c242ab2461c673ac8b2ca2d766ca41
SHA512 da537e6e0a62510e17748dd23e17d3c18af22eb133e56c52f7f82ca553e99b8a057b519b462cf19a2ea95e72e4fb700e2d5222feb976af47bdd7fce3c8539f14
SSDEEP 24576:cWZTxUOmOdajOpFBvvgLn+xHjO9ZJUfYrrW:cwvgb+xHjO9Zlr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RevertToSelf SetThreadToken

kernel32

CloseHandle CreateFileA CreateFileMappingA CreateProcessA DeleteCriticalSection EnterCriticalSection FreeLibrary GetCommandLineA GetCurrentProcess GetLastError GetLocalTime GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetThreadId HeapAlloc HeapFree InitializeConditionVariable InitializeCriticalSection IsDBCSLeadByteEx K32EnumProcessModules K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryW MapViewOfFile MultiByteToWideChar OpenProcess RaiseException ReadProcessMemory RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _exit _fmode _initterm _lock _onexit _read _stricmp _strnicmp _time64 _unlock abort calloc exit fprintf fputc fputs free fwrite getenv iswctype localeconv malloc memchr memcmp memcpy memmove memset rand realloc setlocale signal srand strchr strcmp strcoll strcpy strerror strftime strlen strncmp strncpy strtoul strxfrm towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

ntdll

NtProtectVirtualMemory NtWriteVirtualMemory

shell32

CommandLineToArgvW

shlwapi

PathRemoveFileSpecA StrStrIA

user32

wsprintfW wvsprintfW

Name

.text

Size

772KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

44f40b79a12c1665987fe0d6158731d79e7ec9662dd7b30b9e0c63a2c56667ec.exe

advapi32

kernel32

msvcrt

ntdll

shell32

shlwapi

user32

generic