7956e2d51bea103dc7bf9d16c75efea50996701639432fc8f347ff9a2918799f[.]exe

General

Target
7956e2d51bea103dc7bf9d16c75efea50996701639432fc8f347ff9a2918799f.exe
Size 358KB
Sample241114-jtkd2awckg
SHA256 7956e2d51bea103dc7bf9d16c75efea50996701639432fc8f347ff9a2918799f
MD5 9284b582aac8c76f5e3fde3f12b88c97
SHA1 44cb623cb8768e38a6fea4c598b626b84f293f0a
SHA512 d94ae2cde04f417daf0e6526d6dc1ada0a777145a83bf33c89363ce0fe1693115031425a161e23aaa9cbb548e868540aecd169ee93a676e6c9d6e6cc7bbe6cb4
SSDEEP 6144:HeTsmbZ23oVC3L+C8tGap9hKa5nLnGGhuDh:HwbZM+C8Qap90a4kIh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7956e2d51bea103dc7bf9d16c75efea50996701639432fc8f347ff9a2918799f.exe

File Explorer

7956e2d51bea103dc7bf9d16c75efea50996701639432fc8f347ff9a2918799f.exe

.dll 358KB

7956e2d51bea103dc7bf9d16c75efea50996701639432fc8f347ff9a2918799f.exe

IMPHASH 2256ad4cc93aef9a2bae2ad9459e91eb
SHA256 7956e2d51bea103dc7bf9d16c75efea50996701639432fc8f347ff9a2918799f
MD5 9284b582aac8c76f5e3fde3f12b88c97
SHA1 44cb623cb8768e38a6fea4c598b626b84f293f0a
SHA512 d94ae2cde04f417daf0e6526d6dc1ada0a777145a83bf33c89363ce0fe1693115031425a161e23aaa9cbb548e868540aecd169ee93a676e6c9d6e6cc7bbe6cb4
SSDEEP 6144:HeTsmbZ23oVC3L+C8tGap9hKa5nLnGGhuDh:HwbZM+C8Qap90a4kIh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

471040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\cvcctest\15.33_build_vromanov\trunk\2013_r1\build\Win32\devices\cpu_device\Release\cpu_device32.pdb

kernel32

GetModuleFileNameA GetProcessHeap LoadLibraryExA FreeLibrary GetProcAddress GlobalMemoryStatusEx QueryPerformanceFrequency QueryPerformanceCounter GetCurrentProcessId GetModuleHandleExA GetSystemInfo GetNumaHighestNodeNumber SleepEx CloseHandle OpenThread SetThreadAffinityMask GetCurrentThread GetCurrentThreadId InitializeCriticalSectionAndSpinCount DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventA SetEvent WaitForSingleObject InterlockedCompareExchange InterlockedIncrement InterlockedExchangeAdd InterlockedDecrement GetLastError SwitchToThread InitializeCriticalSection lstrcmpA GetEnvironmentVariableA lstrcpynA LoadLibraryA GetModuleHandleW VirtualQuery TlsSetValue TlsGetValue WideCharToMultiByte UnmapViewOfFile ReleaseMutex MapViewOfFile OpenFileMappingW OpenMutexW TlsFree TlsAlloc LocalAlloc RaiseException GetStringTypeW MultiByteToWideChar Sleep EncodePointer DecodePointer RtlUnwind HeapFree HeapAlloc GetCommandLineA ExitThread CreateThread HeapReAlloc LCMapStringW GetCPInfo IsProcessorFeaturePresent WriteFile GetStdHandle GetModuleFileNameW GetLocaleInfoW SetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy ExitProcess HeapSize GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoW FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale LoadLibraryW CompareStringW SetEnvironmentVariableA WriteConsoleW SetStdHandle SetEnvironmentVariableW CreateFileA CreateFileW SetEndOfFile InterlockedExchange

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

Name

.text

Size

213KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

277B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rmnet

Size

56KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

7956e2d51bea103dc7bf9d16c75efea50996701639432fc8f347ff9a2918799f.exe

kernel32

version

advapi32

generic