ffe7b7a94481baf07af71357c2eb9fe4da46168b4e050e649ab5a7fe8631568a[.]exe

General

Target
ffe7b7a94481baf07af71357c2eb9fe4da46168b4e050e649ab5a7fe8631568a.exe
Size 2.5MB
Sample241115-drdktayalg
SHA256 ffe7b7a94481baf07af71357c2eb9fe4da46168b4e050e649ab5a7fe8631568a
MD5 cd51c014cb51d3af57ce68fe283b3714
SHA1 c3245fc97924424c91a3e36a7df5833ec5b46046
SHA512 da1548c461d6ed5f079c1335d7fa90a9f4401f115bb25fa210b299366e52968ff7fd448947f32b19cf57f8d034f7842fbc3fe8a51cb03dec4c2a23879df0ff61
SSDEEP 24576:MoEKQByjnqh0lhSMXl6OztcajVoYPLtTPyAAewGLP23WaHK5TsjOxkmENDcv8oPc:jLzjnKOzLjVoYZPRAZGyBq58OdcDo
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffe7b7a94481baf07af71357c2eb9fe4da46168b4e050e649ab5a7fe8631568a.exe

File Explorer

ffe7b7a94481baf07af71357c2eb9fe4da46168b4e050e649ab5a7fe8631568a.exe

.exe 2.5MB

ffe7b7a94481baf07af71357c2eb9fe4da46168b4e050e649ab5a7fe8631568a.exe

IMPHASH 06e3eec5fa7862a0cf11cfb70dc048e6
SHA256 ffe7b7a94481baf07af71357c2eb9fe4da46168b4e050e649ab5a7fe8631568a
MD5 cd51c014cb51d3af57ce68fe283b3714
SHA1 c3245fc97924424c91a3e36a7df5833ec5b46046
SHA512 da1548c461d6ed5f079c1335d7fa90a9f4401f115bb25fa210b299366e52968ff7fd448947f32b19cf57f8d034f7842fbc3fe8a51cb03dec4c2a23879df0ff61
SSDEEP 24576:MoEKQByjnqh0lhSMXl6OztcajVoYPLtTPyAAewGLP23WaHK5TsjOxkmENDcv8oPc:jLzjnKOzLjVoYZPRAZGyBq58OdcDo
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

184560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlImageDirectoryEntryToData RtlLeaveCriticalSection RtlEnterCriticalSection RtlCompareMemory NtProtectVirtualMemory RtlImageNtHeader NtQueryVirtualMemory RtlGetNtVersionNumbers

kernel32

GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose VirtualFree VirtualAlloc GetModuleHandleW LoadLibraryA WriteFile CreateFileW CloseHandle GetProcAddress GetCurrentProcess VirtualQuery EnterCriticalSection GetModuleFileNameW LeaveCriticalSection MultiByteToWideChar ExitProcess WideCharToMultiByte GetLastError SetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent HeapAlloc HeapFree GetCurrentThreadId DeleteCriticalSection GetStdHandle GetFileType FreeEnvironmentStringsW RaiseException HeapReAlloc HeapSize GetProcessHeap FlsAlloc FlsGetValue FlsSetValue InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime FreeLibrary LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW GetModuleHandleExW SetFilePointerEx SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree DecodePointer GetStartupInfoW FlsFree InitializeCriticalSectionEx

user32

LoadAcceleratorsA LoadAcceleratorsW

advapi32

GetTokenInformation OpenProcessToken

Sharing