48a54970cdccf00607c155b16186d022376ef41eb8d27fedbf6e5073769d76dcN[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

48a54970cdccf00607c155b16186d022376ef41eb8d27fedbf6e5073769d76dcN.exe
Size

4.8MB
MD5

fcde558167c62d880fc27b00ad2fda70
SHA1

5fc660c8dc0f898164352f3810ed71b8c2759e1a
SHA256

48a54970cdccf00607c155b16186d022376ef41eb8d27fedbf6e5073769d76dc
SHA512

f4953f8e8514058339d6a8fe7d4843c286d1c0265a7cd4954821e83917bdac475e6362c46651ecb29d86c3c4bf2a1eb16c1932e0a1aa1a65403822d045667926
SSDEEP

49152:iA2QfOK2B4ErgDABNogo7A2QjOxA2QjOGA2QjORA2QjOF24vx6s/AY/MDETxaWaF:iBK+Lrg0g71x1G1R1Hvx6IF/M8aWzm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48a54970cdccf00607c155b16186d022376ef41eb8d27fedbf6e5073769d76dcN.exe

Files

48a54970cdccf00607c155b16186d022376ef41eb8d27fedbf6e5073769d76dcN.exe
.exe windows:10 windows x86 arch:x86

afb291654f85a34f0ec0dd79ffabc278

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

cleanmgr.pdb

Imports

gdi32

ExtTextOutW
GetLayout
SetBkMode
SetTextColor
SetBkColor
GetTextExtentPoint32W

user32

GetClientRect
SetDlgItemTextW
GetParent
SendDlgItemMessageW
SetWindowLongW
CreateDialogParamW
SendMessageW
ShowWindow
LoadStringW
EnumWindows
DispatchMessageW
TranslateMessage
SetForegroundWindow
IsDialogMessageW
GetMessageW
GetSystemMetrics
DestroyIcon
DestroyWindow
DialogBoxParamW
EndDialog
SetFocus
GetSysColor
DrawIconEx
MessageBoxW
DrawFocusRect
GetWindowTextW
PostMessageW
LoadIconW
EnableWindow
GetWindowLongW
GetDlgItem

msvcrt

memcpy_s
_wcsicmp
_CIsqrt
memset
_ftol2
_vsnwprintf
toupper
_i64toa_s
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter

comctl32

ord345
CreatePropertySheetPageW
PropertySheetW
ImageList_Create
ImageList_ReplaceIcon
ord17

shell32

SHGetFileInfoW
ExtractIconExW
ord680
ShellExecuteExW

shlwapi

SHDeleteKeyW
ord487
StrFormatByteSizeW
ord271
StrCmpNW
StrCmpW
StrToIntW
StrStrIW
PathStripToRootW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CreateThread
TerminateProcess

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapSetInformation
GetProcessHeap
HeapFree

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
GetProcAddress
GetModuleHandleExW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
SetErrorMode

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

ReleaseMutex
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
SetEvent
CreateSemaphoreExW
CreateMutexExW
ReleaseSRWLockExclusive
WaitForSingleObjectEx
CreateEventW
ReleaseSemaphore

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-core-com-l1-1-0

CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitializeEx
CoUninitialize
CoTaskMemAlloc

api-ms-win-security-base-l1-1-0

CheckTokenMembership
CreateWellKnownSid

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetTickCount
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetSystemTime

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-file-l1-1-0

GetDiskFreeSpaceExW
GetVolumeInformationW
GetDriveTypeW
GetDiskFreeSpaceW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
Sleep
InitOnceComplete

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegEnumKeyExW
RegGetValueW

oleaut32

VariantInit
SysStringLen
VariantClear

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernel32

GetStartupInfoA
MulDiv
lstrlenW
CheckElevationEnabled

ntdll

RtlNtStatusToDosError
NtOpenProcessToken
NtOpenThreadToken
NtClose
NtQueryInformationToken

ole32

CoInitialize

vssapi

VssFreeSnapshotPropertiesInternal
CreateVssBackupComponentsInternal

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

afb291654f85a34f0ec0dd79ffabc278

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdi32

user32

msvcrt

comctl32

shell32

shlwapi

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

oleaut32

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-profile-l1-1-0

kernel32

ntdll

ole32

vssapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 72KB - Virtual size: 71KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 175KB - Virtual size: 175KB

.reloc Size: 1.3MB - Virtual size: 1.3MB

.text
Size: 72KB - Virtual size: 71KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 175KB - Virtual size: 175KB

.reloc
Size: 1.3MB - Virtual size: 1.3MB