c79cbf63cee774ce8b02a785ad7ffbc956bd417c42598cd31e382aa88f2a6add[.]exe

General

Target
c79cbf63cee774ce8b02a785ad7ffbc956bd417c42598cd31e382aa88f2a6add.exe
Size 12.8MB
Sample241123-bfp4cstndx
SHA256 c79cbf63cee774ce8b02a785ad7ffbc956bd417c42598cd31e382aa88f2a6add
MD5 75aaf5422bdf991928937b7d656080f5
SHA1 425ccba2469fc3bfad5ca0a9b5f3a1f8a6acac6c
SHA512 a4e45f29c106e3c166c887d44e349940ce581ea07eed15b1f465a30ccbae470e586c9cee37de85a8dd4bf6253f07bf272fac5bf9114601a25c78865b2a75ecc2
SSDEEP 49152:cN8888888888888888888888888888888888888888888888888888888888888u:0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c79cbf63cee774ce8b02a785ad7ffbc956bd417c42598cd31e382aa88f2a6add.exe

File Explorer

c79cbf63cee774ce8b02a785ad7ffbc956bd417c42598cd31e382aa88f2a6add.exe

.exe 12.8MB

c79cbf63cee774ce8b02a785ad7ffbc956bd417c42598cd31e382aa88f2a6add.exe

IMPHASH e418f9c169f00a46b8096afe30308269
SHA256 c79cbf63cee774ce8b02a785ad7ffbc956bd417c42598cd31e382aa88f2a6add
MD5 75aaf5422bdf991928937b7d656080f5
SHA1 425ccba2469fc3bfad5ca0a9b5f3a1f8a6acac6c
SHA512 a4e45f29c106e3c166c887d44e349940ce581ea07eed15b1f465a30ccbae470e586c9cee37de85a8dd4bf6253f07bf272fac5bf9114601a25c78865b2a75ecc2
SSDEEP 49152:cN8888888888888888888888888888888888888888888888888888888888888u:0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8437

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\kusataf-vucexol.pdb

kernel32

EndUpdateResourceW GetEnvironmentStringsW SetEvent FlushViewOfFile ReadConsoleW GlobalAlloc Sleep InitAtomTable HeapCreate WriteConsoleW GetAtomNameW GetModuleFileNameW CreateActCtxA SetConsoleTitleA SetProcessAffinityMask DeactivateActCtx SetLastError GetProcAddress VirtualAlloc BeginUpdateResourceW LoadLibraryA SetEnvironmentVariableA GetModuleFileNameA GetOEMCP CreateIoCompletionPort GetCPInfoExA SetProcessShutdownParameters Module32Next ReleaseMutex GetVersionExA FindNextVolumeA lstrcpyW LCMapStringW CreateFileW SetTapePosition HeapReAlloc IsProcessorFeaturePresent EncodePointer DecodePointer GetModuleHandleW ExitProcess GetCommandLineW HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId GetLastError InterlockedDecrement HeapAlloc ReadFile EnterCriticalSection LeaveCriticalSection HeapFree SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection SetFilePointer GetCPInfo GetACP IsValidCodePage CloseHandle LoadLibraryW WriteFile FreeEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WideCharToMultiByte GetConsoleCP GetConsoleMode MultiByteToWideChar RtlUnwind SetStdHandle FlushFileBuffers GetStringTypeW HeapSize RaiseException

user32

ClientToScreen

gdi32

GetBitmapBits

winhttp

WinHttpQueryOption

Sharing