0b0f022ba403f75b63a527156dcaa4b6538f22cc1aa8daf8d6ac9112f19ac8cf[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
0b0f022ba403f75b63a527156dcaa4b6538f22cc1aa8daf8d6ac9112f19ac8cf.exe
Size 208KB
Sample241126-cfmtnsyjdw
SHA256 0b0f022ba403f75b63a527156dcaa4b6538f22cc1aa8daf8d6ac9112f19ac8cf
MD5 642563d31ec1d6ccf29bcadea40eb23c
SHA1 42360c9524db86ce13d0255c17538b73d385dea7
SHA512 f3b75802f3a9583d574df5012db2b739ba5f5acc933941a96c07954741ef8f87afe288183dd2f654de48813cec35a3d753dae944f4636599507a8aae98785a04
SSDEEP 6144:Pa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkg:PbapK0JCmRcU9vVokfB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b0f022ba403f75b63a527156dcaa4b6538f22cc1aa8daf8d6ac9112f19ac8cf.exe

File Explorer

0b0f022ba403f75b63a527156dcaa4b6538f22cc1aa8daf8d6ac9112f19ac8cf.exe

.exe 208KB

0b0f022ba403f75b63a527156dcaa4b6538f22cc1aa8daf8d6ac9112f19ac8cf.exe

IMPHASH e391eee2fda3671a828f8ce7165ca399
SHA256 0b0f022ba403f75b63a527156dcaa4b6538f22cc1aa8daf8d6ac9112f19ac8cf
MD5 642563d31ec1d6ccf29bcadea40eb23c
SHA1 42360c9524db86ce13d0255c17538b73d385dea7
SHA512 f3b75802f3a9583d574df5012db2b739ba5f5acc933941a96c07954741ef8f87afe288183dd2f654de48813cec35a3d753dae944f4636599507a8aae98785a04
SSDEEP 6144:Pa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkg:PbapK0JCmRcU9vVokfB
MD5 SHA1 SHA512 SSDEEP

windows:2 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SearchPathA GetModuleHandleW ConnectNamedPipe GetModuleFileNameA EnumTimeFormatsW SuspendThread GetWindowsDirectoryW GetPriorityClass lstrlen CreateThread GetSystemDefaultLangID FlushFileBuffers ReadDirectoryChangesW GetDateFormatA BeginUpdateResourceW FreeResource GetSystemDirectoryA CreateMutexW GetModuleFileNameW GetModuleHandleA LoadLibraryW FatalAppExitA SetLocaleInfoW GetProcessHeap GetDiskFreeSpaceA GetProcAddress FindResourceA GetOEMCP lstrcpyW GetThreadPriority GlobalGetAtomNameW MoveFileW CompareStringA LocalFree MultiByteToWideChar GetVersionExW GetACP

user32

LoadMenuIndirectA UnregisterClassW GetClassInfoExW RegisterClassA GetClassNameA LoadMenuW DefDlgProcW SetWindowRgn GetParent DialogBoxIndirectParamA LoadMenuA GetClassInfoW DrawTextW CreateDialogIndirectParamW wvsprintfA LoadCursorW EnumWindows DialogBoxIndirectParamW CharNextW FindWindowW GetDCEx GetSysColor GetMenuStringW GetTopWindow LoadBitmapA TrackPopupMenuEx AppendMenuW InsertMenuItemA GetWindowRect MessageBoxW SetActiveWindow EnumDesktopsA CreatePopupMenu FindWindowA MessageBoxIndirectW CreateAcceleratorTableW CharLowerA DeleteMenu GetForegroundWindow EnumDesktopWindows EnumDesktopsW CopyRect OpenClipboard GetDlgItemTextW GetWindowLongW GetMenuItemCount CheckDlgButton CreateAcceleratorTableA WaitForInputIdle DialogBoxParamW PostQuitMessage GetActiveWindow CreateCaret RegisterWindowMessageW GetClassNameW GetMenuItemInfoA EndMenu WinHelpA SetCapture SetTimer CreateMenu CreateDialogParamA SendDlgItemMessageA LoadCursorA DefWindowProcW EnumDesktopsA SetMenu

gdi32

GetBrushOrgEx StrokeAndFillPath CreateFontW GetEnhMetaFilePixelFormat GetPixel GetViewportOrgEx CreateDCA CopyMetaFileW AbortPath RemoveFontResourceA GetKerningPairsA EnumFontFamiliesExW AddFontResourceW Rectangle GetDeviceGammaRamp PolyPolygon RectInRegion GetGlyphIndicesA CreatePolygonRgn SetColorSpace SetMetaFileBitsEx CreateBitmap OffsetRgn EndDoc CreateDIBPatternBrush PlayEnhMetaFile RestoreDC GetCharWidth32W PaintRgn StartFormPage

advapi32

RegDeleteKeyW RegOpenKeyA RegQueryMultipleValuesW RegEnumValueW RegSetValueA RegEnumKeyExA RegCreateKeyExA RegRestoreKeyW RegCloseKey RegEnumKeyA RegEnumKeyW RegDeleteValueA RegQueryValueW RegReplaceKeyW RegFlushKey CryptSetProviderA RegOpenKeyW RegEnumValueA

shell32

ExtractIconExA

comctl32

ImageList_SetImageCount ImageList_Duplicate FlatSB_EnableScrollBar DllGetVersion ImageList_SetBkColor InitCommonControls ImageList_GetBkColor

comdlg32

FindTextA LoadAlterBitmap ReplaceTextW GetFileTitleW GetSaveFileNameW ReplaceTextA

oleaut32

VarR8FromDisp VarUI1FromStr VarDateFromUI8 OleLoadPictureFile VarUI1FromDisp VarUI8FromCy

wininet

GopherGetLocatorTypeA ShowCertificate HttpQueryInfoA SetUrlCacheHeaderData FindFirstUrlCacheContainerA GetUrlCacheEntryInfoA FindNextUrlCacheContainerA DeleteUrlCacheEntry InternetGetConnectedState GetUrlCacheConfigInfoW InternetConfirmZoneCrossing InternetGetConnectedStateEx InternetCreateUrlA CreateUrlCacheEntryA InternetSetPerSiteCookieDecisionW InternetSetOptionW RetrieveUrlCacheEntryFileW FindCloseUrlCache UrlZonesDetach

urlmon

IsValidURL CoInternetCreateSecurityManager URLDownloadToCacheFileW Extract MkParseDisplayNameEx GetMarkOfTheWeb CopyStgMedium HlinkNavigateMoniker

wsock32

GetAddressByNameA GetAddressByNameW s_perror WSAAsyncGetProtoByNumber socket WSAAsyncGetHostByName send AcceptEx shutdown

crypt32

CertFreeCRLContext CertGetIntendedKeyUsage CertGetNameStringW PFXExportCertStoreEx CryptVerifyMessageHash CertGetIssuerCertificateFromStore I_CryptEnableLruOfEntries I_CryptGetAsn1Decoder CertEnumSystemStoreLocation I_CryptSetTls

Name

.ehkoKk

Size

2KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.WbOYt

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.jVQpnF

Size

1KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.MAgzG

Size

109KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0b0f022ba403f75b63a527156dcaa4b6538f22cc1aa8daf8d6ac9112f19ac8cf.exe

kernel32

user32

gdi32

advapi32

shell32

comctl32

comdlg32

oleaut32

wininet

urlmon

wsock32

crypt32

generic