a005f910ff794228959e0b07494fb2e4bf7768e3e13fecc29f07a51fc8a43743N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
a005f910ff794228959e0b07494fb2e4bf7768e3e13fecc29f07a51fc8a43743N.exe
Size 253KB
Sample241128-11sgnasmhz
SHA256 a005f910ff794228959e0b07494fb2e4bf7768e3e13fecc29f07a51fc8a43743
MD5 9dcf0cf8ae68919e23ab886fae28c900
SHA1 e15ac1261029f14e21ba484c5d8aac4d2f6024c3
SHA512 0cb1c91a319f7bb2fd935055044027c6ad05f216f071382a7d055fad1f3c2766d5f987df029089c608af9c5608a5ac43df84cf95f75e938f15733a54968d08e2
SSDEEP 6144:CdbC+2kY+FP736r7icB/4OgqZMtqJlXH6Cgv:ru3s7icZ/TytYaLv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a005f910ff794228959e0b07494fb2e4bf7768e3e13fecc29f07a51fc8a43743N.exe

File Explorer

a005f910ff794228959e0b07494fb2e4bf7768e3e13fecc29f07a51fc8a43743N.exe

.exe 253KB

a005f910ff794228959e0b07494fb2e4bf7768e3e13fecc29f07a51fc8a43743N.exe

IMPHASH 247d2f1e48398c3827503373fce846d5
SHA256 a005f910ff794228959e0b07494fb2e4bf7768e3e13fecc29f07a51fc8a43743
MD5 9dcf0cf8ae68919e23ab886fae28c900
SHA1 e15ac1261029f14e21ba484c5d8aac4d2f6024c3
SHA512 0cb1c91a319f7bb2fd935055044027c6ad05f216f071382a7d055fad1f3c2766d5f987df029089c608af9c5608a5ac43df84cf95f75e938f15733a54968d08e2
SSDEEP 6144:CdbC+2kY+FP736r7icB/4OgqZMtqJlXH6Cgv:ru3s7icZ/TytYaLv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

62190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msiexec.pdb

msvcrt

_vsnwprintf wcsrchr _except_handler3 _c_exit _exit _XcptFilter _cexit exit _controlfp _onexit __dllonexit __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _vsnprintf

advapi32

SetSecurityDescriptorOwner StartServiceCtrlDispatcherW OpenThreadToken RevertToSelf GetTokenInformation MakeAbsoluteSD RegGetKeySecurity GetSecurityDescriptorOwner EqualSid RegisterServiceCtrlHandlerW SetServiceStatus RegEnumKeyExW CreateServiceW OpenSCManagerW OpenServiceW ControlService QueryServiceStatus DeleteService CloseServiceHandle SetThreadToken RegEnumKeyW RegOpenKeyExW RegCreateKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken GetLengthSid AllocateAndInitializeSid FreeSid MakeSelfRelativeSD GetSecurityDescriptorLength SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor GetAce AddAccessAllowedAce InitializeAcl RegCloseKey RegSetValueExW RegDeleteKeyW RegQueryValueExW RegDeleteValueW

kernel32

CompareStringW GetFileType GetStdHandle GetCommandLineW ExitProcess SetConsoleCtrlHandler CreateThread GetUserDefaultLangID GetSystemDirectoryW GetModuleHandleW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess SetUnhandledExceptionFilter GetModuleHandleA GetStartupInfoA GlobalAlloc lstrlenW lstrcmpiW InterlockedExchange GetLastError CloseHandle GetCurrentProcess Sleep GetVersionExW GetEnvironmentVariableW GetProcAddress LoadLibraryW InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar lstrcpynW lstrcpynA WideCharToMultiByte SetLastError GetCurrentThread GlobalFree FreeLibrary UnhandledExceptionFilter WaitForSingleObject CreateProcessW GetModuleFileNameW lstrcmpW FormatMessageA GetSystemDefaultLangID LoadLibraryExW WriteFile FormatMessageW GetLocaleInfoW GetACP GetUserDefaultUILanguage SetCurrentDirectoryW OutputDebugStringW LeaveCriticalSection EnterCriticalSection OpenProcess CreateEventW OpenEventW

user32

PostQuitMessage TranslateMessage DispatchMessageW PeekMessageW GetMessageW IsCharAlphaNumericW PostThreadMessageW MsgWaitForMultipleObjects

ntdll

NtQueryInformationProcess

ole32

CoUninitialize StgOpenStorage CoInitialize CoRevokeClassObject CoRegisterClassObject

msi

ord197 ord280 ord190 ord70 ord141 ord199 ord88 ord131 ord184 ord175 ord240 ord222 ord196 ord169 ord78 ord148 ord136 ord8 ord228