2fd2952201c8bbbe3a43f5dcbd7814f3bbb5f455b53691af621e9437c5420c1dN[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2fd2952201c8bbbe3a43f5dcbd7814f3bbb5f455b53691af621e9437c5420c1dN.exe
Size 600KB
Sample250102-fy1p2avpg1
SHA256 2fd2952201c8bbbe3a43f5dcbd7814f3bbb5f455b53691af621e9437c5420c1d
MD5 e18b661db533c1178b3430d50bacc490
SHA1 3dc300ac8d4abd9f83e4b21d6cbc7a23af14afa9
SHA512 fbe77337109cac98d15a4898b9bbc23221ce68de79200f017686dba75cac89ee451e384f103c6ddffc6d209eae93453bfe1322a982e9e6037a8147d6bb378778
SSDEEP 12288:gl9nkB1Rext9dUVa/tv3R/rVOTXQJ+RG/Rgc:gl9nFPKVan/8TXhOqc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2fd2952201c8bbbe3a43f5dcbd7814f3bbb5f455b53691af621e9437c5420c1dN.exe

File Explorer

2fd2952201c8bbbe3a43f5dcbd7814f3bbb5f455b53691af621e9437c5420c1dN.exe

.exe 600KB

2fd2952201c8bbbe3a43f5dcbd7814f3bbb5f455b53691af621e9437c5420c1dN.exe

IMPHASH 1b96e8756fc58e22b39f9aea486522af
SHA256 2fd2952201c8bbbe3a43f5dcbd7814f3bbb5f455b53691af621e9437c5420c1d
MD5 e18b661db533c1178b3430d50bacc490
SHA1 3dc300ac8d4abd9f83e4b21d6cbc7a23af14afa9
SHA512 fbe77337109cac98d15a4898b9bbc23221ce68de79200f017686dba75cac89ee451e384f103c6ddffc6d209eae93453bfe1322a982e9e6037a8147d6bb378778
SSDEEP 12288:gl9nkB1Rext9dUVa/tv3R/rVOTXQJ+RG/Rgc:gl9nFPKVan/8TXhOqc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ALG.pdb

msvcrt

_adjust_fdiv __p__commode __p__fmode memmove _wcsicmp __setusermatherr _initterm __wgetmainargs _wcmdln exit _cexit _XcptFilter _exit _c_exit _purecall __CxxFrameHandler ??2@YAPAXI@Z __set_app_type _except_handler3 __dllonexit _onexit _controlfp isdigit ??3@YAXPAX@Z

atl

ord21 ord32 ord20 ord17 ord23 ord16

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryValueExW StartServiceCtrlDispatcherW RegNotifyChangeKeyValue RegisterServiceCtrlHandlerW SetServiceStatus RegCloseKey SystemFunction036

kernel32

GetStartupInfoW GetModuleHandleA CreateThread UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime CreateTimerQueueTimer ReadFile GetCurrentProcessId WriteFile BindIoCompletionCallback UnregisterWait RegisterWaitForSingleObject HeapAlloc DeleteTimerQueueTimer GetProcessHeap HeapFree DuplicateHandle GetCurrentProcess QueryPerformanceCounter GetTickCount SetUnhandledExceptionFilter EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetLastError CreateTimerQueue DeleteCriticalSection InterlockedIncrement InterlockedDecrement DeleteTimerQueueEx CloseHandle Sleep WaitForMultipleObjects CreateEventW WaitForSingleObject SetEvent GetCurrentThreadId

ole32

CoCreateInstance CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitializeEx CLSIDFromString

oleaut32

SysFreeString SysAllocString

wsock32

getpeername getsockname ord1142 WSAStartup setsockopt WSACleanup htons listen closesocket ioctlsocket WSAGetLastError htonl ord1141 bind ntohs

ws2_32

WSAEnumNetworkEvents WSAConnect WSAEventSelect WSASocketW