94f8381d594aba6c3e437775705df6eba8a728403b8063a58b7da54b7ebd00e4N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
94f8381d594aba6c3e437775705df6eba8a728403b8063a58b7da54b7ebd00e4N.exe
Size 643KB
Sample250103-tntevsslay
SHA256 94f8381d594aba6c3e437775705df6eba8a728403b8063a58b7da54b7ebd00e4
MD5 512487411fc46cb1df352576c326c1b0
SHA1 4f8ebee58fe1a34e44f14d3d5b82c115b62a31eb
SHA512 32125555f8bc434f79c40d824fb4a451358fc2f0e838f73a658215ed8d4f978d8939e8e4ccab94e49aecf3a1900beb5a248c8d4bc882fe56fd4993ba55970028
SSDEEP 12288:oj32cnr9X6oq8UtOhVUAS/5M74xSkEoedy9cHN5H1dCTD+:A2cnr9X7ZhKASBuPkEoUEINF7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94f8381d594aba6c3e437775705df6eba8a728403b8063a58b7da54b7ebd00e4N.exe

File Explorer

94f8381d594aba6c3e437775705df6eba8a728403b8063a58b7da54b7ebd00e4N.exe

.exe 643KB

94f8381d594aba6c3e437775705df6eba8a728403b8063a58b7da54b7ebd00e4N.exe

IMPHASH 63b6d640ef299e8f8898cea09b8aa342
SHA256 94f8381d594aba6c3e437775705df6eba8a728403b8063a58b7da54b7ebd00e4
MD5 512487411fc46cb1df352576c326c1b0
SHA1 4f8ebee58fe1a34e44f14d3d5b82c115b62a31eb
SHA512 32125555f8bc434f79c40d824fb4a451358fc2f0e838f73a658215ed8d4f978d8939e8e4ccab94e49aecf3a1900beb5a248c8d4bc882fe56fd4993ba55970028
SSDEEP 12288:oj32cnr9X6oq8UtOhVUAS/5M74xSkEoedy9cHN5H1dCTD+:A2cnr9X7ZhKASBuPkEoUEINF7
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

cmd.pdb

msvcrt

??1type_info@@UAE@XZ memmove _local_unwind4 _setjmp3 memcmp memmove_s _purecall _wpopen _controlfp ?terminate@@YAXXZ __CxxFrameHandler3 _except_handler4_common _onexit __dllonexit _unlock _lock _initterm __setusermatherr __p__fmode _cexit longjmp ??3@YAXPAX@Z _wcsnicmp __set_app_type __getmainargs wcstol _get_osfhandle _amsg_exit _getch __p__commode _XcptFilter calloc free _wcslwr qsort _dup2 _dup _close _open_osfhandle _ultoa swscanf _ultoa_s _pipe wcsncmp _setmode towupper exit iswxdigit time srand _wtol memcpy_s fflush wcsstr iswalpha wcstoul feof wcsspn _tell _errno ??_V@YAXPAX@Z printf rand fprintf wcsrchr realloc towlower _exit setlocale _wcsupr iswdigit _wcsicmp iswspace wcschr fgets _pclose _vsnwprintf ferror __iob_func malloc _callnewh ??0exception@@QAE@ABQBD@Z ??0exception@@QAE@ABQBDH@Z ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ?what@exception@@UBEPBDXZ _CxxThrowException memcpy memset

ntdll

NtOpenProcessToken NtQueryInformationToken NtClose NtOpenThreadToken NtFsControlFile RtlDosPathNameToNtPathName_U RtlFindLeastSignificantBit RtlFreeHeap RtlReleaseRelativeName NtOpenFile RtlDosPathNameToRelativeNtPathName_U_WithStatus NtSetInformationFile NtQueryVolumeInformationFile NtSetInformationProcess NtQueryInformationProcess RtlNtStatusToDosError NtCancelSynchronousIoFile RtlCreateUnicodeStringFromAsciiz RtlFreeUnicodeString

api-ms-win-core-kernel32-legacy-l1-1-0

GetConsoleWindow CopyFileW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetProcAddress GetModuleFileNameW LoadLibraryExW GetModuleHandleExW GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

ReleaseMutex CreateSemaphoreExW ReleaseSRWLockExclusive InitializeCriticalSection TryAcquireSRWLockExclusive DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection ReleaseSemaphore AcquireSRWLockExclusive WaitForSingleObjectEx EnterCriticalSection OpenSemaphoreW AcquireSRWLockShared ReleaseSRWLockShared CreateMutexExW WaitForSingleObject

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapReAlloc HeapFree HeapSize HeapAlloc HeapSetInformation

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter SetErrorMode GetLastError SetLastError

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer SetThreadpoolTimer CreateThreadpoolTimer WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

TerminateProcess CreateProcessW CreateProcessAsUserW GetStartupInfoW OpenThread UpdateProcThreadAttribute InitializeProcThreadAttributeList GetExitCodeProcess GetCurrentProcessId GetCurrentThreadId DeleteProcThreadAttributeList ResumeThread GetCurrentProcess

api-ms-win-core-localization-l1-2-0

SetThreadLocale GetUserDefaultLCID GetACP GetCPInfo GetLocaleInfoW GetThreadLocale FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak OutputDebugStringW IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-memory-l1-1-0

VirtualAlloc VirtualFree VirtualQuery ReadProcessMemory

api-ms-win-core-console-l1-1-0

ReadConsoleW WriteConsoleW GetConsoleMode SetConsoleMode SetConsoleCtrlHandler GetConsoleOutputCP

api-ms-win-core-file-l1-1-0

FindFirstFileW FindNextFileW FlushFileBuffers SetFileAttributesW GetFileAttributesExW GetFullPathNameW FindClose GetDriveTypeW CreateFileW FileTimeToLocalFileTime WriteFile SetFilePointer GetFileAttributesW ReadFile SetEndOfFile SetFileTime GetVolumePathNameW GetFileSize CreateDirectoryW GetFileType FindFirstFileExW GetDiskFreeSpaceExW GetVolumeInformationW CompareFileTime RemoveDirectoryW SetFilePointerEx DeleteFileW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle ExpandEnvironmentStringsW SearchPathW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentDirectoryW SetEnvironmentStringsW GetCommandLineW GetEnvironmentStringsW SetCurrentDirectoryW FreeEnvironmentStringsW

api-ms-win-core-console-l2-1-0

FillConsoleOutputCharacterW SetConsoleCursorPosition SetConsoleTextAttribute FillConsoleOutputAttribute GetConsoleScreenBufferInfo FlushConsoleInputBuffer ScrollConsoleScreenBufferW

api-ms-win-security-base-l1-1-0

GetFileSecurityW RevertToSelf GetSecurityDescriptorOwner

api-ms-win-core-sysinfo-l1-1-0

SetLocalTime GetLocalTime GetSystemTime GetTickCount GetSystemTimeAsFileTime GetVersion GetWindowsDirectoryW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime SystemTimeToFileTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-systemtopology-l1-1-0

GetNumaNodeProcessorMaskEx GetNumaHighestNodeNumber

api-ms-win-core-console-l2-2-0

GetConsoleTitleW SetConsoleTitleW

api-ms-win-core-processenvironment-l1-2-0

NeedCurrentDirectoryForExePathW

api-ms-win-core-registry-l1-1-0

RegSetValueExW RegCreateKeyExW RegDeleteValueW RegDeleteKeyExW RegEnumKeyExW RegQueryValueExW RegCloseKey RegOpenKeyExW

api-ms-win-core-file-l2-1-0

MoveFileExW CreateSymbolicLinkW MoveFileWithProgressW CreateHardLinkW GetFileInformationByHandleEx

api-ms-win-core-heap-l2-1-0

GlobalFree LocalFree GlobalAlloc

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-winrt-l1-1-0

RoUninitialize RoInitialize

api-ms-win-core-processtopology-l1-1-0

GetThreadGroupAffinity

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW lstrcmpW

api-ms-win-core-processtopology-obsolete-l1-1-0

SetProcessAffinityMask

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

189KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

408KB

Virtual Size

1004KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

94f8381d594aba6c3e437775705df6eba8a728403b8063a58b7da54b7ebd00e4N.exe

msvcrt

ntdll

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processtopology-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic