627818fecce9f620a0220ff4a83171d5d3153806b601c0ff9abb64ef54e974d7N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
627818fecce9f620a0220ff4a83171d5d3153806b601c0ff9abb64ef54e974d7N.exe
Size 878KB
Sample250108-q88thasmcv
SHA256 627818fecce9f620a0220ff4a83171d5d3153806b601c0ff9abb64ef54e974d7
MD5 6dd2aa6894636d25cdb5c0382c6cb2d0
SHA1 519d0f25a1740db4a1ad6205005eaa47ff4d2e5a
SHA512 fa7a758dc744a012aca22f00b64198eb2352f5223d6e02697cb39c3bd11768b76275f37975cea2ad7e89cfab84032f925a2b40b471761f4cf90f82678f6c876f
SSDEEP 24576:qM+dje6X14gSYJJaYO89h1tY3BdTk3aV5Hb54RHs:qr91dJJaYO8NtQgaV59ws
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
627818fecce9f620a0220ff4a83171d5d3153806b601c0ff9abb64ef54e974d7N.exe

File Explorer

627818fecce9f620a0220ff4a83171d5d3153806b601c0ff9abb64ef54e974d7N.exe

.exe 878KB

627818fecce9f620a0220ff4a83171d5d3153806b601c0ff9abb64ef54e974d7N.exe

IMPHASH 705958c97a1937f706c668a1c21fefdb
SHA256 627818fecce9f620a0220ff4a83171d5d3153806b601c0ff9abb64ef54e974d7
MD5 6dd2aa6894636d25cdb5c0382c6cb2d0
SHA1 519d0f25a1740db4a1ad6205005eaa47ff4d2e5a
SHA512 fa7a758dc744a012aca22f00b64198eb2352f5223d6e02697cb39c3bd11768b76275f37975cea2ad7e89cfab84032f925a2b40b471761f4cf90f82678f6c876f
SSDEEP 24576:qM+dje6X14gSYJJaYO89h1tY3BdTk3aV5Hb54RHs:qr91dJJaYO8NtQgaV59ws
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

233422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

M:\TWRK\84162e5da40d452f\src\MicrogamingInstall\Release\MicrogamingInstall.pdb

kernel32

lstrcpyA MapViewOfFile UnmapViewOfFile CreateFileMappingA WideCharToMultiByte OutputDebugStringA CreateProcessW WaitForSingleObject OpenProcess Sleep CreateProcessA lstrcmpiA RemoveDirectoryA CopyFileA GetTempFileNameA GetCurrentProcessId GetTempPathA DeleteFileA GetComputerNameA FormatMessageA GetVolumePathNameW CopyFileW FormatMessageW RemoveDirectoryW GetModuleHandleA ReleaseMutex GetDiskFreeSpaceExA GetVersionExA DeleteFileW SetFileAttributesW SetEvent GetPrivateProfileStringW CreateEventA LoadLibraryA CreateMutexA GetDriveTypeA GetVolumeInformationA DeviceIoControl ResetEvent InterlockedDecrement MoveFileExA Process32First TerminateProcess GetSystemDirectoryA GetLocalTime Process32Next CreateToolhelp32Snapshot InterlockedIncrement GetPrivateProfileIntA InterlockedExchange GetExitCodeThread WaitForMultipleObjects GetCurrentThreadId CreateThread CreateSemaphoreA ReleaseSemaphore GetLogicalDriveStringsA GlobalMemoryStatusEx GetSystemInfo GetEnvironmentVariableA SetThreadPriority GetCurrentThread GetThreadTimes ResumeThread InterlockedCompareExchange QueueUserWorkItem OpenFileMappingA lstrcatA CompareStringW GetProcessHeap SetEndOfFile SetStdHandle GetStringTypeW HeapSize FlushFileBuffers GetConsoleMode GetConsoleCP IsProcessorFeaturePresent GetCurrentDirectoryW PeekNamedPipe GetFileInformationByHandle GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW SetHandleCount LCMapStringW GetTimeZoneInformation GetCurrentProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter DeleteCriticalSection InitializeCriticalSectionAndSpinCount SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate GetStdHandle GetFileType WriteConsoleW MoveFileA RaiseException RtlUnwind GetFullPathNameA GetDriveTypeW SetCurrentDirectoryA GetCurrentDirectoryA SetEnvironmentVariableA FindFirstFileExA FileTimeToLocalFileTime FileTimeToSystemTime GetStartupInfoW HeapSetInformation FindNextFileA GetModuleFileNameA FindClose FindFirstFileA CreateDirectoryA lstrlenW GetFileAttributesW GetModuleFileNameW lstrcpynW GetFileAttributesA lstrcpynA CreateFileA lstrlenA GetFileSize LocalFree GetProcAddress MultiByteToWideChar CreateFileW LoadLibraryW CreateDirectoryW FreeLibrary CloseHandle GetLastError ReadFile WriteFile SetFilePointer GetCommandLineA LeaveCriticalSection EnterCriticalSection HeapReAlloc ExitThread GetSystemTimeAsFileTime ExitProcess GetModuleHandleW EncodePointer DecodePointer HeapAlloc HeapFree SetFileAttributesA

user32

PostMessageA RegisterClassA ShowWindow DefWindowProcA CreateWindowExA FlashWindowEx MoveWindow DefWindowProcW SetWindowTextA LoadCursorA AdjustWindowRect EnableWindow UpdateWindow MapWindowPoints LoadImageA IsWindowVisible GetSystemMetrics RegisterClassW MessageBoxW MessageBoxA SetFocus CopyRect wsprintfW InvalidateRect GetDlgCtrlID GetActiveWindow DispatchMessageA CreateWindowExW CreatePopupMenu SetLayeredWindowAttributes GetCursorPos SetWindowPos SetWindowLongW ReleaseDC PeekMessageA AppendMenuW GetWindowLongW SetWindowLongA OffsetRect ChildWindowFromPoint TranslateMessage IsDialogMessageA SendMessageA GetClientRect IsWindowEnabled LoadIconA SetForegroundWindow PostThreadMessageA wsprintfA wvsprintfA SendMessageTimeoutA DestroyWindow GetMessageA GetWindowRect TrackPopupMenu GetWindowDC

gdi32

DeleteDC CreateDIBSection GetDIBits DeleteObject SelectObject CreateCompatibleDC GetStockObject BitBlt

advapi32

RegQueryValueExA RegEnumKeyW OpenSCManagerA CloseServiceHandle OpenServiceA RegSetValueExW RegOpenKeyExW RegQueryValueExW RegSetValueW RegSetValueA RegQueryValueW RegCloseKey GetUserNameA RegOpenKeyExA RegCreateKeyExA RegSetValueExA FreeSid SetEntriesInAclW

shell32

Shell_NotifyIconA SHGetSpecialFolderLocation ShellExecuteA SHGetPathFromIDListW SHGetFolderPathW SHGetMalloc SHChangeNotify SHGetSpecialFolderPathA

ole32

OleInitialize OleCreate OleSetContainedObject StringFromIID OleUninitialize CoCreateInstance CoCreateGuid CoTaskMemAlloc CoSetProxyBlanket CoUninitialize CoInitialize CoTaskMemFree CLSIDFromProgID

oleaut32

VariantTimeToSystemTime VariantCopy VariantChangeType SysStringLen SafeArrayUnaccessData VariantInit SafeArrayAccessData SysAllocString SysAllocStringLen SysFreeString VariantClear SafeArrayCreateVector

wsock32

gethostbyname gethostbyaddr inet_addr ioctlsocket WSACleanup htonl WSAGetLastError htons ntohs getservbyport getservbyname WSASetLastError WSAStartup

wininet

InternetCreateUrlA InternetOpenW InternetOpenUrlW InternetReadFile InternetConnectA InternetGetLastResponseInfoA InternetCrackUrlW HttpSendRequestA HttpQueryInfoA InternetOpenUrlA InternetQueryOptionA InternetCloseHandle InternetOpenA HttpOpenRequestA InternetSetOptionA InternetCrackUrlA

shlwapi

PathAppendA SHDeleteKeyA PathCanonicalizeW PathAppendW StrStrA PathCanonicalizeA

psapi

GetModuleFileNameExA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

ws2_32

WSAAddressToStringA

urlmon

CoInternetGetSession