20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe
Size 5.2MB
Sample250112-wd1gjaslax
SHA256 20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d
MD5 c8dd54784fb1b6cbd16cec060487fb8f
SHA1 aa8e0f879f1b6a0d83d2657e86cca4b66d8235cf
SHA512 8237a7b7142ec7155f66a8e02de2913f17139eb0f80235376e93cd3b7dbd60f3e48d427cc5f54575b2dcbd83868407d7d534f775ff8eec6b37cee5eaefac9765
SSDEEP 49152:1Ew0dMICHvoBWdKD27GidOx1Sjq+WSGeDfT2bjYqCFhkFDGgvDYldWxjvbbISmEj:7cSqGcF7lZ2uGUj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe

File Explorer

20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe

.exe 5.2MB

20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d.exe

IMPHASH 3618f5646ce04014e413d2930595cbc4
SHA256 20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d
MD5 c8dd54784fb1b6cbd16cec060487fb8f
SHA1 aa8e0f879f1b6a0d83d2657e86cca4b66d8235cf
SHA512 8237a7b7142ec7155f66a8e02de2913f17139eb0f80235376e93cd3b7dbd60f3e48d427cc5f54575b2dcbd83868407d7d534f775ff8eec6b37cee5eaefac9765
SSDEEP 49152:1Ew0dMICHvoBWdKD27GidOx1Sjq+WSGeDfT2bjYqCFhkFDGgvDYldWxjvbbISmEj:7cSqGcF7lZ2uGUj
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3592940

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dev.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetOverlappedResult ReadFile SetFileCompletionNotificationModes Sleep GetModuleHandleA GetCurrentThreadId FreeEnvironmentStringsW DeleteProcThreadAttributeList CompareStringOrdinal GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SwitchToThread PostQueuedCompletionStatus SetWaitableTimer WaitForSingleObject QueryPerformanceCounter GetSystemInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetQueuedCompletionStatusEx GetCommandLineW SetFileInformationByHandle SetFilePointerEx CreateIoCompletionPort IsProcessorFeaturePresent GetStdHandle GetCurrentProcessId WriteFileEx SleepEx GetExitCodeProcess GetModuleHandleW QueryPerformanceFrequency GetProcAddress HeapFree HeapReAlloc ReleaseMutex FindNextFileW FindClose CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileW DeleteFileW GetFinalPathNameByHandleW CopyFileExW CreateEventW CancelIo GetConsoleMode FormatMessageW GetModuleFileNameW ExitProcess CreateNamedPipeW ReadFileEx WaitForMultipleObjects GetFullPathNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute MultiByteToWideChar WriteConsoleW WideCharToMultiByte CreateThread GetProcessHeap HeapAlloc WaitForSingleObjectEx LoadLibraryA CreateMutexA GetCurrentProcess SetHandleInformation DuplicateHandle GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent lstrlenW UnhandledExceptionFilter SetUnhandledExceptionFilter CloseHandle CreateWaitableTimerExW

user32

SystemParametersInfoW

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey SystemFunction036

ws2_32

send recv shutdown ioctlsocket connect bind WSASocketW getsockname getpeername getsockopt setsockopt WSAIoctl WSAGetLastError WSAStartup WSACleanup getaddrinfo closesocket WSASend freeaddrinfo

secur32

ApplyControlToken AcquireCredentialsHandleA QueryContextAttributesW EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW DecryptMessage FreeCredentialsHandle DeleteSecurityContext

crypt32

CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CertFreeCertificateContext CertFreeCertificateChain CertDuplicateCertificateChain CertEnumCertificatesInStore CertAddCertificateContextToStore CertDuplicateStore CertGetCertificateChain CertCloseStore CertOpenStore

ntdll

NtCancelIoFileEx NtReadFile NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtWriteFile

bcrypt

BCryptGenRandom

vcruntime140

memcmp __current_exception_context memset __current_exception memcpy memmove __CxxFrameHandler3 _CxxThrowException __C_specific_handler

api-ms-win-crt-math-l1-1-0

powf pow round roundf truncf ceil exp2f __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _initialize_narrow_environment _get_initial_narrow_environment _configure_narrow_argv _set_app_type _initterm _initterm_e _register_onexit_function terminate _initialize_onexit_table exit _exit _seh_filter_exe __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode